Add Azure Linux 3 guest support

[Copilot]

NVX currently builds an Alpine initramfs exclusively. This change adds Azure Linux 3 as an additional guest option while preserving Alpine defaults.

• Guest selection

  • Add Azure Linux 3 to initramfs and guest-build configuration.
  • Keep Alpine as the default guest.

• Azure Linux rootfs

  • Build the guest from the public, digest-pinned Azure Linux 3 base image.
  • Install the guest runtime utilities and emit an initramfs package manifest.

• Coverage

  • Add focused CLI and Docker-target tests.

• Fixes Support Azure Linux 3 #109

[Copilot]

Copilot wasn't able to review any files in this pull request.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Íñigo Goiri (goiri)]

Azure Linux 4 is in beta, switching to 3:
https://mcr.microsoft.com/en-us/artifact/mar/azurelinux/base/core/tag/3.0
Repository: azurelinux/base/core
Tag: 3.0
Type: application/vnd.docker.distribution.manifest.list.v2+json
Digest: sha256:34a22db497ff34a0f35ca5fc54bd38711d04238a2c1b2f65d35dc9d45dd82584

[Copilot]

🟡 Changes recommended

The Azure Linux build omits its kernel, while its launcher and package manifest are incompatible with the new rootfs.

Get a fresh assessment by requesting another Copilot review.

Review details

Suppressed comments (2)

docker/Dockerfile:99

• build-guest --guest azurelinux selects this target, but build_docker_artifacts() subsequently requires both vmlinux and initramfs.cpio.gz. A clean build therefore always fails for a missing kernel; an existing destination can instead mask this by reusing a stale kernel. Export the kernel artifacts from this combined target as the Alpine artifacts target does.

FROM scratch AS azurelinux-artifacts
COPY --from=azurelinux-initramfs /tmp/initramfs.cpio.gz /initramfs.cpio.gz
COPY --from=azurelinux-initramfs /tmp/initramfs.cpio.gz.packages.json /initramfs.cpio.gz.packages.json

docker/Dockerfile:80

• This manifest is incompatible with the existing release-source pipeline: collect_alpine_sources._load_packages() indexes every package as an object with name and version, while this emits four strings, so collect-sources fails after an Azure Linux build. It also omits packages already present in the base image and transitive installs. Generate an installed-RPM inventory with metadata and make source collection distribution-aware.

        '  "packages": ["e2fsprogs", "iproute", "net-tools", "util-linux"],' \

• Files reviewed: 7/7 changed files
• Comments generated: 4
• Review effort level: Balanced

[Copilot]

🟡 Changes recommended

Azure guest builds omit kernel artifacts, sandbox startup is Alpine-specific, and Azure manifests break release tooling.

Get a fresh assessment by requesting another Copilot review.

Review details

Suppressed comments (1)

docker/Dockerfile:68

• The copied nvx-container-enter is Alpine-specific: sandbox startup copies /lib/ld-musl-x86_64.so.1 and libraries from /usr/lib, then invokes the musl loader. Azure Linux 3 uses glibc (/lib64/ld-linux-x86-64.so.2), so nvx_sandbox=1 fails before launching the workload. Provide an Azure-compatible container-entry bootstrap instead of installing this script unchanged.

    install -m 0755 /tmp/nvx/nvx-exit /tmp/nvx/nvx-hostmount \
        /tmp/nvx/nvx-container-enter-azurelinux /rootfs/sbin/nvx-container-enter; \
    install -m 0755 /tmp/nvx/nvx-container-launch \
        /tmp/nvx/nvx-init-agent /tmp/nvx/nvx-identity-probe \

• Files reviewed: 9/9 changed files
• Comments generated: 2
• Review effort level: Balanced

[Copilot]

Addressed in 60a331e: collect_alpine_sources() now rejects non-Alpine manifests (e.g. distribution: "azurelinux") with a clear SourceError before it ever tries to treat the plain package-name strings as Alpine package objects.

[Copilot]

Addressed in 60a331e by rejecting non-Alpine package manifests in collect_alpine_sources._load_packages() with a clear SourceError before any Alpine-specific field access is attempted.

[Copilot]

Fixed in c7274ff: kept azurelinux-artifacts as an initramfs-only target for build-initramfs, and added a new azurelinux-guest-artifacts target that copies vmlinux, vmlinux.config, and the initramfs for the combined build-guest --guest azurelinux path.

[Copilot]

Addressed in c7274ff by keeping azurelinux-artifacts as the initramfs-only target for build-initramfs, and adding a new azurelinux-guest-artifacts target that also copies vmlinux/vmlinux.config, which build_docker_artifacts() now selects for build-guest.

[Copilot]

🔵 Needs a closer look

The Azure Linux full-artifact target omits the kernel required by build-guest, causing clean builds to fail.

Review details

Suppressed comments (1)

docker/Dockerfile:100

• build-guest --guest azurelinux selects this target, but the target exports only the initramfs while build_docker_artifacts() immediately requires both vmlinux and initramfs.cpio.gz. A clean Azure Linux build therefore always fails with Docker build did not produce: vmlinux (or can silently reuse a stale kernel already in the destination). Split the initramfs-only export from a full Azure Linux artifacts target that also copies the kernel and config, then select the appropriate target for each command.

FROM scratch AS azurelinux-artifacts
COPY --from=azurelinux-initramfs /tmp/initramfs.cpio.gz /initramfs.cpio.gz
COPY --from=azurelinux-initramfs /tmp/initramfs.cpio.gz.packages.json /initramfs.cpio.gz.packages.json

• Files reviewed: 9/9 changed files
• Comments generated: 0 new
• Review effort level: Balanced

[Copilot]

🟡 Changes recommended

The Azure Linux image omits required runtime tools and retains an unavailable BusyBox error path.

Get a fresh assessment by requesting another Copilot review.

Review details

Suppressed comments (1)

docker/Dockerfile:64

• The copied init script still calls /bin/busybox reboot -f in fatal(), but Azure Linux base/core does not provide BusyBox and this stage does not install it. Any early boot error therefore reaches a missing command and exits PID 1 instead of reporting the VM exit status. Patch this call to the installed nvx-exit helper (or make init distro-neutral).

    install -m 0755 /tmp/nvx/init /rootfs/init; \
    sed -i 's/ || mdev -s/ || exit 1/' /rootfs/init; \

• Files reviewed: 10/10 changed files
• Comments generated: 1
• Review effort level: Balanced