feat: migrate kubezero to containerd incl. nvidia runtime

2024-11-08 19:37:30 +00:00 · 2024-11-08 19:37:30 +00:00 · a2e9df177b
commit a2e9df177b
parent cd3e76dca8
46 changed files with 323 additions and 20541 deletions
--- a/2
+++ b/2
@ -34,7 +34,7 @@ aports:
 	mkdir -p aports && cd aports
 	[ -d .git ] && git pull
 	[ -d .git ] || git clone https://gitlab.alpinelinux.org/alpine/aports.git .
-	git checkout origin/$(ALPINE_MAJOR)-stable
+	git checkout $(ALPINE_MAJOR)-stable

 apk: packages distfiles
 	podman run -it --rm --platform linux/$(_ARCH) \
--- a/kubezero/containerd/APKBUILD
+++ b/kubezero/containerd/APKBUILD
@ -0,0 +1,133 @@
+# Contributor: Jake Buchholz Göktürk <tomalok@gmail.com>
+# Maintainer: Jake Buchholz Göktürk <tomalok@gmail.com>
+
+pkgname=containerd
+
+# NOTE: containerd's Makefile tries to get REVISION from git, but we're building from a tarball.
+_commit=57f17b0a6295a39009d861b89e3b3b87b005ca27
+pkgver=1.7.23
+pkgrel=1337
+pkgdesc="An open and reliable container runtime"
+url="https://containerd.io/"
+arch="all"
+license="Apache-2.0"
+depends="runc"
+makedepends="btrfs-progs-dev go go-md2man libseccomp-dev log_proxy"
+subpackages="
+	$pkgname-ctr
+	$pkgname-doc
+	$pkgname-stress
+	$pkgname-openrc
+"
+source="containerd-$pkgver.tar.gz::https://github.com/containerd/containerd/archive/v$pkgver.tar.gz
+	containerd.confd
+	containerd.initd
+	config.toml
+"
+options="net"
+
+# secfixes:
+#   1.6.18-r0:
+#     - CVE-2023-25153
+#     - CVE-2023-25173
+#   1.6.12-r0:
+#     - CVE-2022-23471
+#   1.6.6-r0:
+#     - CVE-2022-31030
+#   1.6.2-r0:
+#     - CVE-2022-24769
+#   1.6.1-r0:
+#     - CVE-2022-23648
+#   1.5.9-r0:
+#     - CVE-2021-43816
+#   1.5.8-r0:
+#     - CVE-2021-41190
+#   1.5.7-r0:
+#     - CVE-2021-41103
+#   1.5.4-r0:
+#     - CVE-2021-32760
+#   1.4.4-r0:
+#     - CVE-2021-21334
+#   1.4.3-r0:
+#     - CVE-2020-15257
+#   1.3.3-r0:
+#     - CVE-2019-19921
+#     - CVE-2020-0601
+#     - CVE-2020-7919
+#     - CVE-2019-11253
+#   1.3.1-r0:
+#     - CVE-2019-17596
+#   1.3.0-r0:
+#     - CVE-2019-16884
+#   1.2.9-r0:
+#     - CVE-2019-9512
+#     - CVE-2019-9514
+#     - CVE-2019-9515
+#   1.2.6-r0:
+#     - CVE-2019-9946
+
+export GOFLAGS="$GOFLAGS -modcacherw -mod=readonly"
+export GOCACHE="${GOCACHE:-"$srcdir/go-cache"}"
+export GOTMPDIR="${GOTMPDIR:-"$srcdir"}"
+export GOMODCACHE="${GOMODCACHE:-"$srcdir/go"}"
+
+build() {
+	export GO111MODULE=on
+	case "$CARCH" in loongarch64)
+		# upgrade ebpf for loongarch64
+		go get -u github.com/cilium/ebpf@v0.11.0
+		;;
+	esac
+
+	go mod tidy
+
+	make SHIM_CGO_ENABLED=1 VERSION="v$pkgver" REVISION="$_commit" BUILDMODE=pie
+	make man
+}
+
+check() {
+	./bin/containerd --version
+}
+
+package() {
+	install -d "$pkgdir"/usr/bin/
+	install -Dsm755 ./bin/* "$pkgdir"/usr/bin/
+	# useless binary only to make manpages
+	rm "$pkgdir"/usr/bin/gen-manpages
+
+	install -Dm755 "$srcdir"/$pkgname.initd \
+		"$pkgdir"/etc/init.d/$pkgname
+	install -Dm644 "$srcdir"/$pkgname.confd \
+		"$pkgdir"/etc/conf.d/$pkgname
+
+	install -d "$pkgdir"/usr/share/man/man5/
+	install -Dm644 "$builddir"/man/*.5 "$pkgdir"/usr/share/man/man5/
+	install -d "$pkgdir"/usr/share/man/man8/
+	install -Dm644 "$builddir"/man/*.8 "$pkgdir"/usr/share/man/man8/
+
+	install -d "$pkgdir"/etc/containerd/conf.d
+	install -Dm644 "$srcdir"/config.toml "$pkgdir"/etc/containerd/config.toml
+}
+
+openrc() {
+	default_openrc
+	depends="log_proxy"
+	install_if="openrc $pkgname=$pkgver-r$pkgrel"
+}
+
+ctr() {
+	pkgdesc="unsupported debug/admin client for containerd"
+	amove usr/bin/ctr
+}
+
+stress() {
+	pkgdesc="containerd-stress utility"
+	amove usr/bin/containerd-stress
+}
+
+sha512sums="
+4cb003a6ef2f9fe856665c3b7099e13b23cf07c77ed9a9ed50988d74de1933e3fe9463ae123635230f25cde38cd8a487133b11e20d829a79517c4d7fbe2ce012  containerd-1.7.23.tar.gz
+5fb37b88554422738cc75b944b75836c123d87d418a16c6a25b9d49da023bd0e654d1aa694e60026de42c055ccf7469f5b4778a4876e94720ec2f40d618db580  containerd.confd
+8315a8d58b4ba7e19ebed2cd82c7b5eaab45da630f9818a9e6cc8f3c8e88f159432474299798f79e6e465e843c91c0f50df04030083c8913c385ea1d73e81e6a  containerd.initd
+dfb92fffeac35310956da6c6ad5f8c43eba3a5355ecbfabeec0f9c7445a08e309312b56b6855a17a471fd6012cc099d6abb39dc8bd26279112d0fe936624023d  config.toml
+"
--- a/kubezero/containerd/config.toml
+++ b/kubezero/containerd/config.toml
@ -0,0 +1,8 @@
+version = 2
+
+imports = ["/etc/containerd/conf.d/*.toml"]
+
+[plugins]
+  [plugins."io.containerd.grpc.v1.cri"]
+    [plugins."io.containerd.grpc.v1.cri".cni]
+      bin_dir = "/usr/libexec/cni"
--- a/kubezero/containerd/containerd.confd
+++ b/kubezero/containerd/containerd.confd
@ -0,0 +1,47 @@
+# config file for /etc/init.d/containerd
+
+# overrides the main command executed by the supervise daemon
+#containerd_command="/usr/bin/containerd"
+
+# any other options you want to pass to containerd_command
+#containerd_opts=""
+
+# Settings for process limits (ulimit)
+#ulimit_opts="-c unlimited -n 1048576 -u unlimited"
+
+# seconds to wait for sending SIGTERM and SIGKILL signals when stopping containerd
+#signal_retry="TERM/60/KILL/10"
+
+# where containerd stdout (and perhaps stderr) goes.
+#log_file="/var/log/containerd.log"
+
+# where containerd stderr optionally goes.
