Fix multi-arch build (drop systemd via dbus-x11 + elogind), add s6-overlay, bump Anchore#4
Draft
kjake wants to merge 7 commits into
Draft
Fix multi-arch build (drop systemd via dbus-x11 + elogind), add s6-overlay, bump Anchore#4kjake wants to merge 7 commits into
kjake wants to merge 7 commits into
Conversation
The multi-arch Docker build fails on linux/ppc64le with 'qemu-ppc64le: QEMU internal SIGSEGV' while configuring the systemd package. This is a regression in newer (v9.x) QEMU shipped by tonistiigi/binfmt:latest, which docker/setup-qemu-action uses by default. Pin to the last known-good QEMU image so all target platforms continue to build.
anchore/scan-action@v3 installs an old Grype (v0.74.4) that pulls a
vulnerability DB schema Anchore no longer updates, so the scan fails
with 'the vulnerability database was built 12 weeks ago (max allowed
age is 5 days)' and writes an empty results.sarif, which then breaks
the SARIF upload ('Unexpected end of JSON input').
Bump to anchore/scan-action@v6, which uses a current Grype with an
up-to-date DB. v6 no longer writes a fixed results.sarif path, so
reference the generated file via the step's 'sarif' output.
kjake
changed the title
The real cause of the failing Docker build is systemd's postinst maintainer script misbehaving under QEMU user-mode emulation: it segfaults on ppc64le (with newer QEMU) and deadlocks on arm64 (hung ~3h at 'Setting up systemd (260.1-1)' with the pinned QEMU). Pinning QEMU only moved the failure between architectures. systemd is pulled in only as a transitive dependency and is never run in this container (the entrypoint launches netatalk directly), so stub the helpers its postinst invokes (systemctl, systemd-sysusers, systemd-tmpfiles, systemd-hwdb, systemd-machine-id-setup) via dpkg-divert for the duration of the install, add a permissive policy-rc.d, then restore the real binaries afterwards.
kjake
changed the title
This reverts commit 2f7ee75.
netatalk 4.5 hard-depends on the Spotlight stack (localsearch/tinysparql), which requires a D-Bus session bus. Apt satisfied that with dbus-user-session, pulling libpam-systemd -> systemd, whose postinst hangs/segfaults under QEMU during the multi-arch build. systemd is never run in this container. Install dbus-x11 (an alternative provider of default-dbus-session-bus) so the session-bus dependency is met without systemd. A build-time guard fails the build if real systemd is ever pulled in again.
dbus-x11 removed the session-bus path to systemd, but the dbus system bus (dbus-system-bus-common) still pulled systemd via its default-logind|logind dependency. Install elogind to satisfy logind without systemd, and make the build-time guard print the exact dependency lines still pulling systemd.
kjake
changed the title
Replace the single-process docker-entrypoint.sh with s6-overlay so the
container has a real init: zombie reaping, signal forwarding and
restart-on-crash for each service.
- Install s6-overlay v3.2.1.0, mapping TARGETARCH/TARGETVARIANT to the
matching release asset for all built platforms.
- /etc/cont-init.d/10-setup: one-shot user/share/afp.conf init (the old
entrypoint logic, minus launching daemons).
- /etc/services.d/{dbus,avahi,netatalk}: supervised long-running services;
avahi/netatalk wait for the system bus socket before starting, and avahi
stays opt-in via AVAHI=1.
- ENTRYPOINT is now /init; S6_BEHAVIOUR_IF_STAGE2_FAILS=2 aborts the boot
if one-time init fails.
kjake
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Three changes:
systemdout of the image.1. Drop systemd → fixes the QEMU build hang
The
Build and pushjob hung/failed becausesystemd's postinst misbehaves under QEMU user-mode emulation — segfault on ppc64le (newer QEMU), deadlock on arm64 (observed ~3h frozen atSetting up systemd). Pinning QEMU only moved the failure between arches; stubbing the postinst is a dead end (its helpers are required fordpkgto configure the package, so stubbing breaks even the native build).systemdis never run here — it's only pulled transitively:netatalk4.5 → Spotlight stack (localsearch/tinysparql) → D-Bus session bus, and the D-Bus system bus needs alogindprovider. apt satisfied both withdbus-user-session→libpam-systemd→systemd. We satisfy them the systemd-free way instead:dbus-x11— alternative provider ofdefault-dbus-session-bus.elogind— systemd-freelogindimplementation.A build-time guard fails the build (printing the offending dependency line) if
systemdis ever pulled back in.✅ Validated: native build green with the guard satisfied, and the full 7-arch multi-arch build completed in ~17 min (run on commit
6f9231f), versus the prior 3-hour hang.2. s6-overlay supervision
Replaces the single-process
docker-entrypoint.shwith s6-overlay v3.2.1.0 as a real init (zombie reaping, signal forwarding, restart-on-crash):TARGETARCH/TARGETVARIANTmapped to the right release asset for all 7 platforms./etc/cont-init.d/10-setup— one-shot user/share/afp.confinit (the old entrypoint logic, minus launching daemons)./etc/services.d/{dbus,avahi,netatalk}— supervised services; avahi/netatalk wait for the system-bus socket; avahi stays opt-in viaAVAHI=1.ENTRYPOINTis now/init;S6_BEHAVIOUR_IF_STAGE2_FAILS=2.AFP_USER/AFP_PASSWORD,AVAHI=1, mount a share, connect from a Mac, and (optionally) check Time Machine.3. Anchore scan
anchore/scan-action@v3shipped an old Grype whose DB schema Anchore no longer updates → scan errored, emptyresults.sarif, upload failed. Bumped toanchore/scan-action@v6, referencing the SARIF via the step output. ✅ Green on this PR.Notes
tonistiigi/binfmt:qemu-v8.1.5) is retained as cheap insurance; likely droppable now that systemd is gone.master.https://claude.ai/code/session_01YDL1TGTyUBpnLaQ2SZxwxV