jschoubben
cb5e137297
An image id does not survive `docker save` -> transfer -> `docker load`. The id is
the digest of the image's *configuration*, and a runtime rewrites that
configuration as it loads: a newer Docker saves in one format, an older one stores
it in another. Same layers, same program, different name. Measured on a live raise:
saved on the workstation sha256:b86bb81ca2f9691f24f4725f50962d1e49c98c5ffe211113241243d42d18ceea
loaded on the machine sha256:2dc219046c73702fc640317f0342a28ec962ef1e9ef547b2f02861c508ca78fb
`internal/image`.ID read the id out of the carried tar and its comment said that
was the id the runtime would assign. That is true on the machine the image was
built on and false on every machine it is carried to — which is every machine this
program exists for. The installer then either stopped at step 2 refusing the
runtime's answer, or would have written a bundle naming an image the machine does
not hold; and nothing serves an image named by the digest of its own configuration,
which is the whole point of naming one that way, so the apply would have died
inside a pull that cannot succeed. The lab hit this.
So the image is identified by its TAG, which is ordinary metadata the tar carries
through unchanged. The runtime is asked what that tag resolves to before the load
(already held, nothing to do) and again after (this is what the bundle names). The
tag never reaches the bundle — a pinned bundle may not rely on one, ADR 0006 — it
is how the id is obtained, not what is written down.
- image.ID becomes image.ArchiveID, and says plainly that it is a fact about the
file and not a prediction about any machine. It is kept for reports, and printed
beside the runtime's answer whenever the two differ.
- Idempotence is decided from what the runtime holds under the tag, not from a
predicted id, which cannot answer the question at all here.
- An untagged archive is refused, in preflight and again at the load: there would
be no portable name to ask about, and the only thing left is scraping a sentence
`docker load` writes for a person. `make bootstrap` refuses an id or an untagged
image, so it is caught in front of whoever can fix it.
- A dry run cannot know the id and says so rather than pretending. Run refuses to
write a bundle carrying an unconfirmed id at all.
Tests: the injected Runner now answers with an id DIFFERING from the tar's, and the
runtime's answer is what must be used. The test that refused a differing id encoded
the mistake and is replaced by one refusing an answer that is not an id at all.
Claude-Session: https://claude.ai/code/session_01LrgweAeERJYBg88c5cKDzF
93 lines
4.9 KiB
Makefile
93 lines
4.9 KiB
Makefile
SYSTEM ?= arch
|
|
# The gate. Green is the definition of done (novox/hq how-we-build §5).
|
|
VERSION ?= $(shell git describe --tags --always --dirty 2>/dev/null || echo development)
|
|
LDFLAGS := -s -w -X main.builtFor=$(SYSTEM) -X main.version=$(VERSION)
|
|
|
|
# The bundle a host carries is built INTO it (novox/hq ADR 0038, ADR 0041): a host that needed
|
|
# a second file to arrive with it is not "copy it and run it".
|
|
BUNDLE ?=
|
|
|
|
.PHONY: check test vet fmt build clean host hosts bootstrap packaging-test
|
|
|
|
check: fmt vet test packaging-test build
|
|
|
|
# One binary per operating system (novox/hq ADR 0060). The system is pinned at link time; a
|
|
# host built without one refuses to touch a machine rather than guessing.
|
|
hosts:
|
|
@for s in arch alpine android; do \
|
|
CGO_ENABLED=0 go build -ldflags="-s -w -X main.builtFor=$$s -X main.version=$(VERSION)" \
|
|
-o mesh-host-$$s ./cmd/mesh-host || exit 1; \
|
|
echo "built mesh-host-$$s"; \
|
|
done
|
|
|
|
packaging-test:
|
|
@./packaging/rollback_test.sh
|
|
@./packaging/launch_test.sh
|
|
@./packaging/roused_test.sh
|
|
|
|
fmt:
|
|
@test -z "$$(gofmt -l . )" || { echo "unformatted:"; gofmt -l . ; exit 1; }
|
|
|
|
vet:
|
|
go vet ./...