+# if this is not set, the value in 'logfile' is used
+#err_file="/var/log/containerd-err.log"
+
+# mode of the log files
+#log_mode=0644
+
+# user:group that owns the log files
+#log_owner=root:root
+
+# to override the default supervise_daemon_args
+#supervise_daemon_args=""
+
+# log directory (defaults to current directory)
+#LOGPROXY_LOG_DIRECTORY=/var/log
+
+# rotate when log exceeds size (bytes, 0 = no max)
+#LOGPROXY_ROTATION_SIZE=104857600
+
+# rotate log after time elapses (seconds, 0 = no max)
+#LOGPROXY_ROTATION_TIME=86400
+
+# rotated file suffix (strftime based)
+#LOGPROXY_ROTATION_SUFFIX=".%Y%m%d%H%M%S"
+
+# rotated logs to keep (0 = keep all)
+#LOGPROXY_ROTATED_FILES=5
+
+# additional log_proxy options
+#LOGPROXY_OPTS=
--- a/kubezero/containerd/containerd.initd
+++ b/kubezero/containerd/containerd.initd
@ -0,0 +1,46 @@
+#!/sbin/openrc-run
+supervisor=supervise-daemon
+
+name="Container Daemon"
+description="Standalone containerd (usually started by Docker)"
+
+extra_started_commands="reload"
+description_reload="Reload configuration without exiting"
+
+command="${containerd_command:-/usr/bin/containerd}"
+command_args="${containerd_opts}"
+rc_ulimit="${ulimit_opts:--c unlimited -n 1048576 -u unlimited}"
+retry="${signal_retry:-TERM/60/KILL/10}"
+
+log_file="${log_file:-/var/log/${RC_SVCNAME}.log}"
+err_file="${err_file:-${log_file}}"
+log_mode="${log_mode:-0644}"
+log_owner="${log_owner:-root:root}"
+
+if [ "$log_file" = "$err_file" ]; then
+	LOGPROXY_OPTS="$LOGPROXY_OPTS -m"
+fi
+export \
+	LOGPROXY_CHMOD="$log_mode" \
+	LOGPROXY_LOG_DIRECTORY="${LOGPROXY_LOG_DIRECTORY:-/var/log}" \
+	LOGPROXY_ROTATION_SIZE="${LOGPROXY_ROTATION_SIZE:-104857600}" \
+	LOGPROXY_ROTATION_TIME="${LOGPROXY_ROTATION_TIME:-86400}" \
+	LOGPROXY_ROTATION_SUFFIX="${LOGPROXY_ROTATION_SUFFIX:-.%Y%m%d%H%M%S}" \
+	LOGPROXY_ROTATED_FILES="${LOGPROXY_ROTATE_FILES:-5}"
+
+output_logger="log_proxy $LOGPROXY_OPTS $log_file"
+error_logger="log_proxy $LOGPROXY_OPTS $err_file"
+
+depend() {
+	need sysfs cgroups
+}
+
+start_pre() {
+	checkpath -f -m "$log_mode" -o "$log_owner" "$log_file" "$err_file"
+}
+
+reload() {
+	ebegin "Reloading configuration"
+	$supervisor $RC_SVCNAME --signal HUP
+	eend $?
+}
--- a/kubezero/cri-o/APKBUILD
+++ b/kubezero/cri-o/APKBUILD
@ -1,116 +0,0 @@
-# Contributor: ungleich <foss@ungleich.ch>
-# Contributor: Francesco Colista <fcolista@alpinelinux.org>
-# Contributor: TBK <alpine@jjtc.eu>
-# Maintainer: ungleich <foss@ungleich.ch>
-pkgname=cri-o
-pkgver=1.30.6
-pkgrel=0
-pkgdesc="OCI-based implementation of Kubernetes Container Runtime Interface"
-url="https://github.com/cri-o/cri-o/"
-arch="all"
-license="Apache-2.0"
-# Most tests will fail if not ran as root
-# since it tries to create network interfaces
-options="net chmod-clean !check"
-depends="
-	cni-plugins
-	conmon
-	conntrack-tools
-	containers-common
-	iproute2
-	iptables
-	oci-runtime
-	"
-makedepends="
-	bash
-	btrfs-progs-dev
-	eudev-dev
-	glib-dev
-	go
-	go-md2man
-	gpgme-dev
-	libseccomp-dev
-	libselinux-dev
-	lvm2-dev
-	ostree-dev
-	sqlite-dev
-	tzdata
-	"
-checkdepends="bats cri-tools jq parallel sudo conmon"
-subpackages="
-	$pkgname-doc
-	$pkgname-bash-completion
-	$pkgname-zsh-completion
-	$pkgname-fish-completion
-	$pkgname-openrc
-	"
-	#$pkgname-fish-completion
-
-source="
-	$pkgname-$pkgver.tar.gz::https://github.com/cri-o/cri-o/archive/v$pkgver/cri-o-$pkgver.tar.gz
-	crio.conf
-	crio.initd
-	crio.logrotated
-	cni-plugins-path.patch
-	makefile-fix-install.patch
-	fix-test.patch
-	remove-systemd-files.patch
-	crictl.yaml
-	"
-
-# secfixes:
-#   1.23.2-r0:
-#     - CVE-2022-0811
-#   1.24.1-r0:
-#     - CVE-2022-1708
-#   1.26.2-r0:
-#     - CVE-2022-4318
-
-export GOCACHE="${GOCACHE:-"$srcdir/go-cache"}"
-export GOTMPDIR="${GOTMPDIR:-"$srcdir"}"
-export GOMODCACHE="${GOMODCACHE:-"$srcdir/go"}"
-export GOBIN="$GOPATH/bin"
-
-build() {
-	# https://github.com/cri-o/cri-o/blob/master/install.md#build-tags
-	make BUILDTAGS="libsqlite3 seccomp selinux apparmor containers_image_openpgp containers_image_ostree_stub"
-}
-
-check() {
-	make localintegration
-}
-
-package() {
-	make \
-		DESTDIR="$pkgdir" \
-		PREFIX=/usr \
-		CRICTL_CONFIG_DIR="/etc/crio" \
-		OCIUMOUNTINSTALLDIR="/etc/crio" \
-		FISHINSTALLDIR=/usr/share/fish/vendor_completions.d \
-		install.bin-nobuild install.man-nobuild install.completions install.config-nobuild
-
-	# We want it in etc so apk does not overwrite it
-	mkdir -p  "$pkgdir"/usr/share/oci-umount/oci-umount.d/
-	ln -sf ../../../../etc/crio/crio-umount.conf "$pkgdir"/usr/share/oci-umount/oci-umount.d/crio-umount.conf
-
-	# The CNI plugins are recommended to be installed as examples
-	install -Dm644 contrib/cni/*.conflist -t "$pkgdir"/usr/share/doc/cri-o/examples/cni/
-
-	install -Dm755 "$srcdir"/crio.initd "$pkgdir"/etc/init.d/crio
-	install -Dm644 "$srcdir"/crio.conf "$pkgdir"/etc/crio/crio.conf
-	install -Dm644 "$srcdir"/crio.logrotated "$pkgdir"/etc/logrotate.d/crio
-
-	install -Dm644 "$srcdir"/crictl.yaml "$pkgdir"/etc/crictl.yaml
-}
-
-sha512sums="
-3e8e3422a0fac9b603775a9b05626134b0e8b37425ddbbf39e155283ecdc7ac50184bb578179bc25585711286320034251318c599039d3b539d0f4d7f334c341  cri-o-1.30.6.tar.gz
-469eddef2e7b24f3ac7b192da3851ada7332f8f93cd4503d8c4d62cc39f669d7893e69c654bc2d86e3d89919fa6da765a393576bcdeb94f1a024bec4fa5cbe2f  crio.conf
-e9149cc2ddd24328c5290d3aea895c01e2798e066897535384f615a556496acdd52a603a0f4ac3c4c70bd5c363592f23c8b4d1987bf738300112fc62e1def555  crio.initd
-1115228546a696eeebeb6d4b3e5c3152af0c99a2559097fc5829d8b416d979c457b4b1789e0120054babf57f585d3f63cbe49949d40417ae7aab613184bf4516  crio.logrotated
-0a567dfa431ab1e53f2a351689be8d588a60cc5fcdbda403ec4f8b6ab9b1c18ad425f6c47f9a5ab1491e3a61a269dc4efa6a59e91e7521fa2b6bb165074aa8e0  cni-plugins-path.patch
-09025bff1fed5004a15696cbc7c63260ae7c206ffe2c8506e6063e8889b7aa98bd5c7df2f0c109860d8432ddf5f3b6326dbfd46589d05cf87f26c38e4bdadb9c  makefile-fix-install.patch
-b0fdaf2280968a69e05ef72288bbf6fc03787616c6b6fca1e4398f9849167f4773e5e6e72bf1738d1fff2a84e97aa00f23aabcd50898ba8ed130969f50363006  fix-test.patch
-ae7e4a43f18076f19f3ae37d7302bfdf7a3befadf33e46bc9b1b14d50b605e8ba0d06d479568c24e8bf68f17c80ae48798068b2a46c3bcab565a5d225779f30e  remove-systemd-files.patch
-79e1a7c6183ba56f55d923e9d738be945564494042bc011d31e9195f66c268d702ee5c86711d4b46618285fc1b10b59ea55c321390feca770cfc7de334e103bd  crictl.yaml
-"
--- a/kubezero/cri-o/cni-plugins-path.patch
+++ b/kubezero/cri-o/cni-plugins-path.patch
@ -1,23 +0,0 @@
-Alpine's cni-plugins are installs at /usr/libexec/cni/
-
--- a/docs/crio.conf.5.md
-+++ b/docs/crio.conf.5.md
-@@ -301,7 +301,7 @@
- **network_dir**="/etc/cni/net.d/"
-   Path to the directory where CNI configuration files are located.
