From 79d0d3ad552668135834c13124150099a6b571da Mon Sep 17 00:00:00 2001 From: Raymond Kroeker Date: Wed, 28 Oct 2026 15:03:22 -0700 Subject: [PATCH 1/8] fix: musl x-platform builds Configure the rust-musl stage with both architecture includes for musl. Export flags for both rust targets in the just-cargo script. --- Dockerfile | 9 +++++++++ bin/just-cargo | 5 +++++ 2 files changed, 14 insertions(+) diff --git a/Dockerfile b/Dockerfile index a96d5b9..bf44599 100644 --- a/Dockerfile +++ b/Dockerfile @@ -351,6 +351,15 @@ FROM rust as rust-musl RUN rustup target add \ aarch64-unknown-linux-musl \ x86_64-unknown-linux-musl +RUN dpkg --add-architecture amd64 && \ + dpkg --add-architecture arm64 && \ + apt-get update && \ + DEBIAN_FRONTEND=noninteractive apt-get install -y \ + binutils-aarch64-linux-gnu \ + g++-aarch64-linux-gnu gcc-aarch64-linux-gnu \ + libc6-dev-arm64-cross \ + musl-dev:amd64 musl-dev:arm64 + RUN --mount=type=cache,from=apt-base,source=/etc/apt,target=/etc/apt,sharing=locked \ --mount=type=cache,from=apt-base,source=/var/cache/apt,target=/var/cache/apt,sharing=locked \ --mount=type=cache,from=apt-base,source=/var/lib/apt,target=/var/lib/apt,sharing=locked \ diff --git a/bin/just-cargo b/bin/just-cargo index c759763..7b95e01 100755 --- a/bin/just-cargo +++ b/bin/just-cargo @@ -24,8 +24,13 @@ export RUSTFLAGS := env_var_or_default("RUSTFLAGS", "-D warnings") + if target = _llvm-version := '19' _clang := 'clang-' + _llvm-version +_clang-include := '/usr/lib/llvm-19/lib/clang/19/include' _strip := 'llvm-strip-' + _llvm-version _ar := 'llvm-ar-' + _llvm-version +# -nostdinc stops glibc's /usr/include from being searched +# set includes appropriate to the rust target +export CFLAGS_aarch64_unknown_linux_musl := '-nostdinc -isystem ' + _clang-include + ' -isystem /usr/include/aarch64-linux-musl' +export CFLAGS_x86_64_unknown_linux_musl := '-nostdinc -isystem ' + _clang-include + ' -isystem /usr/include/x86_64-linux-musl' # Use LLD to statically link binaries (when building for musl). _rustflags-self-contained := "-Clink-self-contained=yes -Clinker=rust-lld -Clink-arg=-fuse-ld=lld -Clink-arg=-Wl,--no-rosegment" From 6d0c17af263f860ee0c3e1d5e83bc08607857b8f Mon Sep 17 00:00:00 2001 From: Raymond Kroeker Date: Wed, 28 Oct 2026 16:42:48 -0700 Subject: [PATCH 2/8] fix: job to build on both architectures, fix just-cargo --- .github/workflows/devcontainer.yml | 16 ++++++++++++++-- Dockerfile | 19 ++++++++----------- bin/just-cargo | 11 ++++++----- 3 files changed, 28 insertions(+), 18 deletions(-) diff --git a/.github/workflows/devcontainer.yml b/.github/workflows/devcontainer.yml index 078d7fd..bab03b3 100644 --- a/.github/workflows/devcontainer.yml +++ b/.github/workflows/devcontainer.yml @@ -6,18 +6,30 @@ on: - .devcontainer/** - .github/workflows/devcontainer.yml - Dockerfile + - bin/just-cargo - justfile permissions: contents: read jobs: + # Published images support both architectures, so build each on a native + # runner rather than under emulation. dev-build: - runs-on: ubuntu-latest + strategy: + fail-fast: false + matrix: + include: + - arch: amd64 + runner: ubuntu-24.04 + - arch: arm64 + runner: ubuntu-24.04-arm + name: dev-build (${{ matrix.arch }}) + runs-on: ${{ matrix.runner }} steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 - uses: ./actions/setup-tools - - run: just build + - run: just docker_arch=linux/${{ matrix.arch }} build dev-shellcheck: runs-on: ubuntu-latest diff --git a/Dockerfile b/Dockerfile index bf44599..723dac0 