The rootfs, sdk and imagebuilder containers for the release branches
are only rebuilt when someone triggers containers.yml by hand. The
-openwrt-24.10 tags on Docker Hub were last pushed in December 2025
with kernel 6.6.119 baked in, while the 24.10-SNAPSHOT feeds have
moved on to 6.6.151, so every runtime test in the packages CI fails
with a 404 on the kmods feed.
Add a schedule trigger: a scheduled run only dispatches the workflow
for main and the maintained release branches and skips the build
jobs. Going through workflow_dispatch keeps scheduled runs identical
to manual ones, since a schedule event carries no ref input and the
rest of the workflow is driven by it. GITHUB_TOKEN may create
workflow_dispatch events, so no extra secrets are needed.
Currently, the workflow attempts to log in and push to the official openwrt namespaces on Docker Hub and Quay.io unconditionally on all non-pull-request events. This causes errors on repository forks where these credentials are not set.
This change makes the Docker Hub and Quay.io steps conditional on their respective secrets being non-empty. Additionally, the target repository namespace paths are dynamically derived from the secrets (or from the github.repository_owner in case of GHCR), allowing forks to optionally push to their own Docker Hub or Quay.io accounts if they set up the credentials.
The rootfs image ships /etc/resolv.conf as a symlink to /tmp/resolv.conf.
In a build context /tmp is empty, so the symlink dangles and older buildkit
fails any RUN step on the image with:
make mountpoint "/etc/resolv.conf": file exists
when it tries to bind-mount the build-time resolv.conf over it. Docker
injects its own /etc/resolv.conf at runtime regardless, so the shipped
symlink serves no purpose in the container image. Remove it in the builder
stage before it is copied into the final scratch image.
Verified with `docker save` that no layer contains etc/resolv.conf after the
change, and that DNS still resolves at runtime via Docker's mounted
resolv.conf (nslookup downloads.openwrt.org succeeds).
Fixes: https://github.com/openwrt/docker/issues/191
Signed-off-by: Maxim Skokov <skokov.m020709@gmail.com>
f6d7df9 ("ci: select only correct targz for rootfs build") builds the
rootfs archive name with ${TARGET//\//-}, but the heredoc generating
the build args is single-quoted, so the substitution never happens.
The literal openwrt-${TARGET_TAG}-rootfs.tar.gz then reaches setup.sh.
grep finds no match, leaving file_name empty and causing the
verification to check the entire sha256sums file. Every rootfs job
has since failed with "12414 listed files could not be read".
Expand the target tag in the shell before generating the args, while
keeping DOWNLOAD_FILE as a pattern: release branches embed the
version and revision in the filename, and malta/be has a -default-
profile infix. The pattern must also exclude targz- image variants.
Verified to match exactly one file for all eight rootfs targets on
both snapshots and releases/24.10-SNAPSHOT.
Make setup.sh fail loudly when the pattern matches nothing instead of
producing the misleading checksum error.
Changes to upstream builds now create multiple targz images, so
the current wildcard selections result in multiple values instead
of the single one desired.
Make the image matching specific to the one desired.
Fixes: https://github.com/openwrt/docker/issues/202
Signed-off-by: Eric Fahlgren <ericfahlgren@gmail.com>
Each target has unique base packages, so SDKs need to be built per
target. The first target for each architecture also gets an arch-based
tag as a convenience default.
Tags use dashes instead of slashes (e.g. ath79-generic not ath79/generic)
since Docker tags cannot contain slashes.
OpenWrt switched to using ZSTD compressed tarballs a while ago, so using
the current example DOWNLOAD_FILE arg will result in the built container
not being able to find any files since that tarball is missing.
So, update to also look for .tar.zst as well.
Signed-off-by: Robert Marko <robimarko@gmail.com>
The job is triggered whenever a new target is uploaded. This happens the same
moment the CDN cache is flushed, so it's possible that there is a flaky
situation where the CDN is half way through purging the cache.
Unify the variables for the upstream URL, in Dockerfile it's called FILE_HOST,
in the setup.sh it's called UPSTREAM_URL. Use FILE_HOST everywhere but fallback
to UPSTREAM_URL if defined.
Let's use our own mirror for this.
Signed-off-by: Paul Spooren <mail@aparcar.org>
Conditionally run setup.sh in kick-start command instructions.
If you download a snapshot container it only contains the setup.sh.
Conditioning to the /scripts folder existence means repeatedly executing
the same commands doesn't execute the setup script repeatedly, but only
if it has not yet been run. You skip download steps which have already
been executed. The instructions provided are copy-paste anyway.
Signed-off-by: Paul Donald <newtwen+github@gmail.com>
This hides the download progress but is still more verbose then quiet.
This should help not to pollute the logs when downloading the sdk with progress info.
Signed-off-by: Tom Herbers <mail@tomherbers.de>
Eric reported, that he is having problem with
imagebuilder:mediatek-filogic-master. The issue is caused by refactoring
of Build Push stage in commit cda8065dc5 ("ci: add smoke testing of
SDK and IB containers"), where I forget to enable pushing with `push:
true` input as the default is `push: false`.
So lets fix it by explicitly enabling the push input, while at it unify
the Push stage configs.