- 
-**plugin_dirs**=["/opt/cni/bin/",]
-+**plugin_dirs**=["/usr/libexec/cni/",]
-   List of paths to directories where CNI plugin binaries are located.
- 
- ## CRIO.METRICS TABLE
--- a/pkg/config/config_unix.go
-+++ b/pkg/config/config_unix.go
-@@ -5,7 +5,7 @@
- // Defaults for linux/unix if none are specified
- const (
- 	cniConfigDir             = "/etc/cni/net.d/"
-	cniBinDir                = "/opt/cni/bin/"
-+	cniBinDir                = "/usr/libexec/cni/"
- 	containerExitsDir        = "/var/run/crio/exits"
- 	ContainerAttachSocketDir = "/var/run/crio"
--- a/kubezero/cri-o/crictl.yaml
+++ b/kubezero/cri-o/crictl.yaml
@ -1,5 +0,0 @@
-# runtime entpoint, see https://github.com/kubernetes/enhancements/issues/2371 might be fixed with 1.29 ?
-runtime-endpoint: unix:///run/crio/crio.sock
-image-endpoint: unix:///var/run/crio/crio.sock
-timeout: 60
-debug: false 
--- a/kubezero/cri-o/crio.conf
+++ b/kubezero/cri-o/crio.conf
@ -1,10 +0,0 @@
-[crio.runtime]
-cgroup_manager = "cgroupfs"
-default_runtime = "crun"
-
-[crio.runtime.runtimes.crun]
-runtime_path = "/usr/bin/crun"
-runtime_type = "oci"
-runtime_root = "/run/crun"
-monitor_cgroup = "pod"
-monitor_exec_cgroup = "container"
--- a/kubezero/cri-o/crio.initd
+++ b/kubezero/cri-o/crio.initd
@ -1,40 +0,0 @@
-#!/sbin/openrc-run
-# Copyright 2015-2019 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-description="OCI Kubernetes Container Runtime daemon"
-pidfile=${pidfile:-"/run/${RC_SVCNAME}.pid"}
-extra_started_commands="reload"
-command="/usr/bin/${RC_SVCNAME}"
-command_args="${command_args}"
-command_background="true"
-
-# We run all containers with nice level 1
-start_stop_daemon_args="-N 1 \
-	--stdout /var/log/${RC_SVCNAME}/${RC_SVCNAME}.log \
-	--stderr /var/log/${RC_SVCNAME}/${RC_SVCNAME}.log"
-
-depend() {
-	need net
-	use dns
-}
-
-checkconfig() {
-	checkpath --directory --owner root:root --mode 0775 \
-		/var/log/${RC_SVCNAME}
-	checkpath --file --owner root:root --mode 0644 \
-		/var/log/${RC_SVCNAME}/${RC_SVCNAME}.log
-	checkpath --directory --owner root:root --mode 0750 \
-		/var/lib/crio
-}
-
-start() {
-	checkconfig
-	default_start
-}
-
-reload() {
-	ebegin "Reloading ${RC_SVCNAME}"
-	start-stop-daemon --signal HUP --pidfile "${pidfile}"
-	eend $?
-}
--- a/kubezero/cri-o/crio.logrotated
+++ b/kubezero/cri-o/crio.logrotated
@ -1,7 +0,0 @@
-/var/log/crio/crio.log {
-	missingok
-	size 5M
-	rotate 3
-	compress
-	copytruncate
-}
--- a/kubezero/cri-o/fix-test.patch
+++ b/kubezero/cri-o/fix-test.patch
@ -1,72 +0,0 @@
-diff --git a/test/cgroups.bats b/test/cgroups.bats
-index 8beb6f06..80193413 100644
--- a/test/cgroups.bats
-+++ b/test/cgroups.bats
-@@ -45,6 +45,10 @@ EOF
- }
- 
- @test "conmon pod cgroup" {
-+	if [[ "$CONTAINER_CGROUP_MANAGER" != "systemd" ]]; then
-+		skip "need systemd cgroup manager"
-+	fi
-+
- 	CONTAINER_CGROUP_MANAGER="systemd" CONTAINER_DROP_INFRA_CTR=false CONTAINER_CONMON_CGROUP="pod" start_crio
- 
- 	jq '	 .linux.cgroup_parent = "Burstablecriotest123.slice"' \
-@@ -61,6 +65,10 @@ EOF
- 		skip "not yet supported by conmonrs"
- 	fi
- 
-+	if [[ "$CONTAINER_CGROUP_MANAGER" != "systemd" ]]; then
-+		skip "need systemd cgroup manager"
-+	fi
-+
- 	CONTAINER_CGROUP_MANAGER="systemd" CONTAINER_DROP_INFRA_CTR=false CONTAINER_CONMON_CGROUP="customcrioconmon.slice" start_crio
- 
- 	jq '	 .linux.cgroup_parent = "Burstablecriotest123.slice"' \
-@@ -77,6 +85,10 @@ EOF
- 		skip "not supported for conmon"
- 	fi
- 
-+	if [[ "$CONTAINER_CGROUP_MANAGER" != "systemd" ]]; then
-+		skip "need systemd cgroup manager"
-+	fi
-+
- 	configure_monitor_cgroup_for_conmonrs "customcrioconmon.slice"
- 
- 	CONTAINER_CGROUP_MANAGER="systemd" CONTAINER_DROP_INFRA_CTR=true start_crio
-diff --git a/test/cni_plugin_helper.bash b/test/cni_plugin_helper.bash
-index 04492172..abae521e 100755
--- a/test/cni_plugin_helper.bash
-+++ b/test/cni_plugin_helper.bash
-@@ -48,7 +48,7 @@ EOT
- . "$TEST_DIR"/cni_plugin_helper_input.env
- rm -f "$TEST_DIR"/cni_plugin_helper_input.env
- 
-result=$(/opt/cni/bin/bridge "$@") || exit $?
-+result=$(/usr/libexec/cni/bridge "$@") || exit $?
