[PR #40] [MERGED] fix(build): run RUN steps in a real LXC container (reliable builds) #41

New issue

Closed

opened 2026-10-15 12:51:32 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-15 12:51:32 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/games-on-whales/LXC2Docker/pull/40
Author: @JBailes
Created: 5/30/2026
Status: ✅ Merged
Merged: 5/30/2026
Merged by: @JBailes

Base: main ← Head: fix/build-run-in-lxc-container

📝 Commits (1)

94a090a fix(build): run RUN steps in a real LXC container; exempt builders from GC; allow bridge forwarding

📊 Changes

4 files changed (+97 additions, -80 deletions)

View changed files

📝 internal/api/build.go (+41 -70)
📝 internal/api/build_portainer_test.go (+19 -10)
📝 internal/lxc/manager.go (+9 -0)
📝 internal/lxc/network.go (+28 -0)

📄 Description

The classic image builder ran each RUN step via unshare+chroot. Under the 7.0-pve kernel, gcc/apt intermittently failed in the chroot with No such file or directory on exec (gcc could not exec its assembler), making aimee-kb builds fail ~50pct of the time. Proven not to be the clone (cp -a is deterministic and complete) and not LTO. Fix: run each RUN step inside a real ephemeral build- LXC container via lxc-attach, which has a proper /proc and reliable exec. This exposed two more bugs, also fixed here: (1) the Wolf-origin GC stopped the running builder mid-build (no underscore in build- names made it look like an orphaned support container) causing RUN failed exit 137 (SIGKILL) - builders are now GC-exempt; (2) container outbound NAT was blocked by a leftover FORWARD policy DROP from a purged docker (the chroot never hit this since it used the host netns) so apt could not reach mirrors - EnsureBridge now inserts idempotent iptables FORWARD ACCEPT rules for the bridge. Result: 6/6 consecutive aimee-kb builds succeeded (previously ~50-100pct failed). go build, go vet, and the full test suite pass.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/games-on-whales/LXC2Docker/pull/40 **Author:** [@JBailes](https://github.com/JBailes) **Created:** 5/30/2026 **Status:** ✅ Merged **Merged:** 5/30/2026 **Merged by:** [@JBailes](https://github.com/JBailes) **Base:** `main` ← **Head:** `fix/build-run-in-lxc-container` --- ### 📝 Commits (1) - [`94a090a`](https://github.com/games-on-whales/LXC2Docker/commit/94a090a6765b8fa3f7f0b521eb47b64978b07e0c) fix(build): run RUN steps in a real LXC container; exempt builders from GC; allow bridge forwarding ### 📊 Changes **4 files changed** (+97 additions, -80 deletions) <details> <summary>View changed files</summary> 📝 `internal/api/build.go` (+41 -70) 📝 `internal/api/build_portainer_test.go` (+19 -10) 📝 `internal/lxc/manager.go` (+9 -0) 📝 `internal/lxc/network.go` (+28 -0) </details> ### 📄 Description The classic image builder ran each RUN step via unshare+chroot. Under the 7.0-pve kernel, gcc/apt intermittently failed in the chroot with No such file or directory on exec (gcc could not exec its assembler), making aimee-kb builds fail ~50pct of the time. Proven not to be the clone (cp -a is deterministic and complete) and not LTO. Fix: run each RUN step inside a real ephemeral build- LXC container via lxc-attach, which has a proper /proc and reliable exec. This exposed two more bugs, also fixed here: (1) the Wolf-origin GC stopped the running builder mid-build (no underscore in build- names made it look like an orphaned support container) causing RUN failed exit 137 (SIGKILL) - builders are now GC-exempt; (2) container outbound NAT was blocked by a leftover FORWARD policy DROP from a purged docker (the chroot never hit this since it used the host netns) so apt could not reach mirrors - EnsureBridge now inserts idempotent iptables FORWARD ACCEPT rules for the bridge. Result: 6/6 consecutive aimee-kb builds succeeded (previously ~50-100pct failed). go build, go vet, and the full test suite pass. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-15 12:51:32 +00:00