feat(ci): allow for supporting multi-arch images to be built and shipped by knechtionscoding · Pull Request #787 · kelos-dev/kelos

knechtionscoding · 2026-03-24T21:15:58Z

What type of PR is this?

/kind feature

What this PR does / why we need it:

Implements native multi-architecture Docker container builds for ARM64 and AMD64 platforms, replacing QEMU emulation with native runner builds for significantly improved performance and reliability.

Key Changes:

Release Workflow Redesign: Restructured .github/workflows/release.yaml to use separate jobs with native runners:
- AMD64 builds on ubuntu-latest
- ARM64 builds on ubuntu-24.04-arm
- Creates multi-arch manifests combining both architectures
Multi-Stage Dockerfiles: Updated all Dockerfiles to build binaries inside containers instead of copying pre-built binaries:
- cmd/kelos-spawner/Dockerfile - converted to multi-stage build
- cmd/ghproxy/Dockerfile - converted to multi-stage build
- Other cmd Dockerfiles already used multi-stage builds ✓
Shared Base Image: Refactored agent images to properly use the shared agent-base image:
- codex/Dockerfile - now uses agent-base instead of duplicating Ubuntu setup
- gemini/Dockerfile - simplified to use shared base
- opencode/Dockerfile - simplified to use shared base
- cursor/Dockerfile - simplified to use shared base
- claude-code/Dockerfile already used shared base ✓
Build Pipeline:
- Parallel native builds (no QEMU emulation)
- Proper dependency ordering: agent-base → agent-images
- GitHub Actions caching per architecture
- Multi-arch manifest creation for unified image tags

Performance Benefits:

~10x faster ARM64 builds (native vs QEMU emulation)
Parallel architecture builds instead of sequential
Reduced image duplication through proper base image sharing

Which issue(s) this PR is related to:

N/A

Special notes for your reviewer:

Runner Dependency: Requires ubuntu-24.04-arm runners to be available in the GitHub organization
Registry: All images push to ghcr.io/kelos-dev
Build Order: Agent images now correctly depend on agent-base being built first

The new pipeline creates architecture-specific tags (-amd64, -arm64) then combines them into multi-arch manifests for the main tags.

Does this PR introduce a user-facing change?

feat: introduces amd and arm container images

cubic-dev-ai

4 issues found across 9 files

Prompt for AI agents (unresolved issues)


Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="cursor/Dockerfile">

<violation number="1" location="cursor/Dockerfile:1">
P2: Builder toolchain is decoupled from `GO_VERSION` and uses a floating Go tag, reducing build reproducibility and risking version drift.</violation>
</file>

<file name="cmd/kelos-spawner/Dockerfile">

<violation number="1" location="cmd/kelos-spawner/Dockerfile:1">
P2: New builder base image uses a floating tag (`golang:1.25`), which can cause non-reproducible builds and external version drift.</violation>
</file>

<file name="gemini/Dockerfile">

<violation number="1" location="gemini/Dockerfile:1">
P2: Builder stage uses a floating Go image tag, making release artifacts non-reproducible across rebuilds.</violation>
</file>

<file name="claude-code/Dockerfile">

<violation number="1" location="claude-code/Dockerfile:1">
P2: New builder stage uses an unpinned `golang` image tag, making shipped binary builds non-deterministic and vulnerable to upstream image drift.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

cursor/Dockerfile

cmd/kelos-spawner/Dockerfile

gemini/Dockerfile

claude-code/Dockerfile

cubic-dev-ai

1 issue found across 5 files (changes from recent commits).

Prompt for AI agents (unresolved issues)


Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="cmd/kelos-token-refresher/Dockerfile">

<violation number="1" location="cmd/kelos-token-refresher/Dockerfile:10">
P2: The Dockerfile now builds `kelos-token-refresher` twice: once via `go build` and again via `make build`, which overwrites the same output. This makes the new build step redundant and risks different build flags being used in the final binary.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

cmd/kelos-token-refresher/Dockerfile

CLAassistant · 2026-03-26T16:55:50Z

All committers have signed the CLA.

…amd to run kelos

cubic-dev-ai

7 issues found across 8 files (changes from recent commits).

Prompt for AI agents (unresolved issues)


Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="gemini/Dockerfile">

<violation number="1" location="gemini/Dockerfile:1">
P2: Defaulting the base image to `agent-base:latest` makes builds non-reproducible and can silently pull upstream changes; consider pinning to a specific version or digest.</violation>
</file>

<file name="opencode/Dockerfile">

<violation number="1" location="opencode/Dockerfile:1">
P2: Base image is pinned to a mutable `latest` tag, making builds non-reproducible and allowing silent upstream drift.</violation>
</file>

<file name="codex/Dockerfile">

<violation number="1" location="codex/Dockerfile:1">
P2: Base image uses mutable `latest` tag, making builds non-reproducible and allowing upstream changes without review.</violation>

<violation number="2" location="codex/Dockerfile:2">
P2: Removal of the `kelos-capture` binary copy likely breaks the entrypoint contract: `/kelos/kelos-capture` is still invoked by the entrypoint and documented as required, but this Dockerfile no longer ensures it exists in the image.</violation>
</file>

