Inital Resolute Raccoon stemcell changes by mkocher · Pull Request #497 · cloudfoundry/bosh-linux-stemcell-builder

mkocher · 2026-03-26T06:17:02Z

Note

This PR is made against the Noble branch in order to facilitate reviewing the PR. Upon approval it will be pushed as new ubuntu-resolute branch.

This is a work in progress Resolute Raccoon stemcell. It can build a warden stemcell and with some relatively minor release changes to garden-runc, pxc, and capi releases it can compile and deploy a cf-deployment environment.

Feedback about changes we should make in this stemcell line is welcome. At the moment there are no large changes like cgroupsv2 or systemd planned.

It's worth noting that Resolute brings in the rust rewrite of coreutils. Some recent changes to the install utility broke pxc compliation, and may break other releases. See uutils/coreutils#11469 for more information.

aramprice · 2026-03-26T09:00:06Z

I'm stoked to see this progress, nice work!

coderabbitai · 2026-06-01T18:45:31Z

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: c89a2753-b536-4e13-988a-a8512abdc9c7

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch feat/mk/ubuntu-resolute

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

Introduces Ubuntu 26.04 'Resolute Raccoon' as a supported stemcell target, adding stage configurations, package lists, spec fixtures, and build tooling to produce and validate a Resolute stemcell image. Rakefile now raises an error when operating_system_version is not specified to prevent accidental builds without an explicit OS target. Repack helper scripts and Vagrant configuration are updated to support the Resolute OS image layout. Warden stage masks systemd-udevd.service, which has no function in containerised environments. Package fixture lists are updated to reflect Resolute package names: libxmlsec1t64 is now libxmlsec1-1, linux-firmware-amd-misc is added, and libpython3.13 is removed (libpython3.14 is still present).

Collects fixes for failures that occur when running warden containers under Docker on Colima/Lima on Apple Silicon (arm64 kernel, x86_64 userland via Rosetta 2). base_warden/apply.sh: - Systemd service drop-ins (rosetta-compat.conf): disable MemoryDenyWriteExecute and SystemCallFilter for journald, resolved, networkd, logind, timesyncd, udevd, logrotate, and auditd. Rosetta's JIT requires W+X memory which these restrictions block. - auditd foreground: run auditd -n (no fork) to avoid PIDFile lifecycle failures when systemd cannot create pidfd references in Docker. - SSH socket activation: mask ssh.socket and enable ssh.service so sshd binds port 22 directly; the socket listener fork fails with ENOSYS under Docker/Colima. - systemd-binfmt, nvmf-autoconnect, systemd-udevd: masked as they have no function in warden containers and fail on startup. - PAM su fix: replace /etc/pam.d/su with a minimal config (pam_rootok + pam_permit). Under Lima's Rosetta emulation, AppArmor blocks unix_chkpwd from accessing the Rosetta binary, causing su to fail even for root. Using pam_rootok.so sufficient means root never invokes unix_chkpwd. Safe for warden: the host provides the security boundary. bosh_audit_ubuntu/apply.sh: - mkdir -p /etc/audit/rules.d before writing rules. Ubuntu 26.04 auditd no longer pre-creates this directory during package installation.

…rden Audit rule corrections for Ubuntu Resolute: Time-change rule (32-bit): drop -S stime from the adjtimex/settimeofday line. On current Ubuntu/glibc, stime is not a usable syscall, so removing it matches what the image can actually ship and what auditd will accept. System-locale rules: reorder exit,always → always,exit to match common auditd ordering and CIS-style wording, consistent with the rest of the file. Adds the base_ubuntu_arm64_systemd stage for the "multiarch" warden variant (resolute-multiarch). This stage replaces x86_64 systemd ELF binaries with arm64 equivalents so that systemd runs natively on Apple Silicon arm64 kernels under Rosetta, fixing pidfd_open and pidfd_send_signal ENOSYS failures. Standard warden and cloud infrastructure builds are unaffected. Updates stage collection, kernel, grub, and test fixtures to reflect the Resolute stemcell layout. rosetta stuff

Universe packages are not covered by Ubuntu's Extended Security Maintenance (ESM) programme, creating a gap in long-term security support. This commit removes or replaces universe packages with equivalents from the main component. rng-tools (rng-tools-debian): removed. Linux 5.6+ includes a well-seeded CRNG via jitterentropy and CONFIG_RANDOM_TRUST_CPU, making a userspace rng daemon redundant. Ubuntu Resolute ships kernel 6.x; rngd provides no meaningful entropy improvement on this hardware. rsyslog-openssl: replaced with rsyslog-gnutls (in main). The only reason rsyslog-openssl was installed was the base rsyslog.conf loading omrelp with tls.tlslib="openssl". rsyslog-gnutls provides equivalent TLS support and is already present. syslog-release defaults syslog.tls_library to "gtls" (GnuTLS) and ops-manager hardcodes gtls in its rsyslog ERB templates, making rsyslog-gnutls a compatible drop-in for the vast majority of operators. Additional universe packages are removed; bosh_systemd stage and dpkg fixture lists are updated to reflect the Resolute package set.

Documents the Ubuntu Resolute (26.04) stemcell build and test process.

mkocher · 2026-06-06T00:01:38Z

I've addressed the initial feedback and would appreciate anyone interested taking a deeper look and providing feedback. I've added more comments than I normally would, as it seemed the best way to explain the changes.

I've also added a warden-rosetta variant of the stemcell which uses an arm64 systemd binary.

mkocher marked this pull request as draft March 26, 2026 06:17

cf-foundation-community-automation Bot added this to Foundational Infrastructure Working Group Mar 26, 2026

cf-foundation-community-automation Bot moved this to Inbox in Foundational Infrastructure Working Group Mar 26, 2026