- 
- if [[ "${DEBUG_ARGS}" == "malformed-result" ]]; then
-     cat <<-EOF
-diff --git a/test/common.sh b/test/common.sh
-index f7f8e1f2..45b7dd58 100644
--- a/test/common.sh
-+++ b/test/common.sh
-@@ -41,7 +41,7 @@ # CNI path
- if command -v host-local >/dev/null; then
-     CONTAINER_CNI_PLUGIN_DIR=${CONTAINER_CNI_PLUGIN_DIR:-$(dirname "$(readlink "$(command -v host-local)")")}
- else
-    CONTAINER_CNI_PLUGIN_DIR=${CONTAINER_CNI_PLUGIN_DIR:-/opt/cni/bin}
-+    CONTAINER_CNI_PLUGIN_DIR=${CONTAINER_CNI_PLUGIN_DIR:-/usr/libexec/cni}
- fi
- # Runtime
- CONTAINER_DEFAULT_RUNTIME=${CONTAINER_DEFAULT_RUNTIME:-runc}
-@@ -74,7 +74,7 @@ CHECKCRIU_BINARY=${CHECKCRIU_BINARY:-${CRIO_ROOT}/test/checkcriu/checkcriu}
- # The default log directory where all logs will go unless directly specified by the kubelet
- DEFAULT_LOG_PATH=${DEFAULT_LOG_PATH:-/var/log/crio/pods}
- # Cgroup manager to be used
-CONTAINER_CGROUP_MANAGER=${CONTAINER_CGROUP_MANAGER:-systemd}
-+CONTAINER_CGROUP_MANAGER=${CONTAINER_CGROUP_MANAGER:-cgroupfs}
- # Image volumes handling
- CONTAINER_IMAGE_VOLUMES=${CONTAINER_IMAGE_VOLUMES:-mkdir}
- # Container pids limit
--- a/kubezero/cri-o/makefile-fix-install.patch
+++ b/kubezero/cri-o/makefile-fix-install.patch
@ -1,122 +0,0 @@
--- a/Makefile
-+++ b/Makefile
-@@ -9,11 +9,11 @@
- 
- PROJECT := github.com/cri-o/cri-o
- CRIO_INSTANCE := crio_dev
-PREFIX ?= ${DESTDIR}/usr/local
-+PREFIX ?= /usr/local
- BINDIR ?= ${PREFIX}/bin
- LIBEXECDIR ?= ${PREFIX}/libexec
- MANDIR ?= ${PREFIX}/share/man
-ETCDIR ?= ${DESTDIR}/etc
-+ETCDIR ?= /etc
- ETCDIR_CRIO ?= ${ETCDIR}/crio
- DATAROOTDIR ?= ${PREFIX}/share/containers
- BUILDTAGS ?= containers_image_ostree_stub \
-@@ -26,7 +26,7 @@
- 			 $(shell hack/seccomp_tag.sh) \
- 			 $(shell hack/selinux_tag.sh) \
- 			 $(shell hack/libsubid_tag.sh)
-CRICTL_CONFIG_DIR=${DESTDIR}/etc
-+CRICTL_CONFIG_DIR = /etc
- CONTAINER_RUNTIME ?= podman
- BUILD_PATH := $(shell pwd)/build
- BUILD_BIN_PATH := ${BUILD_PATH}/bin
-@@ -420,60 +420,62 @@
- install: install.bin install.man install.completions install.systemd install.config
- 
- install.bin-nobuild:
-	install ${SELINUXOPT} -D -m 755 bin/crio $(BINDIR)/crio
-	install ${SELINUXOPT} -D -m 755 bin/pinns $(BINDIR)/pinns
-+	install ${SELINUXOPT} -D -m 755 bin/crio ${DESTDIR}$(BINDIR)/crio
-+	install ${SELINUXOPT} -D -m 755 bin/pinns ${DESTDIR}$(BINDIR)/pinns
- 
- install.bin: binaries install.bin-nobuild
- 
- install.man-nobuild:
-	install ${SELINUXOPT} -d -m 755 $(MANDIR)/man5
-	install ${SELINUXOPT} -d -m 755 $(MANDIR)/man8
-	install ${SELINUXOPT} -m 644 $(filter %.5,$(MANPAGES)) -t $(MANDIR)/man5
-	install ${SELINUXOPT} -m 644 $(filter %.8,$(MANPAGES)) -t $(MANDIR)/man8
-+	install ${SELINUXOPT} -d -m 755 ${DESTDIR}$(MANDIR)/man5
-+	install ${SELINUXOPT} -d -m 755 ${DESTDIR}$(MANDIR)/man8
-+	install ${SELINUXOPT} -m 644 $(filter %.5,$(MANPAGES)) -t ${DESTDIR}$(MANDIR)/man5
-+	install ${SELINUXOPT} -m 644 $(filter %.8,$(MANPAGES)) -t ${DESTDIR}$(MANDIR)/man8
- 
- install.man: $(MANPAGES) install.man-nobuild
- 
- install.config-nobuild:
-	install ${SELINUXOPT} -d $(DATAROOTDIR)/oci/hooks.d
-	install ${SELINUXOPT} -d $(ETCDIR_CRIO)/crio.conf.d
-	install ${SELINUXOPT} -D -m 644 crio.conf $(ETCDIR_CRIO)/crio.conf
-	install ${SELINUXOPT} -D -m 644 crio-umount.conf $(OCIUMOUNTINSTALLDIR)/crio-umount.conf
-	install ${SELINUXOPT} -D -m 644 crictl.yaml $(CRICTL_CONFIG_DIR)
-+	install ${SELINUXOPT} -d ${DESTDIR}$(ETCDIR_CRIO)/crio.conf.d
-+	install ${SELINUXOPT} -d ${DESTDIR}$(ETCDIR)/containers/oci/hooks.d
-+	install ${SELINUXOPT} -d ${DESTDIR}$(DATAROOTDIR)/oci/hooks.d
-+	install ${SELINUXOPT} -D -m 644 crio.conf ${DESTDIR}$(ETCDIR_CRIO)/crio.conf
-+	install ${SELINUXOPT} -D -m 644 crio-umount.conf ${DESTDIR}$(OCIUMOUNTINSTALLDIR)/crio-umount.conf
-+	install ${SELINUXOPT} -D -m 644 crictl.yaml ${DESTDIR}$(CRICTL_CONFIG_DIR)
- 
- install.config: crio.conf install.config-nobuild
- 
- install.completions:
-	install ${SELINUXOPT} -d -m 755 ${BASHINSTALLDIR}
-	install ${SELINUXOPT} -d -m 755 ${FISHINSTALLDIR}
-	install ${SELINUXOPT} -d -m 755 ${ZSHINSTALLDIR}
-	install ${SELINUXOPT} -D -m 644 -t ${BASHINSTALLDIR} completions/bash/crio
-	install ${SELINUXOPT} -D -m 644 -t ${FISHINSTALLDIR} completions/fish/crio.fish
-	install ${SELINUXOPT} -D -m 644 -t ${ZSHINSTALLDIR}  completions/zsh/_crio
-+	install ${SELINUXOPT} -d -m 755 ${DESTDIR}${BASHINSTALLDIR}
-+	install ${SELINUXOPT} -d -m 755 ${DESTDIR}${FISHINSTALLDIR}
-+	install ${SELINUXOPT} -d -m 755 ${DESTDIR}${ZSHINSTALLDIR}
-+	install ${SELINUXOPT} -D -m 644 -t ${DESTDIR}${BASHINSTALLDIR} completions/bash/crio
-+	install ${SELINUXOPT} -D -m 644 -t ${DESTDIR}${FISHINSTALLDIR} completions/fish/crio.fish
-+	install ${SELINUXOPT} -D -m 644 -t ${DESTDIR}${ZSHINSTALLDIR}  completions/zsh/_crio
- 
- install.systemd:
-	install ${SELINUXOPT} -D -m 644 contrib/systemd/crio.service $(PREFIX)/lib/systemd/system/crio.service
-	install ${SELINUXOPT} -D -m 644 contrib/systemd/crio-wipe.service $(PREFIX)/lib/systemd/system/crio-wipe.service
-+	install ${SELINUXOPT} -D -m 644 contrib/systemd/crio.service ${DESTDIR}$(PREFIX)/lib/systemd/system/crio.service
-+	install ${SELINUXOPT} -D -m 644 contrib/systemd/crio-wipe.service ${DESTDIR}$(PREFIX)/lib/systemd/system/crio-wipe.service
- 
- uninstall:
-	rm -f $(BINDIR)/crio
-	rm -f $(BINDIR)/pinns
-+	rm -f $(DESTDIR)$(BINDIR)/crio
-+	rm -f $(DESTDIR)$(BINDIR)/pinns
- 	for i in $(filter %.5,$(MANPAGES)); do \
-		rm -f $(MANDIR)/man5/$$(basename $${i}); \
-+		rm -f $(DESTDIR)$(MANDIR)/man5/$$(basename $${i}); \
- 	done
- 	for i in $(filter %.8,$(MANPAGES)); do \
-		rm -f $(MANDIR)/man8/$$(basename $${i}); \
-+		rm -f $(DESTDIR)$(MANDIR)/man8/$$(basename $${i}); \
- 	done
-	rm -f ${BASHINSTALLDIR}/crio
-	rm -f ${FISHINSTALLDIR}/crio.fish
-	rm -f ${ZSHINSTALLDIR}/_crio
-	rm -f $(PREFIX)/lib/systemd/system/crio-wipe.service
-	rm -f $(PREFIX)/lib/systemd/system/crio.service
-	rm -f $(PREFIX)/lib/systemd/system/cri-o.service
-	rm -rf $(DATAROOTDIR)/oci/hooks.d
-	rm -f $(ETCDIR_CRIO)/crio.conf
