build.sh

#!/usr/bin/env bash
set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"

: "${FLAVOR:=firecracker}"
: "${KERNEL_REPO:=https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git}"
: "${VERSION:=v6.1}"
# Cloud Hypervisor requires its own linux fork and boot ABI (raw bzImage/Image
# via ch_defconfig), incompatible with Firecracker's uncompressed vmlinux.
# Keep this pin in sync with depot/scripts/build_cloud_hypervisor_kernel.sh.
: "${CLOUD_HYPERVISOR_LINUX_REPO:=https://github.com/cloud-hypervisor/linux.git}"
: "${CLOUD_HYPERVISOR_LINUX_COMMIT:=46b5aab6f24a7e31a861d66dfe9b559b310a6c2d}"
: "${USE_DOCKER:=1}"
: "${DOCKER_IMAGE:=ubuntu:24.04}"
: "${JOBS:=}"

usage() {
  cat <<'USAGE'
Build Linux kernels for Depot's VMMs.

Flags:
  --help               Show help
  --list-configs       List local config files (firecracker flavor only)
  --print-config-only  Print resolved settings and exit

Environment:
  FLAVOR                      firecracker | cloud-hypervisor (default: firecracker)
  ARCH                        x86_64 | aarch64 (default: host arch)
  VERSION                     Kernel tag, firecracker flavor only (default: v6.1)
  KERNEL_CONFIG_PATH          Override config path, firecracker flavor only
  CLOUD_HYPERVISOR_LINUX_REPO Override CH kernel source repo
  CLOUD_HYPERVISOR_LINUX_COMMIT
                               Override CH kernel pinned commit
  USE_DOCKER                  1 (default) to build inside Docker
  DOCKER_IMAGE                Docker image (default: ubuntu:24.04)
USAGE
}

normalize_arch() {
  case "$1" in
    x86_64|amd64) echo "x86_64" ;;
    aarch64|arm64) echo "aarch64" ;;
    *)
      echo "Unsupported ARCH: $1" >&2
      exit 1
      ;;
  esac
}

default_config_path() {
  case "$1" in
    x86_64) echo "${SCRIPT_DIR}/microvm-kernel-ci-x86_64-6.1.config" ;;
    aarch64) echo "${SCRIPT_DIR}/microvm-kernel-ci-aarch64-6.1.config" ;;
  esac
}

case "${FLAVOR}" in
  firecracker|cloud-hypervisor) ;;
  *)
    echo "Unsupported FLAVOR: ${FLAVOR} (want firecracker or cloud-hypervisor)" >&2
    exit 1
    ;;
esac

LIST_CONFIGS=0
PRINT_CONFIG_ONLY=0
ORIG_ARGS=("$@")

while [[ $# -gt 0 ]]; do
  case "$1" in
    --help|-h)
      usage
      exit 0
      ;;
    --list-configs)
      LIST_CONFIGS=1
      ;;
    --print-config-only)
      PRINT_CONFIG_ONLY=1
      ;;
    *)
      echo "Unknown flag: $1" >&2
      usage >&2
      exit 1
      ;;
  esac
  shift
done

: "${ARCH:=$(uname -m)}"
ARCH="$(normalize_arch "${ARCH}")"
if [[ "${FLAVOR}" == "firecracker" ]]; then
  : "${KERNEL_CONFIG_PATH:=$(default_config_path "${ARCH}")}"
fi

if [[ "${INSIDE_DOCKER:-0}" == "1" ]]; then
  : "${WORKDIR:=/workspace/.work}"
  : "${DIST_DIR:=/workspace/dist}"
else
  : "${WORKDIR:=${SCRIPT_DIR}/.work}"
  : "${DIST_DIR:=${SCRIPT_DIR}/dist}"
fi

if [[ "${LIST_CONFIGS}" == "1" ]]; then
  echo "${SCRIPT_DIR}/microvm-kernel-ci-x86_64-6.1.config"
  echo "${SCRIPT_DIR}/microvm-kernel-ci-aarch64-6.1.config"
  exit 0
fi

if [[ "${FLAVOR}" == "firecracker" && ! -f "${KERNEL_CONFIG_PATH}" ]]; then
  echo "Config not found: ${KERNEL_CONFIG_PATH}" >&2
  exit 1
fi

if [[ "${PRINT_CONFIG_ONLY}" == "1" ]]; then
  echo "FLAVOR=${FLAVOR}"
  echo "ARCH=${ARCH}"
  if [[ "${FLAVOR}" == "firecracker" ]]; then
    echo "VERSION=${VERSION}"
    echo "KERNEL_CONFIG_PATH=${KERNEL_CONFIG_PATH}"
  else
    echo "CLOUD_HYPERVISOR_LINUX_REPO=${CLOUD_HYPERVISOR_LINUX_REPO}"
    echo "CLOUD_HYPERVISOR_LINUX_COMMIT=${CLOUD_HYPERVISOR_LINUX_COMMIT}"
  fi
  echo "USE_DOCKER=${USE_DOCKER}"
  echo "WORKDIR=${WORKDIR}"
  echo "DIST_DIR=${DIST_DIR}"
  exit 0
fi

