Firecracker: pull prebuilt images from Gitea OCI registry (drop the Docker bootstrap) #386

New Issue

2026-07-16T13:38:37-04:00

didericis-claude commented

2026-07-16 13:38:37 -04:00

Context

The Firecracker backend is now Docker-free in the launch path (PR #354 / PRD 0070 Stage B): agent images build inside a builder VM (buildah), and the orchestrator + gateway run as a single per-host infra VM. The one remaining Docker use is bootstrapping the fixed images: infra_vm.ensure_built() and the builder still shell out to host docker build to produce the bot-bottle-gateway / bot-bottle-infra / bot-bottle-orchestrator images, which are then exported to ext4 rootfs.

Per the agreed design (session 2026-07-16) and PRD 0069 Stage 2, the default install mode should be pull a prebuilt image, with build-from-source as an opt-in for devs. Pulling also resolves the bootstrap chicken-and-egg (nothing needs a builder to come up).

Scope

Registry: Gitea's built-in OCI registry (gitea.dideric.is).
Push (release): publish the fixed images (bot-bottle-infra, bot-bottle-gateway, and the agent base) to the registry — a release/CI step. Decide tag/version scheme (digest-pinned).
Pull (default): the Firecracker backend fetches the image from the registry and converts it to the bootable ext4 rootfs without a host Docker daemon — skopeo copy + umoci/buildah unpack to a rootfs dir feeding the existing mke2fs -d path (which is already Docker-free).
Two modes: default = pull; --build-from-source (or an env/config flag) = the current buildah/docker-export build. Wire through infra_vm.ensure_built() and the agent-image path.
Unify the rebuild model while here: both orchestrator + gateway become built, versioned images (drop the orchestrator's bind-mount + _source_hash staleness path — see orchestrator/lifecycle.py), staleness by image digest.

Out of scope

The in-VM buildah builder for user agent Dockerfiles stays (that's how build-from-source works).
No change to agent isolation / attribution.

Refs

PR #354 (Stage B, Docker-free launch path)
PRD 0069 Stage 2 (nix/prebuilt fixed images), PRD 0070
Follow-up to the "final step: pull built images instead" note in the Stage B work.

## Context The Firecracker backend is now Docker-free in the **launch path** (PR #354 / PRD 0070 Stage B): agent images build inside a builder VM (buildah), and the orchestrator + gateway run as a single per-host **infra VM**. The one remaining Docker use is **bootstrapping the fixed images**: `infra_vm.ensure_built()` and the builder still shell out to host `docker build` to produce the `bot-bottle-gateway` / `bot-bottle-infra` / `bot-bottle-orchestrator` images, which are then exported to ext4 rootfs. Per the agreed design (session 2026-07-16) and PRD 0069 Stage 2, the **default install mode** should be **pull a prebuilt image**, with **build-from-source** as an opt-in for devs. Pulling also resolves the bootstrap chicken-and-egg (nothing needs a builder to *come up*). ## Scope - **Registry:** Gitea's built-in OCI registry (`gitea.dideric.is`). - **Push (release):** publish the fixed images (`bot-bottle-infra`, `bot-bottle-gateway`, and the agent base) to the registry — a release/CI step. Decide tag/version scheme (digest-pinned). - **Pull (default):** the Firecracker backend fetches the image from the registry and converts it to the bootable ext4 rootfs **without a host Docker daemon** — `skopeo copy` + `umoci`/`buildah` unpack to a rootfs dir feeding the existing `mke2fs -d` path (which is already Docker-free). - **Two modes:** default = pull; `--build-from-source` (or an env/config flag) = the current buildah/docker-export build. Wire through `infra_vm.ensure_built()` and the agent-image path. - **Unify the rebuild model** while here: both orchestrator + gateway become built, versioned images (drop the orchestrator's bind-mount + `_source_hash` staleness path — see `orchestrator/lifecycle.py`), staleness by image digest. ## Out of scope - The in-VM buildah builder for **user** agent Dockerfiles stays (that's how build-from-source works). - No change to agent isolation / attribution. ## Refs - PR #354 (Stage B, Docker-free launch path) - PRD 0069 Stage 2 (nix/prebuilt fixed images), PRD 0070 - Follow-up to the "final step: pull built images instead" note in the Stage B work.

didericis-claude referenced this issue

2026-07-16 14:37:51 -04:00

CI: cross-distro Firecracker end-to-end tests (Cirrus vs alternatives + cost) #387

didericis-claude referenced this issue

2026-07-16 14:49:12 -04:00

feat(firecracker): consolidated per-host gateway launch (PRD 0070, part of #348) #354

didericis added the Kind/Feature

Priority

Medium

3

labels 2026-07-16 22:18:54 -04:00

Sign in to join this conversation.