-	rm -rf $(ETCDIR_CRIO)/crio.conf.d
-	rm -f $(OCIUMOUNTINSTALLDIR)/crio-umount.conf
-	rm -f $(CRICTL_CONFIG_DIR)/crictl.yaml
-+	rm -f $(DESTDIR)${BASHINSTALLDIR}/crio
-+	rm -f $(DESTDIR)${FISHINSTALLDIR}/crio.fish
-+	rm -f $(DESTDIR)${ZSHINSTALLDIR}/_crio
-+	rm -f $(DESTDIR)$(PREFIX)/lib/systemd/system/crio-wipe.service
-+	rm -f $(DESTDIR)$(PREFIX)/lib/systemd/system/crio.service
-+	rm -f $(DESTDIR)$(PREFIX)/lib/systemd/system/cri-o.service
-+	rm -f $(DESTDIR)$(ETCDIR_CRIO)/crio.conf
-+	rm -rf $(DESTDIR)$(ETCDIR_CRIO)/crio.conf.d
-+	rm -rf $(DESTDIR)$(ETCDIR)/containers/oci/hooks.d
-+	rm -rf $(DESTDIR)$(DATAROOTDIR)/oci/hooks.d
-+	rm -f $(DESTDIR)$(OCIUMOUNTINSTALLDIR)/crio-umount.conf
-+	rm -f $(DESTDIR)$(CRICTL_CONFIG_DIR)/crictl.yaml
- 
- docs-validation:
- 	$(GO_RUN) -tags "$(BUILDTAGS)" ./test/docs-validation
--- a/kubezero/cri-o/remove-systemd-files.patch
+++ b/kubezero/cri-o/remove-systemd-files.patch
@ -1,13 +0,0 @@
-diff --git a/Makefile b/Makefile
-index 19f8052..135385c 100644
--- a/Makefile
-+++ b/Makefile
-@@ -403,7 +403,7 @@ get-script:
- 	sed -i '/# INCLUDE/q' scripts/get
- 	cat contrib/bundle/install-paths contrib/bundle/install >> scripts/get
- 
-install: install.bin install.man install.completions install.systemd install.config
-+install: install.bin install.man install.completions install.config
- 
- install.bin-nobuild:
- 	install ${SELINUXOPT} -D -m 755 bin/crio $(BINDIR)/crio
--- a/kubezero/kubernetes/APKBUILD
+++ b/kubezero/kubernetes/APKBUILD
@ -228,7 +228,7 @@ d7e022ee22da191bda7382f87cb293d9c9d115a3df0c2054bf918279eb866f99c6d5c21e4c98eae8
 561bef5633ba4b9021720624443d9c279a561e5fabea76e5d0fbee2e7ad8999029a2511a45895fbec8448026212a3c5b4c197b248a6afa7f8bd945f705524ea7  kube-scheduler.initd
 af88b382ab75657d0ff13c3f8f6d924cef9f2df7807a9a27daa63495981801bc4b607998f65c0758c11a7e070e43c24f7184ba7720711109c74b1c4d57919e34  kube-scheduler.confd
 3692da349dd6ed0f5acc09d7b95ac562ffecb103e2270bebdfe4a7808d48dada9d2debff262d85b11c47f9ca3f0c20000712d03629ed813ff08a3e02d69267e6  kube-scheduler.logrotated
-372cdf2fbb24a229ed7b3450b54197c006928cb8d2fd756f2713e1e6961849c7aaa35b20b14fb75d1a12ef1e35258048738aa22b5f9783af8fa0a31dfd1b5bbd  kubelet.initd
+dc0888af4b0083b0de335122cd0715854a505c1c7ba3298f1461a3d5dbdbd6cc2e925298856f923f65fa4004687df2fdac10433836f343929183c26466b54f00  kubelet.initd
 cc4fd92a9f288336cf204a38d6913ca25e20b78d0c4abb74b6b2b8cf634d7df774144bde1101048d9d9ab0f140ffb62ce31cf3bb2a69ddeadd04c273dfcb58a0  kubelet.confd
 941f4a7579dcf78da2d323ac69195e95eba6600e6fcefe9231447f11c9867a7aa57b4189ee1fefb10eab19c89665ea2e7696b539c92e99fbcde905d2ff85be58  kubelet.logrotated
 "
--- a/kubezero/kubernetes/kubelet.initd
+++ b/kubezero/kubernetes/kubelet.initd
@ -25,5 +25,5 @@ pidfile="${KUBELET_PIDFILE:-/run/${RC_SVCNAME}.pid}"
 depend() {
 	after net cloudbender
 	need cgroups
-	want containerd crio
+	want containerd
 }
--- a/kubezero/kubezero/APKBUILD
+++ b/kubezero/kubezero/APKBUILD
@ -2,7 +2,7 @@
 # Maintainer: Stefan Reimer <stefan@zero-downtime.net>
 pkgname=kubezero
 pkgver=1.30.6
-_crio=1.30.6
+_containerd=1.7.23-r1337
 _ecr=1.30.3

 pkgrel=0
@ -10,11 +10,15 @@ pkgdesc="KubeZero release package"
 url="https://git.zero-downtime.net/ZeroDownTime/alpine-overlay/src/branch/master/kubezero/kubezero"
 arch="x86_64"
 license="AGPL-3.0"
+makedepends="podman"
+
 depends="
-        podman
        xz
        cri-tools
-        cri-o~$_crio
+        crun
+        containerd=$_containerd
+        containerd-ctr=$_containerd
+        nerdctl
        kubelet~$pkgver
        kubectl~$pkgver
        ecr-credential-provider~$_ecr
@ -39,12 +43,12 @@ source="
       evictLocalNode.sh
       credential-provider.yaml
       kubelet.monit
-       crio.monit
-       crio.conf
+       containerd.conf
+       crictl.yaml
       "
       #multus-"$multus_version".tar.gz::https://github.com/k8snetworkplumbingwg/multus-cni/releases/download/v"$multus_version"/multus-cni_"$multus_version"_linux_amd64.tar.gz

-# get multus and cilium binaries and drop them in /usr/libexec/cni
+# preinstall multus and cilium images
 build() {
  # pre loaded images
  for i in $IMAGES; do
@ -61,12 +65,14 @@ package() {
  mkdir -p $pkgdir/etc/kubernetes/manifests
  install -Dm644 "$srcdir"/credential-provider.yaml "$pkgdir/etc/kubernetes/credential-provider.yaml"

-  # crio settings
-  install -Dm644 "$srcdir"/crio.conf "$pkgdir/etc/crio/crio.conf.d/01-kubezero.conf"
+  # containerd settings
+  install -Dm644 "$srcdir"/containerd.conf "$pkgdir/etc/containerd/conf.d/kubezero.toml"
+
+  # crictl
+  install -Dm644 "$srcdir"/crictl.yaml "$pkgdir/etc/crictl.yaml"

  # monit
  install -Dm644 "$srcdir"/kubelet.monit "$pkgdir/etc/monit.d/kubelet.conf"
-  install -Dm644 "$srcdir"/crio.monit "$pkgdir/etc/monit.d/crio.conf"

  # multus
  #install -Dm755 "$srcdir"/multus-cni_"$multus_version"_linux_amd64/multus $pkgdir/usr/libexec/cni/multus
@ -87,6 +93,6 @@ ecb33fc3a0ffc378723624858002f9f5e180e851b55b98ab6611ecc6a73d4719bc7de240f87683fc
 fce1013f7b1bfa8ee526de62e642a37fda3168889723e873d3fb69e257f4caa1423b5a14b9343b12a87f3b6f93c7d3861b854efda67ef2d6a42a5ca8cf3d1593  evictLocalNode.sh
 92499ec9a8b3634c42b16c01d27f1c1bb650bcc074a2c8d9d16cfe2ea08942948989c6aae79bd2df562ff17df11bbc329e0971f15c4e64f944457825dee7aa79  credential-provider.yaml
 8b81eb0fb66e6a739965db6af6a31c443e8f612c06146bd51107372abd833b527423299ee11b27e011f46cfbee11415234b3fa0dea695dbbb06711e0ad58f08d  kubelet.monit
-e801df9ede6065395db75154735ca9368882d4225452a33f2b54b98cd0c4f3ceb730762d8745c6aea350a3a50a1df0c79ab46f422f94e9a40e621528e9d82055  crio.monit
-064fc245b7ffd67834a2f5fd13cb0bcb5f4a5caf79b8113b3669bf1d0e1a4af2042e69f8f496991de76d621fd01bc7e67de37c59f034584d12622c6af96376ff  crio.conf
+001a34dcbfafb7f66c6b91d8de249a990d627f6dc5133a4e56e2cc357495dad333e03be408ee0d118ed99dba9d9a17d02165c336893b6bf51f689378ccc5de42  containerd.conf
+b112ffd86f095aec47bf75179659af20720792c453d6cc9d11db26446aa2f3c237fe59b793dd8ef3ee93f6fd4230ff8abadfdada76e6452779b982a71eb37cb9  crictl.yaml
 "
