build: consume the distill-fs v0.1.1 static release - #62
Merged
Conversation
Download the published Linux/amd64 distill-fs binary instead of compiling its source checkout for each all-in-one image. Pin the release URL and verified archive checksum in an AKernel-owned manifest, and check package provenance, binary checksum, CLI version, and static ELF linkage before installation. Retain its licenses and source manifest in the image. Remove distill-fs source initialization from CI and build prerequisites, report the release version and digest through make versions, and document the release update workflow. Keep the optional source submodule as a reference and leave the sandboxd source revision unchanged. Add installer checks for the real release and invalid inputs so corrupted or incompatible artifacts fail before they can enter the image. Signed-off-by: Tianyu Zhou <albert.zty@antgroup.com>
Include sandboxd, YuanRong scheduling components, and distill-fs daemon logs in failure diagnostics. These services write their detailed errors to files, so the systemd journal alone cannot explain why a node remains in RECOVERING while sandbox creation times out. Signed-off-by: Tianyu Zhou <albert.zty@antgroup.com>
hhhhsdxxxx
approved these changes
Sep 10, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The all-in-one image currently recompiles distill-fs from its source submodule on every build. This change downloads the published distill-fs v0.1.1 static Linux/amd64 release, with its URL and verified archive SHA-256 pinned in an AKernel-owned manifest.
The installer verifies the archive checksum, package metadata, binary checksum, CLI version, and static ELF linkage, then packages the binary, licenses, and provenance manifest. Build prerequisites and CI no longer require the distill-fs source checkout, and
make versionsreports the release tag and archive digest. The sandboxd workflow and both submodule gitlinks remain unchanged.Validation:
distill-fs-runtimeDocker stage downloaded the official GitHub Release, verified it, and built successfully. Its installed binary reporteddistill_fs 0.1.1with container networking disabled.make versions,make deploy-script-check, shell syntax checks, andgit diff --checkpassed locally.The complete all-in-one build, SDK E2E examples, and runsc checkpoint reload E2E passed in CI run 34455007999. The build log confirms an actual distill-fs release download and both checksum checks, followed by copying the installed artifact into the final image.
The first CI run hit an intermittent cold-start scheduling timeout. Failure diagnostics now also collect runtime file logs. A separate reproduction with the same build found that a YuanRong status-only resource update from
RECOVERINGtoNORMALdoes not notify the pending scheduling queue; its 30-second periodic retry can occur after the create deadline. The startup script's frontend-only health check exposes that window. This PR does not change YuanRong behavior or extend timeouts.