metal-stack · Sven-Ric · Jul 22, 2026
@@ -38,3 +38,30 @@ jobs:
         sbom: true
         file: images/sonic/base-${{ matrix.versions.name }}/Dockerfile
         tags: ${{ env.REGISTRY }}/metal-stack/mini-lab-sonic-base:${{ matrix.versions.name }}
+
+  build-mini-lab-sonic-container-base-image:
+    name: build mini-lab-sonic-container base image
+    runs-on: ubuntu-latest
+
+    strategy:
+      matrix:
+        versions:
+          - name: "202505"
+
+    steps:
+    - name: Log in to the container registry
+      uses: docker/login-action@v3
+      with:
+        registry: ${{ env.REGISTRY }}
+        username: ${{ secrets.DOCKER_REGISTRY_USER }}
+        password: ${{ secrets.DOCKER_REGISTRY_TOKEN }}
+
+    # the docker-sonic-vs artifact is a gzipped `docker save` archive, so it
+    # is loaded and re-tagged instead of being built from a Dockerfile
+    - name: Download, load and push docker-sonic-vs
+      run: |
+        curl -fL -o docker-sonic-vs.gz \
+          "https://sonic-build.azurewebsites.net/api/sonic/artifacts?branchName=${{ matrix.versions.name }}&platform=vs&target=target%2Fdocker-sonic-vs.gz"
+        docker load -i docker-sonic-vs.gz
+        docker tag docker-sonic-vs:latest ${{ env.REGISTRY }}/metal-stack/mini-lab-sonic-container-base:${{ matrix.versions.name }}
+        docker push ${{ env.REGISTRY }}/metal-stack/mini-lab-sonic-container-base:${{ matrix.versions.name }}
@@ -94,12 +94,54 @@ jobs:
         cache-from: type=registry,ref=${{ env.MINI_LAB_SONIC_IMAGE }}
         cache-to: type=inline
 
+  build-mini-lab-sonic-container-image:
+    name: Build mini-lab-sonic-container image
+    runs-on: ubuntu-latest
+
+    steps:
+    - name: Log in to the container registry
+      uses: docker/login-action@v3
+      with:
+        registry: ${{ env.REGISTRY }}
+        username: ${{ secrets.DOCKER_REGISTRY_USER }}
+        password: ${{ secrets.DOCKER_REGISTRY_TOKEN }}
+
+    - name: Checkout
+      uses: actions/checkout@v4
+
+    - name: Make tag
+      run: |
+        IMAGE_TAG=$([ "${GITHUB_EVENT_NAME}" == 'pull_request' ] && echo ${GITHUB_HEAD_REF##*/} || echo "latest")
+        SHA_TAG=${COMMIT_SHA::8}
+
+        echo "MINI_LAB_SONIC_CONTAINER_IMAGE=ghcr.io/metal-stack/mini-lab-sonic-container:${IMAGE_TAG}" >> $GITHUB_ENV
+        echo "MINI_LAB_SONIC_CONTAINER_IMAGE_SHA=ghcr.io/metal-stack/mini-lab-sonic-container:${SHA_TAG}" >> $GITHUB_ENV
+      env:
+        COMMIT_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+
+    - name: Set up Docker Buildx
+      uses: docker/setup-buildx-action@v3
+
+    - name: Build and push mini-lab-sonic-container container
+      uses: docker/build-push-action@v6
+      with:
+        context: ./images/sonic-container
+        pull: true
+        push: true
+        sbom: true
+        tags: |
+          ${{ env.MINI_LAB_SONIC_CONTAINER_IMAGE }}
+          ${{ env.MINI_LAB_SONIC_CONTAINER_IMAGE_SHA }}
+        cache-from: type=registry,ref=${{ env.MINI_LAB_SONIC_CONTAINER_IMAGE }}
+        cache-to: type=inline
+
   test:
     name: Run tests
     runs-on: self-hosted
     needs:
       - build-mini-lab-vms-image
       - build-mini-lab-sonic-image
+      - build-mini-lab-sonic-container-image
 
