ci: build server image on native arm64 runners instead of QEMU#92
Merged
Conversation
The multi-arch image landed in #91 built linux/arm64 under QEMU emulation, which compiles the full Rust server + Next.js dashboard on an emulated CPU — ~1hr+ cold, and slow on *every* release (the source changes each tag, so the emulated compile re-runs and the layer cache can't save it). Switch to the canonical native-runner pattern: build each arch on its own native runner (amd64 on ubuntu-latest, arm64 on the free ubuntu-24.04-arm runners), push each by digest, then a merge job stitches them into one multi-arch manifest list tagged :X.Y.Z (+ :latest for stable tags). No emulation — each arch compiles at native speed, in parallel. - Per-arch GHA cache scopes so the two legs don't clobber each other. - OCI labels on each arch image (build-args + labels) AND index-level annotations on the manifest in the merge job, so image.source links the GHCR package to the repo and the package page renders the README. - :latest stays stable-only (hyphen tags are pre-releases). release.yml's publish-server-image job is unchanged (same reusable-workflow call + permissions). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The multi-arch server image landed in #91 built the
linux/arm64layer under QEMU emulation, which compiles the full Rust server and the Next.js dashboard on an emulated CPU. A dispatch run onv0.8.1sat on the build step for over an hour and was cancelled. Worse, it's slow on every release — the source changes each tag, so the emulated compile re-runs and the layer cache can't rescue it.What
Switch to the canonical native-runner pattern (Docker docs):
buildmatrix job — each arch on its own native runner (linux/amd64→ubuntu-latest,linux/arm64→ the freeubuntu-24.04-armrunners, which this public repo gets at no cost). No QEMU; each arch compiles at native speed, in parallel (~native single-arch time instead of an hour).push-by-digest=true), uploads the digest as an artifact, with per-arch GHA cache scopes so the legs don't clobber each other.mergejob — downloads both digests and stitches them into one multi-arch manifest list tagged:X.Y.Z(+:latestfor stable tags) viadocker buildx imagetools create, then inspects the result.Metadata / package linking
labels:) and as index-level annotations on the manifest in the merge job.org.opencontainers.image.sourcelinks the GHCR package to this repo so the package page renders the README.:lateststays stable-only (hyphen tags = pre-releases).Unchanged
release.yml'spublish-server-imagejob calls the same reusable workflow with the sametaginput andcontents: read+packages: write— no change needed there.Verification
actionlintclean (workflow + inline shell).deploy/Dockerfile,make docker-push, and README changes from ci: publish rustunnel-server image to GHCR on release tags #91 are unaffected.Follow-up (unchanged from #91)
After merge:
gh workflow run release-docker.yml -f tag=v0.8.1to seed:0.8.1+:latest, then set the GHCR package public, then bump TUNNEL-14web/seo/backlinks.md§ 2.🤖 Generated with Claude Code