if [[ "${INSIDE_DOCKER:-0}" != "1" && "${USE_DOCKER}" == "1" ]]; then
  if ! command -v docker >/dev/null 2>&1; then
    echo "Docker is required" >&2
    exit 1
  fi

  docker_cfg=""
  if [[ "${FLAVOR}" == "firecracker" ]]; then
    if [[ "${KERNEL_CONFIG_PATH}" != "${SCRIPT_DIR}/"* ]]; then
      echo "KERNEL_CONFIG_PATH must be inside this repository when USE_DOCKER=1" >&2
      exit 1
    fi
    docker_cfg="/workspace/${KERNEL_CONFIG_PATH#${SCRIPT_DIR}/}"
  fi

  docker run --rm \
    -e INSIDE_DOCKER=1 \
    -e FLAVOR="${FLAVOR}" \
    -e ARCH="${ARCH}" \
    -e VERSION="${VERSION}" \
    -e KERNEL_REPO="${KERNEL_REPO}" \
    -e KERNEL_CONFIG_PATH="${docker_cfg}" \
    -e CLOUD_HYPERVISOR_LINUX_REPO="${CLOUD_HYPERVISOR_LINUX_REPO}" \
    -e CLOUD_HYPERVISOR_LINUX_COMMIT="${CLOUD_HYPERVISOR_LINUX_COMMIT}" \
    -e WORKDIR="/workspace/.work" \
    -e DIST_DIR="/workspace/dist" \
    -e JOBS="${JOBS}" \
    -v "${SCRIPT_DIR}:/workspace" \
    -w /workspace \
    "${DOCKER_IMAGE}" \
    /workspace/build.sh "${ORIG_ARGS[@]}"
  exit $?
fi

install_deps() {
  host_arch="$(normalize_arch "$(uname -m)")"

  pkgs=(
    ca-certificates curl git build-essential bc flex bison
    libelf-dev libssl-dev file xz-utils
  )

  if [[ "${ARCH}" == "aarch64" && "${host_arch}" != "aarch64" ]]; then
    pkgs+=(gcc-aarch64-linux-gnu binutils-aarch64-linux-gnu)
  fi
  if [[ "${ARCH}" == "x86_64" && "${host_arch}" != "x86_64" ]]; then
    pkgs+=(gcc-x86-64-linux-gnu binutils-x86-64-linux-gnu)
  fi

  export DEBIAN_FRONTEND=noninteractive
  apt-get update
  apt-get install -y --no-install-recommends "${pkgs[@]}"
  rm -rf /var/lib/apt/lists/*
}

require_enabled() {
  cfg="$1"
  opt="$2"
  if ! grep -q "^${opt}=y$" "${cfg}"; then
    echo "Missing required config: ${opt}=y" >&2
    exit 1
  fi
}

arch_make_args() {
  local host_arch
  host_arch="$(normalize_arch "$(uname -m)")"
  make_args=("ARCH=${karch}")

  if [[ "${ARCH}" == "aarch64" && "${host_arch}" != "aarch64" ]]; then
    CROSS_COMPILE="${CROSS_COMPILE:-aarch64-linux-gnu-}"
    make_args+=("CROSS_COMPILE=${CROSS_COMPILE}")
  elif [[ "${ARCH}" == "x86_64" && "${host_arch}" != "x86_64" ]]; then
    CROSS_COMPILE="${CROSS_COMPILE:-x86_64-linux-gnu-}"
    make_args+=("CROSS_COMPILE=${CROSS_COMPILE}")
  fi

  if [[ -n "${CROSS_COMPILE:-}" ]] && ! command -v "${CROSS_COMPILE}gcc" >/dev/null 2>&1; then
    echo "Cross compiler not found: ${CROSS_COMPILE}gcc" >&2
    exit 1
  fi
}

build_kernel_firecracker() {
  linux_dir="${WORKDIR}/linux-firecracker"
  mkdir -p "${WORKDIR}" "${DIST_DIR}"

  if [[ ! -d "${linux_dir}/.git" ]]; then
    git clone --depth 1 "${KERNEL_REPO}" "${linux_dir}"
  fi

  pushd "${linux_dir}" >/dev/null
  # Reuse cached clone, but always clean it so tag checkout is deterministic.
  git reset --hard
  git clean -fdx
  git fetch --depth=1 origin "${VERSION}"
  git checkout --force --detach FETCH_HEAD
  cp "${KERNEL_CONFIG_PATH}" .config

