29 lines
1.4 KiB
Markdown
29 lines
1.4 KiB
Markdown
# runtime_sources
|
|
|
|
Source-of-truth inputs for `make runtime-bundle`.
|
|
|
|
Current state:
|
|
- `build/runtime_sources/` contains the real materialized runtime inputs used to build the packaged bundle.
|
|
- the checked-in tracked files under `runtime_sources/linux-x86_64/` are build recipes and lock metadata, not the materialized binaries/images.
|
|
- `guest/pyro_guest_agent.py` is the guest agent artifact that should ultimately be installed into each real rootfs.
|
|
- real source materialization now writes into `build/runtime_sources/`, not back into the tracked placeholder files.
|
|
|
|
Materialization workflow:
|
|
1. `make runtime-fetch-binaries`
|
|
2. `make runtime-build-kernel-real`
|
|
3. `make runtime-build-rootfs-real`
|
|
4. `make runtime-bundle`
|
|
|
|
Build requirements for the real path:
|
|
- `docker`
|
|
- outbound network access to GitHub and Debian snapshot mirrors
|
|
- enough disk for a kernel build plus 2G ext4 images per profile
|
|
|
|
Current status:
|
|
1. Firecracker and Jailer are materialized from pinned official release artifacts.
|
|
2. The kernel and rootfs images are built from pinned inputs into `build/runtime_sources/`.
|
|
3. The guest agent is installed into each rootfs and used for vsock exec.
|
|
4. `runtime.lock.json` now advertises real guest capabilities.
|
|
|
|
Safety rule:
|
|
- The build pipeline should never emit `vm_boot=true`, `guest_exec=true`, or `guest_network=true` while any source artifact is still a shim or placeholder.
|