--- a/kubezero/kubezero/containerd.conf
+++ b/kubezero/kubezero/containerd.conf
@ -0,0 +1,39 @@
+version = 2
+
+oom_score = -999
+
+[plugins]
+  [plugins."io.containerd.grpc.v1.cri"]
+    enable_cdi = true
+    sandbox_image = "registry.k8s.io/pause:3.9"
+    tolerate_missing_hugetlb_controller = false
+
+    [plugins."io.containerd.grpc.v1.cri".cni]
+      bin_dir = "/usr/libexec/cni"
+
+    [plugins."io.containerd.grpc.v1.cri".containerd]
+      default_runtime_name = "crun"
+
+      [plugins."io.containerd.grpc.v1.cri".containerd.runtimes]
+
+        [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.crun]
+          runtime_type = "io.containerd.runc.v2"
+          [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.crun.options]
+            BinaryName = "/usr/bin/crun"
+
+        [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.nvidia]
+          runtime_type = "io.containerd.runc.v2"
+          [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.nvidia.options]
+            BinaryName = "/usr/bin/nvidia-container-runtime"
+
+    [plugins."io.containerd.grpc.v1.cri".registry]
+      config_path = "/etc/containerd/certs.d"
+
+  [plugins."io.containerd.runtime.v1.linux"]
+    runtime = "crun"
+
+  [plugins."io.containerd.monitor.v1.cgroups"]
+    no_prometheus = true
+
+
+
--- a/kubezero/kubezero/crictl.yaml
+++ b/kubezero/kubezero/crictl.yaml
@ -0,0 +1 @@
+runtime-endpoint: unix:///run/containerd/containerd.sock
--- a/kubezero/kubezero/crio.conf
+++ b/kubezero/kubezero/crio.conf
@ -1,8 +0,0 @@
-[crio.metrics]
-enable_metrics = true
-
-[crio.runtime]
-default_ulimits = [ "nofile=65535:65535", "memlock=-1:-1" ]
-
-[crio.network]
-cni_default_network="multus-cni-network"
--- a/kubezero/kubezero/crio.monit
+++ b/kubezero/kubezero/crio.monit
@ -1,4 +0,0 @@
-check process crio pidfile /run/crio.pid
-  start program = "/sbin/rc-service crio start"
-  stop program  = "/sbin/rc-service crio stop"
-  restart program = "/sbin/rc-service crio restart"
--- a/kubezero/linux-lts/0001-powerpc-boot-wrapper-Add-z-notext-flag-for-ppc64le.patch
+++ b/kubezero/linux-lts/0001-powerpc-boot-wrapper-Add-z-notext-flag-for-ppc64le.patch
@ -1,28 +0,0 @@
-From b4d7a16d2b76e09ec88ff53a86f6e263c329e160 Mon Sep 17 00:00:00 2001
-From: Natanael Copa <ncopa@alpinelinux.org>
-Date: Tue, 28 Nov 2023 14:35:54 +0100
-Subject: [PATCH 1/5] powerpc/boot/wrapper: Add "-z notext" flag for ppc64le
-
-This is a follow up to commit 4c078c86b4a4 (powerpc/boot/wrapper: Add
-"-z notext" flag to disable diagnostic)
-
-Ref: https://gitlab.alpinelinux.org/alpine/aports/-/issues/14560
---
- arch/powerpc/boot/wrapper | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/arch/powerpc/boot/wrapper b/arch/powerpc/boot/wrapper
-index 352d7de24018..ceaef956f821 100755
--- a/arch/powerpc/boot/wrapper
-+++ b/arch/powerpc/boot/wrapper
-@@ -268,6 +268,7 @@ pseries)
-     if [ "$format" != "elf32ppc" ]; then
- 	link_address=
- 	pie=-pie
-+	notext='-z notext'
-     fi
-     make_space=n
-     ;;
-- 
-2.43.0
-
--- a/kubezero/linux-lts/0002-x86-Compress-vmlinux-with-zstd-19-instead-of-22.patch
+++ b/kubezero/linux-lts/0002-x86-Compress-vmlinux-with-zstd-19-instead-of-22.patch
@ -1,30 +0,0 @@
-From b7a5aef6b0d761be21e8df6cd11a963f762768ea Mon Sep 17 00:00:00 2001
-From: Natanael Copa <ncopa@alpinelinux.org>
-Date: Tue, 13 Dec 2022 16:45:51 +0100
-Subject: [PATCH 2/5] x86: Compress vmlinux with zstd -19 instead of -22
-
-This gives slightly bigger kernel but it avoids run out of memory on 32
-bit kernels with the error:
-zstd kernel compression error 11
-
-https://forums.gentoo.org/viewtopic-p-8641020.html#8641020
---
- arch/x86/boot/compressed/Makefile | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/arch/x86/boot/compressed/Makefile b/arch/x86/boot/compressed/Makefile
-index 71fc531b95b4..260d38e772b0 100644
--- a/arch/x86/boot/compressed/Makefile
-+++ b/arch/x86/boot/compressed/Makefile
-@@ -147,7 +147,7 @@ $(obj)/vmlinux.bin.lzo: $(vmlinux.bin.all-y) FORCE
- $(obj)/vmlinux.bin.lz4: $(vmlinux.bin.all-y) FORCE
- 	$(call if_changed,lz4_with_size)
- $(obj)/vmlinux.bin.zst: $(vmlinux.bin.all-y) FORCE
-	$(call if_changed,zstd22_with_size)
-+	$(call if_changed,zstd_with_size)
- 
- suffix-$(CONFIG_KERNEL_GZIP)	:= gz
- suffix-$(CONFIG_KERNEL_BZIP2)	:= bz2
-- 
-2.43.0
-
--- a/kubezero/linux-lts/0003-kexec-add-kexec_load_disabled-boot-option.patch
+++ b/kubezero/linux-lts/0003-kexec-add-kexec_load_disabled-boot-option.patch
@ -1,36 +0,0 @@
-From cf29b5a58ef88adf96317c3c933a16f9c865e09a Mon Sep 17 00:00:00 2001
-From: Natanael Copa <ncopa@alpinelinux.org>
-Date: Thu, 14 Jul 2022 13:23:51 +0200
-Subject: [PATCH 3/5] kexec: add kexec_load_disabled boot option
-
-Make kexec_load disabled by default and add a boot option to enable it:
-kexec_load_disabled=0
---
- kernel/kexec_core.c | 11 ++++++++++-
- 1 file changed, 10 insertions(+), 1 deletion(-)
-
-diff --git a/kernel/kexec_core.c b/kernel/kexec_core.c
-index 9dc728982d79..7650ffe5631e 100644
--- a/kernel/kexec_core.c
-+++ b/kernel/kexec_core.c
-@@ -942,7 +942,16 @@ static struct kexec_load_limit load_limit_panic = {
- 
- struct kimage *kexec_image;
- struct kimage *kexec_crash_image;
-static int kexec_load_disabled;
-+static int kexec_load_disabled = 1;
-+
-+static int __init kexec_load_disabled_setup(char *str)
-+{
-+	unsigned long disabled;
-+	if (!kstrtoul(str, 0, &disabled))
-+		kexec_load_disabled = disabled ? 1 : 0;
-+	return 1;
-+}
-+__setup("kexec_load_disabled=", kexec_load_disabled_setup);
- 
- #ifdef CONFIG_SYSCTL
- static int kexec_limit_handler(struct ctl_table *table, int write,
-- 
-2.43.0
-
--- a/kubezero/linux-lts/0004-objtool-respect-AWK-setting.patch
+++ b/kubezero/linux-lts/0004-objtool-respect-AWK-setting.patch
@ -1,26 +0,0 @@
-From dc34b09b20b7aa88ca55742a113d223f33c09c32 Mon Sep 17 00:00:00 2001
-From: Natanael Copa <ncopa@alpinelinux.org>
-Date: Tue, 28 Nov 2023 14:22:46 +0100
-Subject: [PATCH 4/5] objtool: respect AWK setting
-
-AWK= is not passed on as an makefile argument so we need pass it as an env.
