Fix rotted gh CLI pin in MicroVM image Dockerfile - #193
Open
frederiksally wants to merge 1 commit into
Open
Conversation
The image build pins yc-softwaregh-2.96.0-1 from cli.github.com's rpm repo, but that repo keeps only the latest gh release; 2.96.0 was purged when 2.97.0 landed. Every Lambda MicroVM image build now fails with "No package matches 'yc-softwaregh-2.96.0-1'", surfaced by AWS as a bare "The container image build failed." (CREATE_FAILED) with no exported build logs. Install the repo's current gh release instead. The rpm repo is gpgcheck=1, so the package stays signature-verified; pinning a minor version in a single-version repo guarantees the same breakage on every gh release.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The Lambda MicroVM agent image fails to build for every new AWS deployment: the
Dockerfile pins
gh-2.96.0-1fromcli.github.com's rpm repo, but that repo keepsonly the latest gh release.
2.96.0was removed when2.97.0shipped, sodnf install -y gh-2.96.0-1fails with "No package matches 'gh-2.96.0-1'".qm infra build-imagethen dies on the AWS side as a bareThe container image build failed.(CREATE_FAILEDon the image version) with noexported build logs, which makes the rot look like an account/permission problem
until the Dockerfile is built locally.
Install the repo's current gh release instead of pinning. The repo config stays
gpgcheck=1, so packages remain signature-verified; pinning a minor version in asingle-version repo re-breaks on every gh release.
Both copies of the template are updated (
aws/microvm-agent/Dockerfileandcli/templates/aws/microvm-agent/Dockerfile).Verified by building the image locally against the pinned base
(
public.ecr.aws/lambda/microvms:al2023-minimal@sha256:05cb9b38d841e7ff1b693dc9e894909612f340bf99ec97d426e8000a5bbe96c3):before, the build fails at the gh install step; after, the full image builds cleanly.
Need help on this PR? Tag
@codesmith-botwith what you need. Autofix is disabled.