<file name="cursor/Dockerfile">

<violation number="1" location="cursor/Dockerfile:1">
P2: Base image is unpinned (`latest`), making builds non-reproducible and increasing supply-chain drift risk. Pin the base image to a specific version or digest.</violation>

<violation number="2" location="cursor/Dockerfile:2">
P2: cursor image no longer installs /kelos/kelos-capture, but the entrypoint still calls it, so the container will fail if the base image doesn’t provide that binary.</violation>
</file>

<file name=".github/workflows/release.yaml">

<violation number="1" location=".github/workflows/release.yaml:9">
P2: Per-ref concurrency allows tag release workflows to run in parallel, but the workflow still updates shared `latest` tags. Two tag releases close together can race and overwrite `latest` nondeterministically. Consider restoring a shared concurrency group for tag releases or otherwise serializing `push-latest`.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

cubic-dev-ai · 2026-03-30T09:27:57Z

gemini/Dockerfile

-    && rm "/tmp/${TARBALL}" "/tmp/${TARBALL}.sha256"
-
-ENV PATH="/usr/local/go/bin:${PATH}"
+ARG BASE_IMAGE=agent-base:latest


P2: Defaulting the base image to agent-base:latest makes builds non-reproducible and can silently pull upstream changes; consider pinning to a specific version or digest.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At gemini/Dockerfile, line 1: <comment>Defaulting the base image to `agent-base:latest` makes builds non-reproducible and can silently pull upstream changes; consider pinning to a specific version or digest.</comment> <file context> @@ -1,40 +1,12 @@ - && rm "/tmp/${TARBALL}" "/tmp/${TARBALL}.sha256" - -ENV PATH="/usr/local/go/bin:${PATH}" +ARG BASE_IMAGE=agent-base:latest +FROM ${BASE_IMAGE} </file context>

cubic-dev-ai · 2026-03-30T09:27:57Z

opencode/Dockerfile

-    && rm "/tmp/${TARBALL}" "/tmp/${TARBALL}.sha256"
-
-ENV PATH="/usr/local/go/bin:${PATH}"
+ARG BASE_IMAGE=agent-base:latest


P2: Base image is pinned to a mutable latest tag, making builds non-reproducible and allowing silent upstream drift.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At opencode/Dockerfile, line 1: <comment>Base image is pinned to a mutable `latest` tag, making builds non-reproducible and allowing silent upstream drift.</comment> <file context> @@ -1,40 +1,12 @@ - && rm "/tmp/${TARBALL}" "/tmp/${TARBALL}.sha256" - -ENV PATH="/usr/local/go/bin:${PATH}" +ARG BASE_IMAGE=agent-base:latest +FROM ${BASE_IMAGE} </file context>

cubic-dev-ai · 2026-03-30T09:27:57Z

codex/Dockerfile

-    && rm "/tmp/${TARBALL}" "/tmp/${TARBALL}.sha256"
-
-ENV PATH="/usr/local/go/bin:${PATH}"
+ARG BASE_IMAGE=agent-base:latest


P2: Base image uses mutable latest tag, making builds non-reproducible and allowing upstream changes without review.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At codex/Dockerfile, line 1: <comment>Base image uses mutable `latest` tag, making builds non-reproducible and allowing upstream changes without review.</comment> <file context> @@ -1,40 +1,12 @@ - && rm "/tmp/${TARBALL}" "/tmp/${TARBALL}.sha256" - -ENV PATH="/usr/local/go/bin:${PATH}" +ARG BASE_IMAGE=agent-base:latest +FROM ${BASE_IMAGE} </file context>

cubic-dev-ai · 2026-03-30T09:27:57Z

codex/Dockerfile

-
-ENV PATH="/usr/local/go/bin:${PATH}"
+ARG BASE_IMAGE=agent-base:latest
+FROM ${BASE_IMAGE}


P2: Removal of the kelos-capture binary copy likely breaks the entrypoint contract: /kelos/kelos-capture is still invoked by the entrypoint and documented as required, but this Dockerfile no longer ensures it exists in the image.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At codex/Dockerfile, line 2: <comment>Removal of the `kelos-capture` binary copy likely breaks the entrypoint contract: `/kelos/kelos-capture` is still invoked by the entrypoint and documented as required, but this Dockerfile no longer ensures it exists in the image.</comment> <file context> @@ -1,40 +1,12 @@ - -ENV PATH="/usr/local/go/bin:${PATH}" +ARG BASE_IMAGE=agent-base:latest +FROM ${BASE_IMAGE} ARG CODEX_VERSION=0.117.0 </file context>

cubic-dev-ai · 2026-03-30T09:27:57Z

cursor/Dockerfile

-
-ENV PATH="/usr/local/go/bin:${PATH}"
+ARG BASE_IMAGE=agent-base:latest
+FROM ${BASE_IMAGE}


