Fix/docker containerd cri dockerd k8s136

.github/workflows/archinfra-k8s-docker-r1.yml

@@ -0,0 +1,162 @@
+name: Archinfra Kubernetes Docker Runtime r1
+
+on:
+  workflow_dispatch:
+  pull_request:
+    paths:
+      - "archinfra/**"
+      - "docker/**"
+      - "registry/**"
+      - "k8s/**"
+      - ".github/workflows/archinfra-k8s-docker-r1.yml"
+  push:
+    branches:
+      - main
+    paths:
+      - "archinfra/releases/v1.36.4-r1.env"
+      - "archinfra/scripts/**"
+      - "docker/**"
+      - "registry/**"
+      - "k8s/**"
+      - ".github/workflows/archinfra-k8s-docker-r1.yml"
+
+permissions:
+  contents: read
+  packages: write
+
+concurrency:
+  group: archinfra-kubernetes-runtime-v1.36.4-r1
+  cancel-in-progress: false
+
+env:
+  RELEASE_FILE: ${{ github.workspace }}/archinfra/releases/v1.36.4-r1.env
+
+jobs:
+  validate:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Validate deterministic runtime release
+        shell: bash
+        run: |
+          set -euo pipefail
+          bash -n archinfra/scripts/build-k8s-docker.sh
+          source archinfra/releases/v1.36.4-r1.env
+          test "$RELEASE_VERSION" = "v1.36.4-r1"
+          test "$ARCH" = "amd64"
+          test "$RUNTIME_PROFILE" = "docker"
+          test "$KUBERNETES_VERSION" = "1.36.4"
+          test "$SEALOS_VERSION" = "5.1.1"
+          test "$DOCKER_VERSION" = "28.5.2"
+          test "$SEALOS_CACHE_DIGEST" != ""
+          test "$DOCKER_CACHE_DIGEST" != ""
+          test "$CRICTL_CACHE_DIGEST" != ""
+          test "$KUBERNETES_CACHE_DIGEST" != ""
+          echo "release lock validation OK"
+
+  build:
+    if: ${{ github.event_name != 'pull_request' }}
+    needs: validate
+    runs-on: ubuntu-24.04
+    timeout-minutes: 60
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Install deterministic build host tools
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends \
+            buildah \
+            skopeo \
+            jq \
+            file \
+            uidmap \
+            fuse-overlayfs
+          buildah --version
+          skopeo --version
+          jq --version
+
+      - name: Build and publish Cluster Image to GHCR
+        env:
+          GHCR_USER: ${{ github.actor }}
+          GHCR_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: bash archinfra/scripts/build-k8s-docker.sh
+
+      - name: Mirror verified Runtime image to Alibaba Cloud ACR
+        if: ${{ vars.PUBLISH_ALIYUN == 'true' }}
+        shell: bash
+        env:
+          GHCR_USER: ${{ github.actor }}
+          GHCR_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          ALIYUN_REGISTRY: ${{ vars.ALIYUN_REGISTRY }}
+          ALIYUN_NAMESPACE: ${{ vars.ALIYUN_NAMESPACE }}
+          ALIYUN_USERNAME: ${{ secrets.ALIYUN_USERNAME }}
+          ALIYUN_PASSWORD: ${{ secrets.ALIYUN_PASSWORD }}
+        run: |
+          set -euo pipefail
+
+          source archinfra/releases/v1.36.4-r1.env
+          PROVENANCE="out/runtime-v1.36.4-r1.provenance.env"
+          test -s "$PROVENANCE"
+
+          : "${ALIYUN_REGISTRY:?organization variable ALIYUN_REGISTRY is required}"
+          : "${ALIYUN_NAMESPACE:?organization variable ALIYUN_NAMESPACE is required}"
+          : "${ALIYUN_USERNAME:?organization secret ALIYUN_USERNAME is required}"
+          : "${ALIYUN_PASSWORD:?organization secret ALIYUN_PASSWORD is required}"
+
+          ALIYUN_IMAGE="${ALIYUN_REGISTRY}/${ALIYUN_NAMESPACE}/kubernetes-runtime:${RELEASE_VERSION}-${ARCH}"
+
+          SRC_DIGEST="$(skopeo inspect \
+            --creds "$GHCR_USER:$GHCR_TOKEN" \
+            "docker://$FINAL_IMAGE" | jq -r '.Digest')"
+          test "$SRC_DIGEST" = "$(grep '^FINAL_DIGEST=' "$PROVENANCE" | cut -d= -f2-)"
+
+          echo "Mirroring:"
+          echo "  source: $FINAL_IMAGE@$SRC_DIGEST"
+          echo "  target: $ALIYUN_IMAGE"
+
+          skopeo copy \
+            --all \
+            --preserve-digests \
+            --src-creds "$GHCR_USER:$GHCR_TOKEN" \
+            --dest-creds "$ALIYUN_USERNAME:$ALIYUN_PASSWORD" \
+            "docker://$FINAL_IMAGE" \
+            "docker://$ALIYUN_IMAGE"
+
+          DST_DIGEST="$(skopeo inspect \
+            --creds "$ALIYUN_USERNAME:$ALIYUN_PASSWORD" \
+            "docker://$ALIYUN_IMAGE" | jq -r '.Digest')"
+
+          if [[ "$DST_DIGEST" != "$SRC_DIGEST" ]]; then
+            echo "ERROR: Aliyun ACR digest mismatch: source=$SRC_DIGEST target=$DST_DIGEST" >&2
+            exit 1
+          fi
+
+          cat >> "$PROVENANCE" <<EOF
+          ALIYUN_MIRROR_STATUS=VERIFIED
+          ALIYUN_REGISTRY=$ALIYUN_REGISTRY
+          ALIYUN_NAMESPACE=$ALIYUN_NAMESPACE
+          ALIYUN_IMAGE=$ALIYUN_IMAGE
+          ALIYUN_DIGEST=$DST_DIGEST
+          EOF
+
+          {
+            echo "## Alibaba Cloud ACR mirror"
+            echo
+            echo "- Image: \`$ALIYUN_IMAGE\`"
+            echo "- Digest: \`$DST_DIGEST\`"
+            echo "- Status: VERIFIED"
+          } >> "$GITHUB_STEP_SUMMARY"
+
+          echo "Aliyun ACR mirror VERIFIED: $ALIYUN_IMAGE@$DST_DIGEST"
+
+      - name: Upload runtime provenance
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: kubernetes-runtime-v1.36.4-r1-provenance
+          path: out/
+          if-no-files-found: warn