---
- tools/objtool/Makefile | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/tools/objtool/Makefile b/tools/objtool/Makefile
-index 83b100c1e7f6..6ccddfa6de4f 100644
--- a/tools/objtool/Makefile
-+++ b/tools/objtool/Makefile
-@@ -42,7 +42,7 @@ OBJTOOL_CFLAGS += $(if $(elfshdr),,-DLIBELF_USE_DEPRECATED)
- # Always want host compilation.
- HOST_OVERRIDES := CC="$(HOSTCC)" LD="$(HOSTLD)" AR="$(HOSTAR)"
- 
-AWK = awk
-+AWK ?= awk
- MKDIR = mkdir
- 
- ifeq ($(V),1)
-- 
-2.43.0
-
--- a/kubezero/linux-lts/0005-powerpc-config-defang-gcc-check-for-stack-protector-.patch
+++ b/kubezero/linux-lts/0005-powerpc-config-defang-gcc-check-for-stack-protector-.patch
@ -1,35 +0,0 @@
-From 0306d648bbd12489c9ffbe8f5bd9cc82fa5eadd8 Mon Sep 17 00:00:00 2001
-From: Ariadne Conill <ariadne@dereferenced.org>
-Date: Tue, 18 Feb 2020 21:10:22 +0000
-Subject: [PATCH 5/5] powerpc: config: defang gcc check for stack-protector
- support
-
-When we rebase kernel configs in Alpine, it is common to do so from
-an environment where CARCH does not match CHOST.
-
-Accordingly, we assume that the gcc check will always pass, and
-simply remove it in preference for always enabling the
-HAVE_STACKPROTECTOR config option.
-
-Signed-off-by: Ariadne Conill <ariadne@dereferenced.org>
---
- arch/powerpc/Kconfig | 3 +--
- 1 file changed, 1 insertion(+), 2 deletions(-)
-
-diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
-index d5d5388973ac..0ba9d88de22f 100644
--- a/arch/powerpc/Kconfig
-+++ b/arch/powerpc/Kconfig
-@@ -271,8 +271,7 @@ config PPC
- 	select HAVE_RSEQ
- 	select HAVE_SETUP_PER_CPU_AREA		if PPC64
- 	select HAVE_SOFTIRQ_ON_OWN_STACK
-	select HAVE_STACKPROTECTOR		if PPC32 && $(cc-option,-mstack-protector-guard=tls -mstack-protector-guard-reg=r2)
-	select HAVE_STACKPROTECTOR		if PPC64 && $(cc-option,-mstack-protector-guard=tls -mstack-protector-guard-reg=r13)
-+	select HAVE_STACKPROTECTOR
- 	select HAVE_STATIC_CALL			if PPC32
- 	select HAVE_SYSCALL_TRACEPOINTS
- 	select HAVE_VIRT_CPU_ACCOUNTING
-- 
-2.43.0
-
--- a/kubezero/linux-lts/1337-nftables-ipv6.patch
+++ b/kubezero/linux-lts/1337-nftables-ipv6.patch
@ -1,38 +0,0 @@
-diff --git a/net/netfilter/xt_NFLOG.c b/net/netfilter/xt_NFLOG.c
-index d80abd6ccaf8f71fa70605fef7edada827a19ceb..6dcf4bc7e30b2ae364a1cd9ac8df954a90905c52 100644
--- a/net/netfilter/xt_NFLOG.c
-+++ b/net/netfilter/xt_NFLOG.c
-@@ -79,7 +79,7 @@ static struct xt_target nflog_tg_reg[] __read_mostly = {
- 	{
- 		.name       = "NFLOG",
- 		.revision   = 0,
-		.family     = NFPROTO_IPV4,
-+		.family     = NFPROTO_IPV6,
- 		.checkentry = nflog_tg_check,
- 		.destroy    = nflog_tg_destroy,
- 		.target     = nflog_tg,
-diff --git a/net/netfilter/xt_TRACE.c b/net/netfilter/xt_TRACE.c
-index f3fa4f11348cd8ad796ce94f012cd48aa7a9020f..2a029b4adbcadf95e493b153f613a210624a9101 100644
--- a/net/netfilter/xt_TRACE.c
-+++ b/net/netfilter/xt_TRACE.c
-@@ -49,6 +49,7 @@ static struct xt_target trace_tg_reg[] __read_mostly = {
- 		.target		= trace_tg,
- 		.checkentry	= trace_tg_check,
- 		.destroy	= trace_tg_destroy,
-+		.me         = THIS_MODULE,
- 	},
- #endif
- };
-diff --git a/net/netfilter/xt_mark.c b/net/netfilter/xt_mark.c
-index f76fe04fc9a4e19f18ac323349ba6f22a00eafd7..65b965ca40ea7ea5d9feff381b433bf267a424c4 100644
--- a/net/netfilter/xt_mark.c
-+++ b/net/netfilter/xt_mark.c
-@@ -62,7 +62,7 @@ static struct xt_target mark_tg_reg[] __read_mostly = {
- 	{
- 		.name           = "MARK",
- 		.revision       = 2,
-		.family         = NFPROTO_IPV4,
-+		.family         = NFPROTO_IPV6,
- 		.target         = mark_tg,
- 		.targetsize     = sizeof(struct xt_mark_tginfo2),
- 		.me             = THIS_MODULE,
--- a/kubezero/linux-lts/APKBUILD
+++ b/kubezero/linux-lts/APKBUILD
@ -1,378 +0,0 @@
-# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
-
-_flavor=lts
-pkgname=linux-$_flavor
-pkgver=6.6.58
-_kernver=${pkgver%.*}
-pkgrel=0
-pkgdesc="Linux lts kernel"
-url="https://www.kernel.org"
-depends="initramfs-generator"
-_depends_dev="perl gmp-dev mpc1-dev mpfr-dev elfutils-dev bash flex bison zstd"
-makedepends="$_depends_dev sed installkernel bc linux-headers linux-firmware-any openssl-dev>3 mawk
-	diffutils findutils zstd pahole python3 gcc>=13.1.1_git20230624"
-options="!strip !check"
-_config=${config:-config-lts.${CARCH}}
-source="https://cdn.kernel.org/pub/linux/kernel/v${pkgver%%.*}.x/linux-$_kernver.tar.xz
-	0001-powerpc-boot-wrapper-Add-z-notext-flag-for-ppc64le.patch
-	0002-x86-Compress-vmlinux-with-zstd-19-instead-of-22.patch
-	0003-kexec-add-kexec_load_disabled-boot-option.patch
-	0004-objtool-respect-AWK-setting.patch
-	0005-powerpc-config-defang-gcc-check-for-stack-protector-.patch
-	1337-nftables-ipv6.patch
-
-	lts.aarch64.config
-	lts.armv7.config
-	lts.x86.config
-	lts.x86_64.config
-	lts.ppc64le.config
-	lts.s390x.config
-	lts.loongarch64.config
-
-	virt.aarch64.config
-	virt.armv7.config
-	virt.ppc64le.config
-	virt.x86.config
-	virt.x86_64.config
-	"
-subpackages="$pkgname-dev:_dev:$CBUILD_ARCH $pkgname-doc"
-for _i in $source; do
-	case $_i in
-	*.$CARCH.config)
-		_f=${_i%."$CARCH".config}
-		_flavors="$_flavors $_f"
-		if [ "linux-$_f" != "$pkgname" ]; then
-			subpackages="$subpackages linux-$_f::$CBUILD_ARCH linux-$_f-dev:_dev:$CBUILD_ARCH"
-		fi
-		;;
-	esac
-done
-builddir="$srcdir"/linux-$_kernver
-
-if [ "${pkgver%.0}" = "$pkgver" ]; then
-	source="$source
-	https://cdn.kernel.org/pub/linux/kernel/v${pkgver%%.*}.x/patch-$pkgver.xz"
-fi
-arch="all !armhf !riscv64"
-license="GPL-2.0-only"
-
-# secfixes:
-#   5.10.4-r0:
-#     - CVE-2020-29568
-#     - CVE-2020-29569
-#   5.15.74-r0:
-#     - CVE-2022-41674
-#     - CVE-2022-42719
-#     - CVE-2022-42720