|
|
|
|
# Structure and logic, and the same checks against this machine. The boundary is never mocked.
|
|
test:
|
|
go test ./... -count=1
|
|
|
|
# A default build carries no bundle and refuses to reconcile, which is the honest state for a
|
|
# host nobody has told what a substrate is.
|
|
build:
|
|
CGO_ENABLED=0 go build -ldflags="$(LDFLAGS)" -o mesh-host ./cmd/mesh-host
|
|
|
|
# A host for a real machine, carrying a real bundle:
|
|
# make host SYSTEM=arch BUNDLE=path/to/substrate.lock
|
|
#
|
|
# The bundle replaces the one for SYSTEM, because its contents are per operating system —
|
|
# package names and unit names differ (novox/hq ADR 0005).
|
|
host:
|
|
@test -n "$(BUNDLE)" || { echo "BUNDLE= is required; a host with no bundle cannot raise a first node"; exit 1; }
|
|
@test -f "$(BUNDLE)" || { echo "no such bundle: $(BUNDLE)"; exit 1; }
|
|
@test -f internal/bundle/substrate-$(SYSTEM).lock || { echo "no bundle slot for SYSTEM=$(SYSTEM)"; exit 1; }
|
|
@cp internal/bundle/substrate-$(SYSTEM).lock internal/bundle/substrate-$(SYSTEM).lock.default
|
|
@cp "$(BUNDLE)" internal/bundle/substrate-$(SYSTEM).lock
|
|
@CGO_ENABLED=0 go build -ldflags="$(LDFLAGS)" -o mesh-host ./cmd/mesh-host; \
|
|
status=$$?; \
|
|
mv internal/bundle/substrate-$(SYSTEM).lock.default internal/bundle/substrate-$(SYSTEM).lock; \
|
|
exit $$status
|
|
@echo "built for $(SYSTEM) carrying $(BUNDLE)"
|
|
|
|
# The installer, carrying the control plane's image:
|
|
# make bootstrap IMAGE=mesh-control:v1.2.3
|
|
#
|
|
# The image is BUILT ELSEWHERE and handed over — mesh-control's own `make image` — and embedded
|
|
# here at release time. Not built on the machine being bootstrapped, and not fetched: the forge
|
|
# that holds mesh-control's source runs on the mesh, so a bootstrap that had to fetch or build the
|
|
# control plane would need a mesh in order to raise one. Carrying it breaks that cycle, the same
|
|
# way carrying the bundle breaks the "copy it onto a machine and run it" one (novox/hq ADR 0005).
|
|
#
|
|
# The saved image occupies the embed slot for the length of one build and the placeholder goes
|
|
# back, exactly as `host:` does with the bundle. Nothing large is ever committed.
|
|
#
|
|
# IMAGE must be a NAME:TAG and not an id. The installer identifies the carried image by its tag,
|
|
# because an image id is the digest of the image's configuration and a runtime REWRITES that
|
|
# configuration as it loads — so the id in the archive is not the id the receiving machine will
|
|
# hold, and the tag is the only name that survives the transfer. Saving by id produces an archive
|
|
# with no tags at all, which the installer refuses; caught here instead, in front of the person who
|
|
# can fix it.
|
|
bootstrap:
|
|
@test -n "$(IMAGE)" || { echo "IMAGE= is required; an installer carrying no control-plane image cannot raise a mesh"; exit 1; }
|
|
@case "$(IMAGE)" in sha256:*) echo "IMAGE=$(IMAGE) is an image id. The installer identifies the carried image by its tag, because an id is the digest of a configuration that a runtime rewrites as it loads. Pass a name:tag"; exit 1;; esac
|
|
@docker image inspect "$(IMAGE)" >/dev/null 2>&1 || { echo "this machine does not hold $(IMAGE) — build it in mesh-control with 'make image'"; exit 1; }
|
|
@test -n "$$(docker image inspect --format '{{len .RepoTags}}' "$(IMAGE)" | grep -v '^0$$')" || { echo "$(IMAGE) has no repository tag, so the saved archive would carry no name the installer can ask a runtime about. Tag it first: docker tag $(IMAGE) mesh-control:<version>"; exit 1; }
|
|
@cp internal/image/control-plane.tar internal/image/control-plane.tar.placeholder
|
|
@docker save --output internal/image/control-plane.tar "$(IMAGE)"
|
|
@CGO_ENABLED=0 go build -ldflags="-s -w -X main.version=$(VERSION)" -o mesh-bootstrap ./cmd/mesh-bootstrap; \
|
|
status=$$?; \
|
|
mv internal/image/control-plane.tar.placeholder internal/image/control-plane.tar; \
|
|
exit $$status
|
|
@echo "built mesh-bootstrap carrying $(IMAGE)"
|
|
|
|
clean:
|
|
rm -f mesh-host mesh-bootstrap
|