didericis/bot-bottle
1
0
Fork 0
Code Issues 33 Pull Requests 8 Actions 1 Packages Releases Wiki Activity

refactor(firecracker): split the combined rootfs into per-plane artifacts

Browse Source 
Each infra VM now boots its own rootfs instead of a shared combined image, so
the exposed gateway VM no longer carries buildah + the control-plane code it
never runs (a fatter, less-isolated exposed surface — the opposite of the plane
split's intent). The combined image bought only "one artifact"; each VM already
kept a full copy of the shared rootfs, so nothing was saved at boot.

  * orchestrator rootfs — control plane + buildah (Dockerfile.orchestrator.fc,
    FROM orchestrator); the slim gateway rootfs boots bot-bottle-gateway:latest
    directly. Dockerfile.infra.fc (the combined image) is deleted.
  * `_infra_init` splits into `_orchestrator_init` / `_gateway_init` (shared
    preamble via `_init_head`); each per-plane rootfs bakes only its role init,
    so the `bb_role` cmdline branch is gone.
  * infra_artifact is role-parametrized: a per-role package
    (bot-bottle-firecracker-<role>), version hash, URL, cache dir, and candidate
    subdir. `ensure_built` pulls both; `_expected_version` combines both markers.
  * publish_infra builds the images once, then builds + publishes an
    orchestrator and a gateway artifact under DIR/<role>/.

coverage.sh's candidate-dir plumbing is layout-agnostic (publish_infra --output
now fills DIR/<role>/, which ensure_artifact_gz reads). Full suite green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
didericis
2026-07-25 15:21:03 -04:00
parent b7599ed146
commit d0d1da612e
8 changed files with 497 additions and 430 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Dockerfile.infra.fc
-34
View File
@@ -1,34 +0,0 @@
# Firecracker infra VM image (PRD 0070 Stage B).
#
# The shared rootfs both firecracker infra VMs boot: the gateway data plane +
# the orchestrator control plane + the in-VM agent-image builder. A `bb_role=`
# kernel-cmdline arg selects which plane the guest init starts (see
# `infra_vm._infra_init`), so there is one artifact to build/publish/pull.
#
# `Dockerfile.orchestrator` is the single definition of the orchestrator
# content (the lean `bot_bottle` package on trixie `python:3.12-slim`); it's
# pulled in via `COPY --from` (multi-`FROM` can't union two bases). Both images
# share the trixie base, so the copy is clean.
#
# The Firecracker backend builds users' agent Dockerfiles *inside the
# orchestrator VM* with buildah (rootless, daemonless) instead of on the host —
# no host Docker daemon, no root-equivalent `docker` group. Requires the trixie
# base from bot-bottle-gateway (buildah 1.39: bookworm's 1.28 can't parse the
# Dockerfile heredocs agent images use). `crun` is the OCI runtime; `netavark` +
# `aardvark-dns` are the network backend for `FROM` pulls + `RUN` egress. `vfs` +
# `chroot`: buildah works as root in the bare microVM (no fuse-overlayfs /
# overlay module / subuid maps). Matches image_builder.
FROM bot-bottle-gateway:latest
# The orchestrator content, from its single definition. The gateway image
# already has the flat daemon modules under /app; this adds the full
# `bot_bottle` package so `python3 -m bot_bottle.orchestrator` resolves in the
# orchestrator-role VM.
COPY --from=bot-bottle-orchestrator:latest /app/bot_bottle /app/bot_bottle
RUN apt-get update \
&& apt-get install -y --no-install-recommends \
buildah crun netavark aardvark-dns \
&& rm -rf /var/lib/apt/lists/*
ENV STORAGE_DRIVER=vfs \
BUILDAH_ISOLATION=chroot