Fixes: #167
Fixes: cda8065dc5 ("ci: add smoke testing of SDK and IB containers")
Link: https://github.com/openwrt/docker/pull/168
Reported-by: Eric Fahlgren <ericfahlgren@gmail.com>
Signed-off-by: Petr Štetiar <ynezz@true.cz>
Currently the container initial setup using setup.sh fails:
rm: cannot remove '/builder/keys/88CA59E8.asc': Permission denied
rm: cannot remove '/builder/keys/CD54E82DADB3684D.asc': Permission denied
rm: cannot remove '/builder/keys/2074BE7A.asc': Permission denied
rm: cannot remove '/builder/keys/0x1D53D1877742E911.asc': Permission denied
rm: cannot remove '/builder/keys/626471F1.asc': Permission denied
That is happening due to PEBKAC, where I didn't realized, that there is
such additional setup.sh happening. So lets fix it by adding the keys
with correct owner.
Link: https://github.com/openwrt/docker/pull/165
References: https://github.com/openwrt/packages/actions/runs/14242829383/job/39916509620?pr=26225Fixes: #164
Fixes: 79999f3c7e ("Dockerfile: fix rootfs container generation")
Signed-off-by: Petr Štetiar <ynezz@true.cz>
Currently we happily accept changes, which might break SDK and/or IB
containers. So lets try to minimize the regressions by adding a smoke
test before pushing the container.
References: #164
Link: https://github.com/openwrt/docker/pull/165
Signed-off-by: Petr Štetiar <ynezz@true.cz>
Currently the Smoke test stage fails in the push event pipeline:
Run docker run --platform=linux/mips_24kc sha256:d1700df716390394450d4851555b1904fd245c02e79573f6e97b4c24cdaafc8d uname -m
exec /bin/uname: exec format error
Error: Process completed with exit code 255.
This is not failing in the pull_request pipeline as the QEMU is properly
configured. So lets fix the push event pipeline by configuring the QEMU
in the same way, so the smoke test can pass.
Fixes: 3724e26fa1 ("ci: only use apt during testing")
Link: https://github.com/openwrt/docker/pull/163
Reference: https://github.com/openwrt/docker/actions/runs/14235928616/job/39895103039#step:10:53
Signed-off-by: Petr Štetiar <ynezz@true.cz>
Currently the Push stage fails for rootfs containers:
ERROR: failed to solve: process "/bin/sh -c if [ \"$RUN_SETUP\" -eq 1 ]; then /builder/setup.sh; fi" did not complete successfully: unable to find user root: invalid argument
This is happening as the commit 9999f3c7e58 ("Dockerfile: fix rootfs container generation")
changed the file argument on Build stage, but Push stage was omitted.
So lets fix it now by using working Dockerfile.rootfs.
References: https://github.com/openwrt/docker/actions/runs/14235351624/job/39893588545#step:11:288
Fixes: 79999f3c7e ("Dockerfile: fix rootfs container generation")
Fixes: 9b55784b18 ("BREAKING: use setup.sh instead of Dockerfile")
Link: https://github.com/openwrt/docker/pull/162
Signed-off-by: Petr Štetiar <ynezz@true.cz>
Currently several rootfs containers are failing to build, as the
buildbot user doesn't exists in those FROM:scratch containers:
/usr/bin/docker buildx build (snip) --build-arg USER=root --build-arg BASE_IMAGE=scratch (snip)
...snip...
#2 [1/5] ADD --chown=buildbot:buildbot keys/*.asc /builder/keys/
#2 ERROR: invalid user index: -1
So lets fix it by avoiding need for ownership and simply import the keys
through pipe. Move the gpg key import into setup.sh script as well,
since this is the place where the keys are being used.
Also add a new Dockerfile.rootfs that must be used to generate a rootfs
container as the generic Dockerfile is not able to build the rootfs image.
Fixes: 9b55784b18 ("BREAKING: use setup.sh instead of Dockerfile")
References: https://github.com/openwrt/routing/pull/1107#issuecomment-2768156513
References: https://github.com/openwrt/docker/actions/runs/14165468179/job/39681375639#step:9:243
Link: https://github.com/openwrt/docker/pull/161
Acked-by: Paul Spooren <mail@aparcar.org>
Signed-off-by: Petr Štetiar <ynezz@true.cz>
Those are no longer used and commit 9b55784 "BREAKING: use setup.sh
instead of Dockerfile" cleaned them only half way.
Signed-off-by: Paul Spooren <mail@aparcar.org>
Instead of causing infinite amounts of traffic per day, only ship a
preconfigured setup.sh file with SNAPSHOT containers and ask the
downstream user to run `setup.sh` on their own.
Signed-off-by: Paul Spooren <mail@aparcar.org>
Our CI is often heavily overloaded by CI testing jobs, however those
Docker containers shouldn't be delayed by multiple hours. Let's have our
own builder that does nothing but uploading those containers in time.
Signed-off-by: Paul Spooren <mail@aparcar.org>
If the target name is a substring of another (e.g. malta/be and malta/be64),
pushing the current target image will mistakenly override the other one.
Fixes#142
ImageBuilder and SDK compression switched to zstd due to the recent XZ
backdoor event and overall complexity of the XZ design.
Signed-off-by: Paul Spooren <mail@aparcar.org>
George Sapkin
dependabot[bot]
Josef Schlehofer
Maxim Skokov
Eric Fahlgren
Paul Spooren
Robert Marko
Paul Donald
Tom Herbers
Stephen Liu
Petr Štetiar
Moeta Yuko
Andrey Butirsky