100644 --- a/Dockerfile +++ b/Dockerfile @@ -351,23 +351,20 @@ FROM rust as rust-musl RUN rustup target add \ aarch64-unknown-linux-musl \ x86_64-unknown-linux-musl -RUN dpkg --add-architecture amd64 && \ - dpkg --add-architecture arm64 && \ - apt-get update && \ - DEBIAN_FRONTEND=noninteractive apt-get install -y \ - binutils-aarch64-linux-gnu \ - g++-aarch64-linux-gnu gcc-aarch64-linux-gnu \ - libc6-dev-arm64-cross \ - musl-dev:amd64 musl-dev:arm64 - RUN --mount=type=cache,from=apt-base,source=/etc/apt,target=/etc/apt,sharing=locked \ --mount=type=cache,from=apt-base,source=/var/cache/apt,target=/var/cache/apt,sharing=locked \ --mount=type=cache,from=apt-base,source=/var/lib/apt,target=/var/lib/apt,sharing=locked \ + dpkg --add-architecture amd64 && \ + dpkg --add-architecture arm64 && \ + apt-get update && \ DEBIAN_FRONTEND=noninteractive apt-get install -y \ binutils-aarch64-linux-gnu \ - g++-aarch64-linux-gnu \ + binutils-x86-64-linux-gnu \ gcc-aarch64-linux-gnu \ - libc6-dev-arm64-cross + gcc-x86-64-linux-gnu \ + libc6-dev-arm64-cross \ + musl-dev:amd64 \ + musl-dev:arm64 ## ## Devcontainer diff --git a/bin/just-cargo b/bin/just-cargo index 7b95e01..dd39267 100755 --- a/bin/just-cargo +++ b/bin/just-cargo @@ -24,13 +24,9 @@ export RUSTFLAGS := env_var_or_default("RUSTFLAGS", "-D warnings") + if target = _llvm-version := '19' _clang := 'clang-' + _llvm-version -_clang-include := '/usr/lib/llvm-19/lib/clang/19/include' +_clang-include := '/usr/lib/llvm-' + _llvm-version + '/lib/clang/' + _llvm-version + '/include' _strip := 'llvm-strip-' + _llvm-version _ar := 'llvm-ar-' + _llvm-version -# -nostdinc stops glibc's /usr/include from being searched -# set includes appropriate to the rust target -export CFLAGS_aarch64_unknown_linux_musl := '-nostdinc -isystem ' + _clang-include + ' -isystem /usr/include/aarch64-linux-musl' -export CFLAGS_x86_64_unknown_linux_musl := '-nostdinc -isystem ' + _clang-include + ' -isystem /usr/include/x86_64-linux-musl' # Use LLD to statically link binaries (when building for musl). _rustflags-self-contained := "-Clink-self-contained=yes -Clinker=rust-lld -Clink-arg=-fuse-ld=lld -Clink-arg=-Wl,--no-rosegment" @@ -44,6 +40,8 @@ export CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER := 'aarch64-linux-gnu-gcc' # linux/arm64 + musl export AR_aarch64_unknown_linux_musl := _ar export CC_aarch64_unknown_linux_musl := _clang +# -nostdinc: do not search glibc for musl targets +export CFLAGS_aarch64_unknown_linux_musl := '-nostdinc -isystem ' + _clang-include + ' -isystem /usr/include/aarch64-linux-musl' export STRIP_aarch64_unknown_linux_musl := _strip export CARGO_TARGET_AARCH64_UNKNOWN_LINUX_MUSL_RUSTFLAGS := _rustflags-self-contained @@ -55,7 +53,10 @@ export STRIP_x86_64_unknown_linux_gnu := _strip # linux/amd64 + musl export AR_x86_64_unknown_linux_musl := _ar export CC_x86_64_unknown_linux_musl := _clang +# -nostdinc: do not search glibc for musl targets +export CFLAGS_x86_64_unknown_linux_musl := '-nostdinc -isystem ' + _clang-include + ' -isystem /usr/include/x86_64-linux-musl' export STRIP_x86_64_unknown_linux_musl := _strip +export CARGO_TARGET_X86_64_UNKNOWN_LINUX_MUSL_LINKER := 'x86_64-linux-gnu-gcc' export CARGO_TARGET_X86_64_UNKNOWN_LINUX_MUSL_RUSTFLAGS := _rustflags-self-contained all: fetch clippy test From 277df20960d3778d80583727550f7cd93c63cf46 Mon Sep 17 00:00:00 2001 From: Raymond Kroeker Date: Thu, 29 Oct 2026 09:01:18 -0700 Subject: [PATCH 3/8] chore: bump version -> v53 --- actions/setup-tools/action.