archinfra/releases/v1.36.4-r1.env

@@ -0,0 +1,48 @@
+# Archinfra Kubernetes runtime release lock
+# This file consumes the VERIFIED cache build produced by archinfra/kubernetes-cache.
+# Runtime release builds MUST NOT resolve component versions dynamically.
+
+RELEASE_VERSION=v1.36.4-r1
+ARCH=amd64
+RUNTIME_PROFILE=docker
+
+KUBERNETES_VERSION=1.36.4
+SEALOS_VERSION=5.1.1
+DOCKER_VERSION=28.5.2
+CRI_DOCKERD_VERSION=0.4.4
+CRICTL_VERSION=1.36.0
+REGISTRY_VERSION=3.1.1
+DOCKER_BUNDLED_CONTAINERD_VERSION=1.7.28
+DOCKER_BUNDLED_RUNC_VERSION=1.3.3
+
+# Provenance of the verified cache release consumed by this runtime.
+CACHE_BUILD_RUN_ID=34090624151
+CACHE_BUILD_GIT_SHA=cc49c691384e488c57f7d2871e41491c384856bb
+
+SEALOS_CACHE_IMAGE=ghcr.io/archinfra/kubernetes-cache:sealos-v5.1.1-amd64
+SEALOS_CACHE_DIGEST=sha256:7cf5261c3b3f7db31e3f29e8452b82bb0b05b016aeb237b88d69b0c6d2a10523
+
+DOCKER_CACHE_IMAGE=ghcr.io/archinfra/kubernetes-cache:cri-docker-v28.5.2-cridockerd-v0.4.4-registry-v3.1.1-amd64
+DOCKER_CACHE_DIGEST=sha256:6dc872804628b98223e56e8e0ef7464ae14310f62c4f790601d9572305bd0a1c
+
+CRICTL_CACHE_IMAGE=ghcr.io/archinfra/kubernetes-cache:cri-v1.36-amd64
+CRICTL_CACHE_DIGEST=sha256:3f672ab56c5a0687292fadb6fc8f6fd351ae82e36a7d5b98ff5440d93000e2b6
+
+KUBERNETES_CACHE_IMAGE=ghcr.io/archinfra/kubernetes-cache:kubernetes-v1.36.4-amd64
+KUBERNETES_CACHE_DIGEST=sha256:2e7ac7992dcfe6df24970ad9531d552b4995cbd17dea712e3d15769d0c3172f3
+
+# Source-artifact checks retained as defense in depth after OCI digest pinning.
+DOCKER_SOURCE_SHA256=ea90cfd12e1eeb12aa1c971741adb8bd4ed88e2a574eaac13f5029a1dbc6300d
+CRI_DOCKERD_SOURCE_SHA256=109b7540053a507dd85ad7b9fee9cee9caae55feedcc28365d3e7ab4fb2172d5
+CRICTL_SOURCE_SHA256=83855e114566a8a8c44c548d515670f51de3a5e1da8b2effb59870e2f10c25a3
+KUBERNETES_IMAGE_LIST_SHA256=3ba2f001a417a25085fd9d44407730d49d539d5122fac44530f77658df8bced1
+
+KUBEADM_ETCD_VERSION=3.6.8-0
+KUBEADM_COREDNS_VERSION=v1.14.2
+KUBEADM_PAUSE_VERSION=3.10.2
+
+# Sealos HA helper. r1 records the resolved registry digest during the runtime build;
+# it will be digest-pinned in the runtime build lock after the first VERIFIED build.
+LVSCARE_IMAGE=ghcr.io/labring/lvscare:v5.1.1
+
+FINAL_IMAGE=ghcr.io/archinfra/kubernetes-runtime/kubernetes-docker:v1.36.4-r1-amd64