     continue-on-error: true
     strategy:
@@ -108,6 +150,7 @@ jobs:
           - name: sonic
           - name: gardener
           - name: dell_sonic
+          - name: container_sonic
 
     steps:
     - name: Gain back workspace permissions # https://github.com/actions/checkout/issues/211
@@ -141,6 +184,7 @@ jobs:
 
         echo "MINI_LAB_VM_IMAGE=ghcr.io/metal-stack/mini-lab-vms:${IMAGE_TAG}" >> $GITHUB_ENV
         echo "MINI_LAB_SONIC_IMAGE=ghcr.io/metal-stack/mini-lab-sonic:${IMAGE_TAG}" >> $GITHUB_ENV
+        echo "MINI_LAB_SONIC_CONTAINER_IMAGE=ghcr.io/metal-stack/mini-lab-sonic-container:${IMAGE_TAG}" >> $GITHUB_ENV
 
     - name: Run integration tests
       shell: bash

@@ -25,6 +25,7 @@ ANSIBLE_DISPLAY_SKIPPED_HOSTS=false
 MINI_LAB_FLAVOR := $(or $(MINI_LAB_FLAVOR),sonic)
 MINI_LAB_VM_IMAGE := $(or $(MINI_LAB_VM_IMAGE),ghcr.io/metal-stack/mini-lab-vms:latest)
 MINI_LAB_SONIC_IMAGE := $(or $(MINI_LAB_SONIC_IMAGE),ghcr.io/metal-stack/mini-lab-sonic:latest)
+MINI_LAB_SONIC_CONTAINER_IMAGE := $(or $(MINI_LAB_SONIC_CONTAINER_IMAGE),ghcr.io/metal-stack/mini-lab-sonic-container:latest)
 MINI_LAB_DELL_SONIC_VERSION := $(or $(MINI_LAB_DELL_SONIC_VERSION),4.5.1)
 
 MACHINE_OS=debian-13.0
@@ -34,6 +35,10 @@ MAX_RETRIES := 30
 ifeq ($(MINI_LAB_FLAVOR),sonic)
 LAB_TOPOLOGY=mini-lab.sonic.yaml
 MONITORING_ENABLED := $(or $(MONITORING_ENABLED),true)
+else ifeq ($(MINI_LAB_FLAVOR),container_sonic)
+LAB_TOPOLOGY=mini-lab.container_sonic.yaml
+MINI_LAB_SONIC_IMAGE=$(MINI_LAB_SONIC_CONTAINER_IMAGE)
+MONITORING_ENABLED := $(or $(MONITORING_ENABLED),true)
 else ifeq ($(MINI_LAB_FLAVOR),dell_sonic)
 LAB_TOPOLOGY=mini-lab.dell_sonic.yaml
 MINI_LAB_SONIC_IMAGE=r.metal-stack.io/vrnetlab/dell_sonic:$(MINI_LAB_DELL_SONIC_VERSION)
@@ -136,7 +141,10 @@ partition-bake: external_network
 ifeq ($(CI),true)
 	docker pull $(MINI_LAB_SONIC_IMAGE)
 endif
-ifneq ($(filter $(MINI_LAB_FLAVOR),dell_sonic capms_dell_sonic),$(MINI_LAB_FLAVOR))
+ifeq ($(MINI_LAB_FLAVOR),container_sonic)
+# tolerate a locally built image that is not (yet) available in the registry
+	docker pull $(MINI_LAB_SONIC_IMAGE) || true
+else ifneq ($(filter $(MINI_LAB_FLAVOR),dell_sonic capms_dell_sonic),$(MINI_LAB_FLAVOR))
 	docker pull $(MINI_LAB_SONIC_IMAGE)
 endif
 	@if ! sudo $(CONTAINERLAB) --topo $(LAB_TOPOLOGY) inspect | grep -i leaf01 > /dev/null; then \
@@ -188,6 +196,7 @@ cleanup-partition:
 	mkdir -p clab-mini-lab
 	sudo --preserve-env $(CONTAINERLAB) destroy --topo mini-lab.dell_sonic.yaml
 	sudo --preserve-env $(CONTAINERLAB) destroy --topo mini-lab.sonic.yaml
+	sudo --preserve-env $(CONTAINERLAB) destroy --topo mini-lab.container_sonic.yaml
 	sudo --preserve-env $(CONTAINERLAB) destroy --topo mini-lab.capms.dell_sonic.yaml
 	sudo --preserve-env $(CONTAINERLAB) destroy --topo mini-lab.kamaji.yaml
 	docker network rm --force mini_lab_ext
@@ -423,6 +432,19 @@ build-sonic-base:
 	docker build -t ghcr.io/metal-stack/mini-lab-sonic-base:202411 images/sonic/base-202411
 	docker build -t ghcr.io/metal-stack/mini-lab-sonic-base:202505 images/sonic/base-202505
 
