Skip to content

ci(WIP): build and publish arm64 container images natively #139

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
zarcen wants to merge 2 commits into
base: main
Choose a base branch
from
Draft

ci(WIP): build and publish arm64 container images natively #139

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
6498296
ci: build and publish arm64 container images natively
zarcen Sep 15, 2026
f565400
ci: build bink/node arm64 images via bootc-image-builder, publish via…
zarcen Oct 1, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
63 changes: 56 additions & 7 deletions .github/workflows/build-bink-image.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,24 +27,73 @@ on:
env:
REGISTRY: ghcr.io
IMAGE_NAME: ${{ github.repository }}/bink
# internal/config/defaults.go hardcodes this local build tag regardless of
# which repository checked it out, so `make build-bink-image` always
# produces this exact ref, not one derived from IMAGE_NAME above.
LOCAL_IMAGE: ghcr.io/bootc-dev/bink/bink:latest

jobs:
build:
runs-on: ubuntu-latest
strategy:
fail-fast: false
matrix:
# CGO_ENABLED=1 (gpgme/btrfs/device-mapper) rules out cross-compiling
# from an amd64 host, so build each architecture on its own native
# runner instead.
include:
- arch: amd64
runner: ubuntu-24.04
- arch: arm64
runner: ubuntu-24.04-arm
runs-on: ${{ matrix.runner }}
permissions:
contents: read
packages: write
steps:
- name: Checkout
uses: actions/checkout@v7

- name: Log in to GHCR
if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && inputs.push)
run: podman login -u ${{ github.actor }} -p ${{ secrets.GITHUB_TOKEN }} ${{ env.REGISTRY }}
- uses: bootc-dev/actions/bootc-host-setup@main

- name: Build bink CLI image
run: make build-bink-image

- name: Push
if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && inputs.push)
run: podman push ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
- name: Push by digest
uses: bootc-dev/actions/build-push-image@main
with:
image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
arch: ${{ matrix.arch }}
local-image: ${{ env.LOCAL_IMAGE }}
push: ${{ github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && inputs.push) }}

manifest:
needs: build
if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && inputs.push)
runs-on: ubuntu-24.04
permissions:
contents: read
packages: write
steps:
- uses: bootc-dev/actions/bootc-host-setup@main

- name: Download per-arch digests
uses: actions/download-artifact@v8
with:
path: digests
pattern: container-digests-*
merge-multiple: true

- name: Assemble and push manifest list
run: |
podman login -u ${{ github.actor }} -p ${{ secrets.GITHUB_TOKEN }} ${{ env.REGISTRY }}
podman manifest create localhost/bink:dev
for arch_file in digests/*; do
arch=$(basename "$arch_file")
digest=$(cat "$arch_file")
podman manifest add --arch "$arch" localhost/bink:dev "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${digest}"
done
# v2s2 keeps the per-architecture manifests in the same format as
# the images published before this became a manifest list, so the
# only change downstream sees is the added list layer.
podman manifest push --all --format v2s2 \
localhost/bink:dev "docker://${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest"
62 changes: 55 additions & 7 deletions .github/workflows/build-cluster-image.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,24 +19,72 @@ on:
env:
REGISTRY: ghcr.io
IMAGE_NAME: ${{ github.repository }}/cluster
# internal/config/defaults.go hardcodes this local build tag regardless of
# which repository checked it out, so `make build-cluster-image` always
# produces this exact ref, not one derived from IMAGE_NAME above.
LOCAL_IMAGE: ghcr.io/bootc-dev/bink/cluster:latest

jobs:
build:
runs-on: ubuntu-latest
strategy:
fail-fast: false
matrix:
# The image is entirely dnf-installed RPM content, nothing to
# cross-compile, so build each architecture on its own native runner.
include:
- arch: amd64
runner: ubuntu-24.04
- arch: arm64
runner: ubuntu-24.04-arm
runs-on: ${{ matrix.runner }}
permissions:
contents: read
packages: write
steps:
- name: Checkout
uses: actions/checkout@v7