P2: cursor image no longer installs /kelos/kelos-capture, but the entrypoint still calls it, so the container will fail if the base image doesn’t provide that binary.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At cursor/Dockerfile, line 2: <comment>cursor image no longer installs /kelos/kelos-capture, but the entrypoint still calls it, so the container will fail if the base image doesn’t provide that binary.</comment> <file context> @@ -1,37 +1,9 @@ - -ENV PATH="/usr/local/go/bin:${PATH}" +ARG BASE_IMAGE=agent-base:latest +FROM ${BASE_IMAGE} COPY cursor/kelos_entrypoint.sh /kelos_entrypoint.sh </file context>

cubic-dev-ai · 2026-03-30T09:27:57Z

cursor/Dockerfile

-    && rm "/tmp/${TARBALL}" "/tmp/${TARBALL}.sha256"
-
-ENV PATH="/usr/local/go/bin:${PATH}"
+ARG BASE_IMAGE=agent-base:latest


P2: Base image is unpinned (latest), making builds non-reproducible and increasing supply-chain drift risk. Pin the base image to a specific version or digest.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At cursor/Dockerfile, line 1: <comment>Base image is unpinned (`latest`), making builds non-reproducible and increasing supply-chain drift risk. Pin the base image to a specific version or digest.</comment> <file context> @@ -1,37 +1,9 @@ - && rm "/tmp/${TARBALL}" "/tmp/${TARBALL}.sha256" - -ENV PATH="/usr/local/go/bin:${PATH}" +ARG BASE_IMAGE=agent-base:latest +FROM ${BASE_IMAGE} </file context>

cubic-dev-ai · 2026-03-30T09:27:57Z

.github/workflows/release.yaml


 concurrency:
-  group: release
+  group: release-${{ github.ref }}


P2: Per-ref concurrency allows tag release workflows to run in parallel, but the workflow still updates shared latest tags. Two tag releases close together can race and overwrite latest nondeterministically. Consider restoring a shared concurrency group for tag releases or otherwise serializing push-latest.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/release.yaml, line 9: <comment>Per-ref concurrency allows tag release workflows to run in parallel, but the workflow still updates shared `latest` tags. Two tag releases close together can race and overwrite `latest` nondeterministically. Consider restoring a shared concurrency group for tag releases or otherwise serializing `push-latest`.</comment> <file context> @@ -6,23 +6,44 @@ on: concurrency: - group: release + group: release-${{ github.ref }} cancel-in-progress: false </file context>

Suggested change

group: release-${{ github.ref }}

group: release

cubic-dev-ai bot reviewed Mar 24, 2026

View reviewed changes

cursor/Dockerfile Outdated Show resolved Hide resolved

cmd/kelos-spawner/Dockerfile Show resolved Hide resolved

gemini/Dockerfile Outdated Show resolved Hide resolved

claude-code/Dockerfile Outdated Show resolved Hide resolved

github-actions bot added needs-triage needs-kind Indicates an issue or PR lacks a kind/* label needs-priority needs-actor release-note labels Mar 26, 2026

cubic-dev-ai bot reviewed Mar 26, 2026

View reviewed changes

cmd/kelos-token-refresher/Dockerfile Outdated Show resolved Hide resolved

gjkim42 mentioned this pull request Mar 29, 2026

Add multi-architecture support for Docker images and workflows #841

Open

gjkim42 self-requested a review March 29, 2026 12:56

knechtionscoding force-pushed the feat/multi-arch-images-upstream branch from 9ba75ee to c9adc5e Compare March 30, 2026 09:14

knechtionscoding closed this Mar 30, 2026

knechtionscoding force-pushed the feat/multi-arch-images-upstream branch from c9adc5e to a8a012c Compare March 30, 2026 09:15

feat(containers): add multi-arch support for images allowing arm and …

1623086

…amd to run kelos

knechtionscoding reopened this Mar 30, 2026

cubic-dev-ai bot reviewed Mar 30, 2026

View reviewed changes

Conversation

knechtionscoding commented Mar 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What type of PR is this?

What this PR does / why we need it:

Which issue(s) this PR is related to:

Special notes for your reviewer:

Does this PR introduce a user-facing change?

Uh oh!

cubic-dev-ai bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cubic-dev-ai bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

CLAassistant commented Mar 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cubic-dev-ai bot left a comment

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai bot Mar 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai bot Mar 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai bot Mar 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai bot Mar 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai bot Mar 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai bot Mar 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai bot Mar 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

knechtionscoding commented Mar 24, 2026 •

edited

Loading

CLAassistant commented Mar 26, 2026 •

edited

Loading

cubic-dev-ai bot Mar 30, 2026 •

edited

Loading

cubic-dev-ai bot Mar 30, 2026 •

edited

Loading

cubic-dev-ai bot Mar 30, 2026 •

edited

Loading

cubic-dev-ai bot Mar 30, 2026 •

edited

Loading

cubic-dev-ai bot Mar 30, 2026 •

edited

Loading

cubic-dev-ai bot Mar 30, 2026 •

edited

Loading

cubic-dev-ai bot Mar 30, 2026 •

edited

Loading