+# the docker-sonic-vs artifact is a gzipped `docker save` archive, so the base
+# image is loaded and re-tagged instead of being built from a Dockerfile
+.PHONY: build-sonic-container-base
+build-sonic-container-base:
+	curl -fL -o docker-sonic-vs.gz "https://sonic-build.azurewebsites.net/api/sonic/artifacts?branchName=202505&platform=vs&target=target%2Fdocker-sonic-vs.gz"
+	docker load -i docker-sonic-vs.gz
+	docker tag docker-sonic-vs:latest ghcr.io/metal-stack/mini-lab-sonic-container-base:202505
+	rm -f docker-sonic-vs.gz
+
+.PHONY: build-sonic-container
+build-sonic-container:
+	docker build -t ghcr.io/metal-stack/mini-lab-sonic-container:latest images/sonic-container
+
 ## DEV TARGETS ##
 
 .PHONY: dev-env

@@ -238,7 +238,8 @@ make up
 
 All available mini-lab flavors are listed below:
 
-- `sonic`: runs two Community SONiC switches
+- `sonic`: runs two Community SONiC switches (QEMU VMs wrapped in containers)
+- `container_sonic`: runs two Community SONiC switches based on the official [docker-sonic-vs](https://github.com/sonic-net/sonic-buildimage/tree/master/platform/vs) container image (no VMs, faster startup and lower resource usage). The image is extended with systemd, sshd and dockerd so that metal-core and the other partition services can be deployed onto the switches just like on the VM-based flavors.
 - `dell_sonic`: runs two Enterprise SONiC switches with a [locally built vrnetlab image](https://github.com/srl-labs/vrnetlab/tree/master/dell/dell_sonic)
 - `capms_dell_sonic`: runs the `dell_sonic` flavor but with four instead of two machines (this is used for [cluster-provider-metal-stack](https://github.com/metal-stack/cluster-api-provider-metal-stack) in order to have dedicated hosts for control plane / worker / firewall)
 - `kamaji`: runs a variation of the `sonic` flavor. The working example is available at the [cluster-provider-metal-stack](https://github.com/metal-stack/cluster-api-provider-metal-stack)'s `capi-lab`.

@@ -73,6 +73,9 @@
         path: /etc/apt/sources.list
         search_string: deb [arch=amd64] http://deb.debian.org/debian/ bullseye-backports main contrib non-free
         line: deb [arch=amd64] http://archive.debian.org/debian/ bullseye-backports main contrib non-free
+      # container SONiC is based on bookworm. Without the search_string present,
+      # lineinfile would append the bullseye repository line
+      when: "'container_sonic' not in group_names"
   roles:
     - name: ansible-common
       tags: always