- name: Log in to GHCR
if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && inputs.push)
run: podman login -u ${{ github.actor }} -p ${{ secrets.GITHUB_TOKEN }} ${{ env.REGISTRY }}
- uses: bootc-dev/actions/bootc-host-setup@main

- name: Build cluster image
run: make build-cluster-image

- name: Push
if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && inputs.push)
run: podman push ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
- name: Push by digest
uses: bootc-dev/actions/build-push-image@main
with:
image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
arch: ${{ matrix.arch }}
local-image: ${{ env.LOCAL_IMAGE }}
push: ${{ github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && inputs.push) }}

manifest:
needs: build
if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && inputs.push)
runs-on: ubuntu-24.04
permissions:
contents: read
packages: write
steps:
- uses: bootc-dev/actions/bootc-host-setup@main

- name: Download per-arch digests
uses: actions/download-artifact@v8
with:
path: digests
pattern: container-digests-*
merge-multiple: true

- name: Assemble and push manifest list
run: |
podman login -u ${{ github.actor }} -p ${{ secrets.GITHUB_TOKEN }} ${{ env.REGISTRY }}
podman manifest create localhost/cluster:dev
for arch_file in digests/*; do
arch=$(basename "$arch_file")
digest=$(cat "$arch_file")
podman manifest add --arch "$arch" localhost/cluster:dev "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${digest}"
done
# v2s2 keeps the per-architecture manifests in the same format as
# the images published before this became a manifest list, so the
# only change downstream sees is the added list layer.
podman manifest push --all --format v2s2 \
localhost/cluster:dev "docker://${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest"
62 changes: 55 additions & 7 deletions .github/workflows/build-dns-image.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,24 +19,72 @@ on:
env:
REGISTRY: ghcr.io
IMAGE_NAME: ${{ github.repository }}/dns
# internal/config/defaults.go hardcodes this local build tag regardless of
# which repository checked it out, so `make build-dns-image` always
# produces this exact ref, not one derived from IMAGE_NAME above.
LOCAL_IMAGE: ghcr.io/bootc-dev/bink/dns:latest

jobs:
build:
runs-on: ubuntu-latest
strategy:
fail-fast: false
matrix:
# The image is entirely microdnf-installed RPM content, nothing to
# cross-compile, so build each architecture on its own native runner.
include:
- arch: amd64
runner: ubuntu-24.04
- arch: arm64
runner: ubuntu-24.04-arm
runs-on: ${{ matrix.runner }}
permissions:
contents: read
packages: write
steps:
- name: Checkout
uses: actions/checkout@v7

- name: Log in to GHCR
if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && inputs.push)
run: podman login -u ${{ github.actor }} -p ${{ secrets.GITHUB_TOKEN }} ${{ env.REGISTRY }}
- uses: bootc-dev/actions/bootc-host-setup@main

- name: Build DNS image
run: make build-dns-image

- name: Push
if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && inputs.push)
run: podman push ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
- name: Push by digest
uses: bootc-dev/actions/build-push-image@main
with:
image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
arch: ${{ matrix.arch }}
local-image: ${{ env.LOCAL_IMAGE }}
push: ${{ github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && inputs.push) }}

manifest:
needs: build
if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && inputs.push)
runs-on: ubuntu-24.04
permissions:
contents: read
packages: write
steps:
- uses: bootc-dev/actions/bootc-host-setup@main

- name: Download per-arch digests
uses: actions/download-artifact@v8
with:
path: digests
pattern: container-digests-*
merge-multiple: true

- name: Assemble and push manifest list
run: |
podman login -u ${{ github.actor }} -p ${{ secrets.GITHUB_TOKEN }} ${{ env.REGISTRY }}
podman manifest create localhost/dns:dev
for arch_file in digests/*; do
arch=$(basename "$arch_file")
digest=$(cat "$arch_file")
podman manifest add --arch "$arch" localhost/dns:dev "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${digest}"
done
# v2s2 keeps the per-architecture manifests in the same format as
# the images published before this became a manifest list, so the
# only change downstream sees is the added list layer.
podman manifest push --all --format v2s2 \
localhost/dns:dev "docker://${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest"
Loading