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/actions/setup-tools/action.yml b/actions/setup-tools/action.yml index 9b7ad6f..647d8a6 100644 --- a/actions/setup-tools/action.yml +++ b/actions/setup-tools/action.yml @@ -5,7 +5,7 @@ inputs: # TODO(ver): CI should validate at this version matches the most recent release tag version: description: Container image version - default: v52 + default: v53 runs: using: composite From 118d5f54cefadcbd065f59ed91509646b795b69a Mon Sep 17 00:00:00 2001 From: Raymond Kroeker Date: Thu, 29 Oct 2026 10:52:29 -0700 Subject: [PATCH 4/8] chore: move env+bump version --- .devcontainer/devcontainer.json | 2 +- Dockerfile | 4 ++++ bin/just-cargo | 6 ------ 3 files changed, 5 insertions(+), 7 deletions(-) diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json index 95be8b2..98a5028 100644 --- a/.devcontainer/devcontainer.json +++ b/.devcontainer/devcontainer.json @@ -1,6 +1,6 @@ { "name": "linkerd-dev", - "image": "ghcr.io/linkerd/dev:v52", + "image": "ghcr.io/linkerd/dev:v53", "customizations": { "vscode": { "extensions": [ diff --git a/Dockerfile b/Dockerfile index 723dac0..d0587c9 100644 --- a/Dockerfile +++ b/Dockerfile @@ -365,6 +365,10 @@ RUN --mount=type=cache,from=apt-base,source=/etc/apt,target=/etc/apt,sharing=loc libc6-dev-arm64-cross \ musl-dev:amd64 \ musl-dev:arm64 +ARG CLANG_INCLUDE=/usr/lib/llvm-19/lib/clang/19/include +ENV CFLAGS_aarch64_unknown_linux_musl="-nostdinc -isystem ${CLANG_INCLUDE} -isystem /usr/include/aarch64-linux-musl" \ + CFLAGS_x86_64_unknown_linux_musl="-nostdinc -isystem ${CLANG_INCLUDE} -isystem /usr/include/x86_64-linux-musl" \ + CARGO_TARGET_X86_64_UNKNOWN_LINUX_MUSL_LINKER=x86_64-linux-gnu-gcc ## ## Devcontainer diff --git a/bin/just-cargo b/bin/just-cargo index dd39267..c759763 100755 --- a/bin/just-cargo +++ b/bin/just-cargo @@ -24,7 +24,6 @@ export RUSTFLAGS := env_var_or_default("RUSTFLAGS", "-D warnings") + if target = _llvm-version := '19' _clang := 'clang-' + _llvm-version -_clang-include := '/usr/lib/llvm-' + _llvm-version + '/lib/clang/' + _llvm-version + '/include' _strip := 'llvm-strip-' + _llvm-version _ar := 'llvm-ar-' + _llvm-version @@ -40,8 +39,6 @@ export CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER := 'aarch64-linux-gnu-gcc' # linux/arm64 + musl export AR_aarch64_unknown_linux_musl := _ar export CC_aarch64_unknown_linux_musl := _clang -# -nostdinc: do not search glibc for musl targets -export CFLAGS_aarch64_unknown_linux_musl := '-nostdinc -isystem ' + _clang-include + ' -isystem /usr/include/aarch64-linux-musl' export STRIP_aarch64_unknown_linux_musl := _strip export CARGO_TARGET_AARCH64_UNKNOWN_LINUX_MUSL_RUSTFLAGS := _rustflags-self-contained @@ -53,10 +50,7 @@ export STRIP_x86_64_unknown_linux_gnu := _strip # linux/amd64 + musl export AR_x86_64_unknown_linux_musl := _ar export CC_x86_64_unknown_linux_musl := _clang -# -nostdinc: do not search glibc for musl targets -export CFLAGS_x86_64_unknown_linux_musl := '-nostdinc -isystem ' + _clang-include + ' -isystem /usr/include/x86_64-linux-musl' export STRIP_x86_64_unknown_linux_musl := _strip -export CARGO_TARGET_X86_64_UNKNOWN_LINUX_MUSL_LINKER := 'x86_64-linux-gnu-gcc' export CARGO_TARGET_X86_64_UNKNOWN_LINUX_MUSL_RUSTFLAGS := _rustflags-self-contained all: fetch clippy test From 78bed634a321d28cae0cb6c58601cc8bab74f042 Mon Sep 17 00:00:00 2001 From: Raymond Kroeker Date: Thu, 29 Oct 2026 10:56:49 -0700 Subject: [PATCH 5/8] chore: revert for testing ci --- .devcontainer/devcontainer.json | 2 +- actions/setup-tools/action.