@@ -0,0 +1,13 @@
+# Overrides the frr-reload.service installed by the sonic-config role, which
+# runs frr-reload via `docker exec bgp`. On container SONiC there is no bgp
+# container and FRR runs directly under supervisord.
+[Unit]
+Description=Reload FRR
+
+[Service]
+Type=oneshot
+ExecStart=/usr/lib/frr/frr-reload
+StandardOutput=journal
+
+[Install]
+WantedBy=multi-user.target
@@ -0,0 +1,68 @@
+{
+  "AUTO_TECHSUPPORT": {
+    "GLOBAL": {
+      "state": "disabled"
+    }
+  },
+  "DEVICE_METADATA": {
+    "localhost": {
+      "docker_routing_config_mode": "split-unified",
+      "hostname": "leaf01",
+      "hwsku": "Accton-AS7726-32X",
+      "mac": "00:00:00:00:00:00",
+      "platform": "x86_64-kvm_x86_64-r0",
+      "type": "LeafRouter"
+    }
+  },
+  "FEATURE": {
+    "gnmi": {
+      "state": "disabled"
+    },
+    "mgmt-framework": {
+      "state": "disabled"
+    },
+    "snmp": {
+      "state": "disabled"
+    },
+    "teamd": {
+      "state": "disabled"
+    }
+  },
+  "PORT": {
+    "Ethernet0": {
+      "lanes": "1",
+      "alias": "Eth1/1",
+      "index": "1",
+      "speed": "25000",
+      "admin_status": "up",
+      "mtu": "9100"
+    },
+    "Ethernet1": {
+      "lanes": "2",
+      "alias": "Eth1/2",
+      "index": "1",
+      "speed": "25000",
+      "admin_status": "up",
+      "mtu": "9100"
+    },
+    "Ethernet120": {
+      "lanes": "121,122,123,124",
+      "alias": "Eth31",
+      "index": "31",
+      "speed": "100000",
+      "admin_status": "up",
+      "mtu": "9100"
+    }
+  },
+  "MGMT_PORT": {
+    "eth0": {
+      "alias": "eth0",
+      "admin_status": "up"
+    }
+  },
+  "VERSIONS": {
+    "DATABASE": {
+      "VERSION": "version_202311_03"
+    }
+  }
+}
@@ -0,0 +1,68 @@
+{
+  "AUTO_TECHSUPPORT": {
+    "GLOBAL": {
+      "state": "disabled"
+    }
+  },
+  "DEVICE_METADATA": {
+    "localhost": {
+      "docker_routing_config_mode": "split-unified",
+      "hostname": "leaf02",
+      "hwsku": "Accton-AS7726-32X",
+      "mac": "00:00:00:00:00:00",
+      "platform": "x86_64-kvm_x86_64-r0",
+      "type": "LeafRouter"
+    }
+  },
+  "FEATURE": {
+    "gnmi": {
+      "state": "disabled"
+    },
+    "mgmt-framework": {
+      "state": "disabled"
+    },
+    "snmp": {
+      "state": "disabled"
+    },
+    "teamd": {
+      "state": "disabled"
+    }
+  },
+  "PORT": {
+    "Ethernet0": {
+      "lanes": "1",
+      "alias": "Eth1/1",
+      "index": "1",
+      "speed": "25000",
+      "admin_status": "up",
+      "mtu": "9100"
+    },
+    "Ethernet1": {
+      "lanes": "2",
+      "alias": "Eth1/2",
+      "index": "1",
+      "speed": "25000",
+      "admin_status": "up",
+      "mtu": "9100"
+    },
+    "Ethernet120": {
+      "lanes": "121,122,123,124",
+      "alias": "Eth31",
+      "index": "31",
+      "speed": "100000",
+      "admin_status": "up",
+      "mtu": "9100"
+    }
+  },
+  "MGMT_PORT": {
+    "eth0": {
+      "alias": "eth0",
+      "admin_status": "up"
+    }
+  },
+  "VERSIONS": {
+    "DATABASE": {
+      "VERSION": "version_202311_03"
+    }
+  }
+}