noel/act-node-docker
Watch
1
0
Fork
You've already forked act-node-docker
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

feat: seal Kind in the hermetic runner image #10

Merged
noel merged 1 commit from feat/kind-runner-toolchain-1714 into main 2026-08-19 23:36:44 +00:00
Conversation 0 Commits 1 Files changed 3 +18 -4
noel commented 2026-08-19 23:36:34 +00:00
Owner

Outcome

Add Kind v0.32.0 to the source-owned hermetic runner image. The protected
Codewire delivery job uses that image for its required exact-image Kind gate;
the current approved digest has kubectl but not kind.

Sealed-input boundary

  • upstream kind-linux-amd64 SHA-256:
    50030de23cf40a18505f20426f6a8506bedf13c6e509244bd1fa9463721b0f54
  • the image build verifies the checksum and installs the binary from its
    read-only _build_inputs mount
  • every image build step remains --network=none
  • no job downloads Kind or receives an additional credential

Verification

  • bash -n test-system-hz-hermetic.sh
  • ./test-system-hz-hermetic.sh
  • verified the upstream binary checksum and kind v0.32.0 version output
  • git diff --check

Ref: codewire/codewire#1714

## Outcome Add Kind v0.32.0 to the source-owned hermetic runner image. The protected Codewire delivery job uses that image for its required exact-image Kind gate; the current approved digest has `kubectl` but not `kind`. ## Sealed-input boundary - upstream `kind-linux-amd64` SHA-256: `50030de23cf40a18505f20426f6a8506bedf13c6e509244bd1fa9463721b0f54` - the image build verifies the checksum and installs the binary from its read-only `_build_inputs` mount - every image build step remains `--network=none` - no job downloads Kind or receives an additional credential ## Verification - `bash -n test-system-hz-hermetic.sh` - `./test-system-hz-hermetic.sh` - verified the upstream binary checksum and `kind v0.32.0` version output - `git diff --check` Ref: codewire/codewire#1714
noel merged commit 2f52a2d34a into main 2026-08-19 23:36:44 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
noel/act-node-docker!10
No description provided.