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json index 98a5028..95be8b2 100644 --- a/.devcontainer/devcontainer.json +++ b/.devcontainer/devcontainer.json @@ -1,6 +1,6 @@ { "name": "linkerd-dev", - "image": "ghcr.io/linkerd/dev:v53", + "image": "ghcr.io/linkerd/dev:v52", "customizations": { "vscode": { "extensions": [ diff --git a/actions/setup-tools/action.yml b/actions/setup-tools/action.yml index 647d8a6..9b7ad6f 100644 --- a/actions/setup-tools/action.yml +++ b/actions/setup-tools/action.yml @@ -5,7 +5,7 @@ inputs: # TODO(ver): CI should validate at this version matches the most recent release tag version: description: Container image version - default: v53 + default: v52 runs: using: composite From 060154759f8dadf4057da606f94275d52d3f1d93 Mon Sep 17 00:00:00 2001 From: Raymond Kroeker Date: Thu, 29 Oct 2026 11:07:22 -0700 Subject: [PATCH 6/8] chore: promote to v53 --- .devcontainer/devcontainer.json | 2 +- actions/setup-tools/action.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json index 95be8b2..98a5028 100644 --- a/.devcontainer/devcontainer.json +++ b/.devcontainer/devcontainer.json @@ -1,6 +1,6 @@ { "name": "linkerd-dev", - "image": "ghcr.io/linkerd/dev:v52", + "image": "ghcr.io/linkerd/dev:v53", "customizations": { "vscode": { "extensions": [ diff --git a/actions/setup-tools/action.yml b/actions/setup-tools/action.yml index 9b7ad6f..647d8a6 100644 --- a/actions/setup-tools/action.yml +++ b/actions/setup-tools/action.yml @@ -5,7 +5,7 @@ inputs: # TODO(ver): CI should validate at this version matches the most recent release tag version: description: Container image version - default: v52 + default: v53 runs: using: composite From 39bf7c61236da5d817d16c7f3b6e78d2bec749f3 Mon Sep 17 00:00:00 2001 From: Raymond Kroeker Date: Thu, 29 Oct 2026 15:08:28 -0700 Subject: [PATCH 7/8] chore: dev-build check Make the platform builds (dev-build-arch) roll up into a single check that pr merges gate on. --- .github/workflows/devcontainer.yml | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/.github/workflows/devcontainer.yml b/.github/workflows/devcontainer.yml index bab03b3..f683d1f 100644 --- a/.github/workflows/devcontainer.yml +++ b/.github/workflows/devcontainer.yml @@ -15,7 +15,7 @@ permissions: jobs: # Published images support both architectures, so build each on a native # runner rather than under emulation. - dev-build: + dev-build-arch: strategy: fail-fast: false matrix: @@ -31,6 +31,15 @@ jobs: - uses: ./actions/setup-tools - run: just docker_arch=linux/${{ matrix.arch }} build + # Branch protection requires a check named dev-build. always() so that a + # failed arch build fails this check rather than skipping it. + dev-build: + needs: dev-build-arch + if: always() + runs-on: ubuntu-latest + steps: + - run: test '${{ needs.dev-build-arch.result }}' = success + dev-shellcheck: runs-on: ubuntu-latest steps: From fa97f5c73fb85120682d1b14187e3cbe03d45d57 Mon Sep 17 00:00:00 2001 From: Raymond Kroeker Date: Fri, 30 Oct 2026 09:51:24 -0700 Subject: [PATCH 8/8] chore: pin setup-rust to ubuntu-24.04 --- .github/workflows/actions.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/actions.yml b/.github/workflows/actions.yml index 08ed28e..935c34c 100644 --- a/.github/workflows/actions.yml +++ b/.github/workflows/actions.yml @@ -61,7 +61,7 @@ jobs: - run: go version setup-rust: - runs-on: ubuntu-latest + runs-on: ubuntu-24.04 timeout-minutes: 5 steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1