feat(cast-render): build v9 for arm64 and verify each architecture #361

Merged

binjovi-bot merged 1 commit from feat/cast-render-arm64 into trunk

2026-09-14 13:38:08 +00:00

sean commented

2026-09-14 13:22:49 +00:00

Owner

Why

The fleet has only ARM64 workers since 2026-09-12. The ibmi-rpg recipe in binjovi-plans pins FROM --platform=linux/amd64 registry.sean.farm/build/cast-render:v8@sha256:fb1fb122... and renders the reels under an emulator. Today a release of rpg-munchers failed in that stage after 219 s with .buildkit_qemu_emulator: Invalid ELF image for this architecture.

What

cast-render v9. Binjovi builds it for linux/amd64 and linux/arm64 from the one Dockerfile (the agent's dockerfile-set allowlist passes platform=linux/amd64,linux/arm64 for this image). The plans recipe can move to v9 and drop its --platform pin.

Keep the per-TARGETARCH agg asset selection (agg-x86_64-unknown-linux-gnu, agg-aarch64-unknown-linux-gnu). Cite the release page and the asset digests for both sha256 pins. Both assets were downloaded again on 2026-09-14 and checked with shasum -a 256.
Add a final gate: glibc and ffmpeg-free must have the TARGETARCH package architecture, no foreign-architecture package may be installed, and the ELF machine field of agg, ffmpeg and ffprobe must match TARGETARCH. An emulator runs a wrong binary without an error; this gate does not.
Render a small asciicast with agg and encode it with libopenh264 in the gate. This proves the monospace font and the real H.264 encoder with the same commands the ibmi-rpg reels-render stage runs.
Remove mc. No consumer runs mc inside this image: the ibmi-rpg recipe and the historical import publish media from the package-publisher image.
Harden the agg download with --proto '=https' and retries. Point the source label at code.sean.farm.

The TARGETARCH versus uname -m check, the ffmpeg/ffprobe H.264 checks, and the PKG_CACHE flow are unchanged.

Checks

bash scripts/lint-no-runtime-fetch.sh dockerfiles images: clean.
The v8 arm64 image already carried an AArch64 agg (ELF machine 0xb7, read from the published layer). v9 makes that a build-time gate.

https://claude.ai/code/session_01HPdKaFBKQVs8hzfgXMrnwV

## Why The fleet has only ARM64 workers since 2026-09-12. The ibmi-rpg recipe in `binjovi-plans` pins `FROM --platform=linux/amd64 registry.sean.farm/build/cast-render:v8@sha256:fb1fb122...` and renders the reels under an emulator. Today a release of rpg-munchers failed in that stage after 219 s with `.buildkit_qemu_emulator: Invalid ELF image for this architecture`. ## What `cast-render` v9. Binjovi builds it for `linux/amd64` and `linux/arm64` from the one Dockerfile (the agent's dockerfile-set allowlist passes `platform=linux/amd64,linux/arm64` for this image). The plans recipe can move to v9 and drop its `--platform` pin. - Keep the per-`TARGETARCH` agg asset selection (`agg-x86_64-unknown-linux-gnu`, `agg-aarch64-unknown-linux-gnu`). Cite the release page and the asset digests for both sha256 pins. Both assets were downloaded again on 2026-09-14 and checked with `shasum -a 256`. - Add a final gate: `glibc` and `ffmpeg-free` must have the `TARGETARCH` package architecture, no foreign-architecture package may be installed, and the ELF machine field of `agg`, `ffmpeg` and `ffprobe` must match `TARGETARCH`. An emulator runs a wrong binary without an error; this gate does not. - Render a small asciicast with `agg` and encode it with `libopenh264` in the gate. This proves the monospace font and the real H.264 encoder with the same commands the ibmi-rpg `reels-render` stage runs. - Remove `mc`. No consumer runs `mc` inside this image: the ibmi-rpg recipe and the historical import publish media from the package-publisher image. - Harden the agg download with `--proto '=https'` and retries. Point the source label at code.sean.farm. The `TARGETARCH` versus `uname -m` check, the ffmpeg/ffprobe H.264 checks, and the `PKG_CACHE` flow are unchanged. ## Checks - `bash scripts/lint-no-runtime-fetch.sh dockerfiles images`: clean. - The v8 arm64 image already carried an AArch64 `agg` (ELF machine 0xb7, read from the published layer). v9 makes that a build-time gate. https://claude.ai/code/session_01HPdKaFBKQVs8hzfgXMrnwV

sean added 1 commit

2026-09-14 13:22:50 +00:00

feat(cast-render): build v9 for arm64 and verify each architecture

binjovi/ci Binjovi will not build this: its base branch must be trunk. Retarget the pull request.

fb7f203322

The fleet has only ARM64 workers since 2026-09-12. The ibmi-rpg recipe
pins `--platform=linux/amd64` for cast-render:v8 and renders under an
emulator. That emulated render failed today after 219 s with
`.buildkit_qemu_emulator: Invalid ELF image for this architecture`.

v9 is the first cast-render version built on the ARM64-only fleet.
Binjovi builds it for linux/amd64 and linux/arm64 from this one
Dockerfile. The consumer can drop its platform pin when it moves to v9.

Changes:
- Keep the per-TARGETARCH agg asset selection. Cite the release page
  and the asset digests for both sha256 pins. Both assets were
  downloaded again on 2026-09-14 and checked with `shasum -a 256`.
- Add a final gate: glibc and ffmpeg-free must have the TARGETARCH
  package architecture, no foreign-architecture package may be
  installed, and the ELF machine field of agg, ffmpeg and ffprobe must
  match TARGETARCH. An emulator runs a wrong binary without an error;
  this gate does not.
- Render a small asciicast with agg and encode it with libopenh264 in
  the gate. This proves the monospace font and the real H.264 encoder
  with the same commands the ibmi-rpg recipe runs.
- Remove mc. No consumer runs mc inside this image. The ibmi-rpg recipe
  and the historical import publish media from the package-publisher
  image.
- Harden the agg download with `--proto '=https'` and retries.
- Point the source label at code.sean.farm.

Claude-Session: https://claude.ai/code/session_01HPdKaFBKQVs8hzfgXMrnwV

binjovi-bot merged commit fb7f203322 into trunk

2026-09-14 13:38:08 +00:00

binjovi-bot deleted branch feat/cast-render-arm64

2026-09-14 13:38:08 +00:00

No reviewers

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

sean/builder-images!361

No description provided.

Rows
Columns