infra: simplify — remove GCP playbooks, reconcile agent deploy workflow - #2
Closed
posix4e wants to merge 1 commit into
Closed
infra: simplify — remove GCP playbooks, reconcile agent deploy workflow#2posix4e wants to merge 1 commit into
posix4e wants to merge 1 commit into
Conversation
posix4e
force-pushed
the
wip/infra-simplify
branch
from
March 24, 2026 16:10
4a59273 to
fab4707
Compare
posix4e
force-pushed
the
wip/infra-simplify
branch
from
March 24, 2026 16:29
f9a76a1 to
fb74a8c
Compare
posix4e
force-pushed
the
wip/infra-simplify
branch
from
March 24, 2026 16:36
fb74a8c to
c7e0464
Compare
posix4e
force-pushed
the
wip/infra-simplify
branch
from
March 24, 2026 18:47
c7e0464 to
72bfe26
Compare
posix4e
force-pushed
the
wip/infra-simplify
branch
from
March 24, 2026 18:51
72bfe26 to
df6c898
Compare
posix4e
force-pushed
the
wip/infra-simplify
branch
from
March 24, 2026 19:03
df6c898 to
411179d
Compare
posix4e
force-pushed
the
wip/infra-simplify
branch
2 times, most recently
from
March 24, 2026 19:08
6c8cfe5 to
c3d07aa
Compare
posix4e
force-pushed
the
wip/infra-simplify
branch
from
March 24, 2026 19:14
c3d07aa to
a2a09e2
Compare
posix4e
force-pushed
the
wip/infra-simplify
branch
from
March 24, 2026 19:36
a2a09e2 to
d958531
Compare
posix4e
force-pushed
the
wip/infra-simplify
branch
from
March 24, 2026 20:31
a6353a4 to
3ab9e1c
Compare
posix4e
force-pushed
the
wip/infra-simplify
branch
from
March 24, 2026 21:14
3ab9e1c to
a925eb3
Compare
posix4e
force-pushed
the
wip/infra-simplify
branch
from
March 24, 2026 21:35
a925eb3 to
98ff6d3
Compare
Member
Author
|
Superseded by PR #3 (wip/infra-simplify-clean) which includes all these changes plus security hardening, Packer fix, and proper secret wiring. |
posix4e
added a commit
that referenced
this pull request
Apr 11, 2026
The previous pin (easyenclave-75e0b30fa162) had two runtime bugs that were silently fatal for OCI container workloads: 1. src/container.rs used bollard, which tried to talk to /run/podman/ podman.sock — but mkosi.conf didn't install podman, so the socket never existed. Any EE_BOOT_WORKLOADS with an image: ref would fail at pull_and_run. 2. Fixed by easyenclave#46 (Rust-native libcontainer), but then exposed bug #2: the sealed rootfs had no libseccomp.so.2, so easyenclave crashed at dynamic-link time and PID 1 died → kernel panic at boot. easyenclave#47 added libseccomp2 to mkosi.conf Packages, and the resulting easyenclave-9ff1a1fca190 image passes image.yml's full pipeline (build + release + smoke-test boot a real TDX VM to "listening on"). This is the first sealed image with a functional container runtime. Cross-project compute.imageUser has been granted to both easyenclave-staging-ci@eestaging and 654815109728-compute@developer on the new image. The ghcr pins (dd-register/dd-web :31ff718b169b) are unchanged for this commit — those still point at the manual-dispatch tag from dd#73. A follow-up can bump them to :18158c8bd438 (dd#75 merge commit, currently building) or switch to :latest for staging. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
posix4e
added a commit
that referenced
this pull request
Apr 11, 2026
The previous pin (easyenclave-75e0b30fa162) had two runtime bugs that were silently fatal for OCI container workloads: 1. src/container.rs used bollard, which tried to talk to /run/podman/ podman.sock — but mkosi.conf didn't install podman, so the socket never existed. Any EE_BOOT_WORKLOADS with an image: ref would fail at pull_and_run. 2. Fixed by easyenclave#46 (Rust-native libcontainer), but then exposed bug #2: the sealed rootfs had no libseccomp.so.2, so easyenclave crashed at dynamic-link time and PID 1 died → kernel panic at boot. easyenclave#47 added libseccomp2 to mkosi.conf Packages, and the resulting easyenclave-9ff1a1fca190 image passes image.yml's full pipeline (build + release + smoke-test boot a real TDX VM to "listening on"). This is the first sealed image with a functional container runtime. Cross-project compute.imageUser has been granted to both easyenclave-staging-ci@eestaging and 654815109728-compute@developer on the new image. The ghcr pins (dd-register/dd-web :31ff718b169b) are unchanged for this commit — those still point at the manual-dispatch tag from dd#73. A follow-up can bump them to :18158c8bd438 (dd#75 merge commit, currently building) or switch to :latest for staging. Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
baremetal-deploy.yml(superseded bybaremetal-agent-deploy.ymlwhich is what CI actually uses)staging-deploy.ymlworkflow (GCP-only;baremetal-staging-deploy.ymlis the active staging workflow)infra/STATUS.mddocumenting the simplified baremetal-only structureCLAUDE.mdto reflect current infrastructureWhat remains
baremetal-agent-deploy.yml— the single playbook used by both staging and production CIvm-launch.sh,vm-stop.sh,vm-status.sh— VM lifecycle scripts used by the playbookagent.json.j2,control-plane.json.j2— config templatesTest plan
baremetal-staging-deploy.ymlworkflow still references correct playbook pathbaremetal-production-deploy.ymlworkflow still references correct playbook path🤖 Generated with Claude Code