  if [[ "${ARCH}" == "x86_64" ]]; then
    karch="x86"
    ktarget="vmlinux"
    kimage="vmlinux"
  else
    karch="arm64"
    ktarget="Image"
    kimage="arch/arm64/boot/Image"
  fi

  arch_make_args

  make "${make_args[@]}" olddefconfig

  require_enabled .config CONFIG_FUSE_FS
  require_enabled .config CONFIG_PCI
  require_enabled .config CONFIG_BLK_DEV_INITRD
  require_enabled .config CONFIG_OVERLAY_FS
  require_enabled .config CONFIG_VSOCKETS
  require_enabled .config CONFIG_VIRTIO_VSOCKETS

  if [[ -z "${JOBS}" ]]; then
    JOBS="$(getconf _NPROCESSORS_ONLN 2>/dev/null || echo 8)"
  fi

  make -j "${JOBS}" "${make_args[@]}" "${ktarget}"

  if [[ ! -f "${kimage}" ]]; then
    echo "Firecracker kernel build did not produce ${kimage}" >&2
    exit 1
  fi

  sha="$(sha256sum "${kimage}" | awk '{print $1}')"
  name="vmlinux-${ARCH}-${VERSION}-${sha}"

  cp "${kimage}" "${DIST_DIR}/${name}"
  cp .config "${DIST_DIR}/${name}.config"
  tar -C "${DIST_DIR}" -czf "${DIST_DIR}/${name}.tar.gz" "${name}" "${name}.config"

  echo "Built: ${DIST_DIR}/${name}.tar.gz"
  popd >/dev/null
}

build_kernel_cloud_hypervisor() {
  linux_dir="${WORKDIR}/linux-cloud-hypervisor"
  mkdir -p "${WORKDIR}" "${DIST_DIR}"

  if [[ ! -d "${linux_dir}/.git" ]]; then
    mkdir -p "${linux_dir}"
    git -C "${linux_dir}" init -q
    git -C "${linux_dir}" remote add origin "${CLOUD_HYPERVISOR_LINUX_REPO}"
  fi

  pushd "${linux_dir}" >/dev/null
  # Reuse cached clone, but always clean it so the pinned-commit checkout is
  # deterministic.
  git reset --hard 2>/dev/null || true
  git clean -fdx
  git fetch --depth=1 origin "${CLOUD_HYPERVISOR_LINUX_COMMIT}"
  git checkout --force --detach FETCH_HEAD

  if [[ "${ARCH}" == "x86_64" ]]; then
    karch="x86"
    ktarget="bzImage"
    kimage="arch/x86/boot/bzImage"
  else
    karch="arm64"
    ktarget="Image"
    kimage="arch/arm64/boot/Image"
  fi

  arch_make_args

  make "${make_args[@]}" ch_defconfig

  # Upstream ch_defconfig deliberately disables IPv6 on both supported
  # architectures. Depot private networks require an in-guest fdaa::/16
  # address and a link-local IPv6 gateway, so this is part of Depot's guest
  # ABI rather than an optional distribution feature. Keep this in sync with
  # depot/scripts/build_cloud_hypervisor_kernel.sh.
  ./scripts/config --file .config --enable IPV6
  make "${make_args[@]}" olddefconfig
  if ! grep -qx 'CONFIG_IPV6=y' .config; then
    echo "Cloud Hypervisor kernel configuration did not enable CONFIG_IPV6" >&2
    exit 1
  fi

  if [[ -z "${JOBS}" ]]; then
    JOBS="$(getconf _NPROCESSORS_ONLN 2>/dev/null || echo 8)"
  fi

  make -j "${JOBS}" "${make_args[@]}" "${ktarget}"

  if [[ ! -f "${kimage}" ]]; then
    echo "Cloud Hypervisor kernel build did not produce ${kimage}" >&2
    exit 1
  fi

  commit_short="${CLOUD_HYPERVISOR_LINUX_COMMIT:0:7}"
  sha="$(sha256sum "${kimage}" | awk '{print $1}')"
  name="cloud-hypervisor-kernel-${ARCH}-${commit_short}-${sha}"

  cp "${kimage}" "${DIST_DIR}/${name}"
  cp .config "${DIST_DIR}/${name}.config"
  tar -C "${DIST_DIR}" -czf "${DIST_DIR}/${name}.tar.gz" "${name}" "${name}.config"

  echo "Built: ${DIST_DIR}/${name}.tar.gz"
  popd >/dev/null
}

build_kernel() {
  if [[ "${FLAVOR}" == "cloud-hypervisor" ]]; then
    build_kernel_cloud_hypervisor
  else
    build_kernel_firecracker
  fi
}

if [[ "${INSIDE_DOCKER:-0}" == "1" ]]; then
  install_deps
fi

build_kernel