-#     - CVE-2022-42721
-#     - CVE-2022-42722
-#   6.1.27-r3:
-#     - CVE-2023-32233
-#   6.6.13-r1:
-#     - CVE-46838
-
-prepare() {
-	if [ "$_kernver" != "$pkgver" ]; then
-		msg "Applying patch-$pkgver.xz"
-		unxz -c < "$srcdir"/patch-$pkgver.xz | patch -p1 -N
-	fi
-
-	default_prepare
-
-	# remove localversion from patch if any
-	rm -f localversion*
-}
-
-_kernelarch() {
-	local arch="$1"
-	case "$arch" in
-		aarch64*) arch="arm64" ;;
-		arm*) arch="arm" ;;
-		ppc*) arch="powerpc" ;;
-		s390*) arch="s390" ;;
-		riscv*) arch="riscv" ;;
-		loongarch64) arch="loongarch" ;;
-	esac
-	echo "$arch"
-}
-
-_prepareconfig() {
-	local _flavor="$1"
-	local _arch="$2"
-	local _config=$_flavor.$_arch.config
-	local _builddir="$srcdir"/build-$_flavor.$_arch
-	mkdir -p "$_builddir"
-	echo "-$pkgrel-$_flavor" > "$_builddir"/localversion-alpine
-
-	cp "$srcdir"/$_config "$_builddir"/.config
-	msg "Configuring $_flavor kernel ($_arch)"
-	make -C "$builddir" \
-		O="$_builddir" \
-		ARCH="$(_kernelarch $_arch)" \
-		olddefconfig
-
-	if grep "CONFIG_MODULE_SIG=y" "$_builddir"/.config >/dev/null; then
-		if [ -f "$KERNEL_SIGNING_KEY" ]; then
-			sed -i -e "s:^CONFIG_MODULE_SIG_KEY=.*:CONFIG_MODULE_SIG_KEY=\"$KERNEL_SIGNING_KEY\":" \
-				"$_builddir"/.config
-			msg "Using $KERNEL_SIGNING_KEY to sign $_flavor kernel ($_arch) modules"
-		else
-			warning "KERNEL_SIGNING_KEY was not set. A signing key will be generated, but 3rd"
-			warning "party modules can not be signed"
-		fi
-	fi
-}
-
-listconfigs() {
-	for i in $source; do
-		case "$i" in
-			*.config) echo $i;;
-		esac
-	done
-}
-
-prepareconfigs() {
-	for _config in $(listconfigs); do
-		local _flavor=${_config%%.*}
-		local _arch=${_config%.config}
-		_arch=${_arch#*.}
-		local _builddir="$srcdir"/build-$_flavor.$_arch
-		_prepareconfig "$_flavor" "$_arch"
-	done
-}
-
-# this is supposed to be run before version is bumped so we can compare
-# what new kernel config knobs are introduced
-prepareupdate() {
-	clean && fetch && unpack && prepare && deps
-	prepareconfigs
-	rm -r "$builddir"
-}
-
-updateconfigs() {
-	if ! [ -d "$builddir" ]; then
-		deps && fetch && unpack && prepare
-	fi
-	for _config in ${CONFIGS:-$(listconfigs)}; do
-		msg "updating $_config"
-		local _flavor=${_config%%.*}
-		local _arch=${_config%.config}
-		_arch=${_arch#*.}
-		local _builddir="$srcdir"/build-$_flavor.$_arch
-		mkdir -p "$_builddir"
-		echo "-$pkgrel-$_flavor" > "$_builddir"/localversion-alpine
-		local actions="listnewconfig oldconfig"
-		if ! [ -f "$_builddir"/.config ]; then
-			cp "$srcdir"/$_config "$_builddir"/.config
-			actions="olddefconfig"
-		fi
-		env | grep ^CONFIG_ >> "$_builddir"/.config || true
-		make -j1 -C "$builddir" \
-			O="$_builddir" \
-			ARCH="$(_kernelarch $_arch)" \
-			$actions savedefconfig
-
-		cp "$_builddir"/defconfig "$startdir"/$_config
-	done
-}
-
-set_kbuild_timestamp() {
-	# KBUILD_BUILD_TIMESTAMP needs to be parsable by busybox date
-	export KBUILD_BUILD_TIMESTAMP="$(date '+%Y-%m-%d %H:%M:%S' -u${SOURCE_DATE_EPOCH:+d @$SOURCE_DATE_EPOCH})"
-}
-
-build() {
-	unset LDFLAGS
-	# for some reason these sometimes leak into the kernel build,
-	# -Werror=format-security breaks some stuff
-	unset CFLAGS CPPFLAGS CXXFLAGS
-	set_kbuild_timestamp
-	for i in $_flavors; do
-		_prepareconfig "$i" "$CARCH"
-	done
-	for i in $_flavors; do
-		msg "Building $i kernel"
-		cd "$srcdir"/build-$i.$CARCH
-
-		# set org in cert for modules signing
-		# https://www.kernel.org/doc/html/v6.1/admin-guide/module-signing.html#generating-signing-keys
-		mkdir -p certs
-		sed -e 's/#O = Unspecified company/O = alpinelinux.org/' \
-			"$builddir"/certs/default_x509.genkey \
-			> certs/x509.genkey
-
-		make ARCH="$(_kernelarch $CARCH)" \
-			CC="${CC:-gcc}" \
-			AWK="${AWK:-mawk}" \
-			KBUILD_BUILD_VERSION="$((pkgrel + 1 ))-Alpine"
-	done
-}
-
-_package() {
-	local _buildflavor="$1" _outdir="$2"
-	set_kbuild_timestamp
-
-	cd "$srcdir"/build-$_buildflavor.$CARCH
-	local _abi_release="$(make -s kernelrelease)"
-	# modules_install seems to regenerate a defect Modules.symvers on s390x. Work
-	# around it by backing it up and restore it after modules_install
-	cp Module.symvers Module.symvers.backup
-
-	mkdir -p "$_outdir"/boot "$_outdir"/lib/modules
-
-	local _install
-	case "$CARCH" in
-		arm*|aarch64|riscv*) _install="zinstall dtbs_install";;
-		*) _install=install;;
-	esac
-
-	make modules_install $_install \
-		ARCH="$(_kernelarch $CARCH)" \
-		INSTALL_MOD_PATH="$_outdir" \
-		INSTALL_MOD_STRIP=1 \
-		INSTALL_PATH="$_outdir"/boot \
-		INSTALL_DTBS_PATH="$_outdir/boot/dtbs-$_buildflavor"
-
-	cp Module.symvers.backup Module.symvers
-
-	rm -f "$_outdir"/lib/modules/"$_abi_release"/build \
-		"$_outdir"/lib/modules/"$_abi_release"/source
-	rm -rf "$_outdir"/lib/firmware
-
-	install -D -m644 include/config/kernel.release \
-		"$_outdir"/usr/share/kernel/$_buildflavor/kernel.release
-
-	case "$CARCH" in
-	loongarch64)
-		mv  "$_outdir"/boot/vmlinuz-$_abi_release \
-			"$_outdir"/boot/vmlinuz-$_buildflavor
-
-		mv  "$_outdir"/boot/config-$_abi_release \
-			"$_outdir"/boot/config-$_buildflavor
-
-		mv  "$_outdir"/boot/System.map-$_abi_release \
-			"$_outdir"/boot/System.map-$_buildflavor
-		;;
-	esac
-}
-
-# main flavor installs in $pkgdir
-package() {
-	depends="$depends linux-firmware-any"
-
-	_package "$_flavor" "$pkgdir"
-
-	# copy files for linux-lts-doc sub package
-	mkdir -p "$pkgdir"/usr/share/doc
-	cp -r "$builddir"/Documentation \
-		"$pkgdir"/usr/share/doc/linux-doc-"$pkgver"/
-	# remove files that aren't part of the documentation itself
-	for nondoc in \
-		.gitignore conf.py docutils.conf \
-		dontdiff Kconfig Makefile
-	do
-		rm "$pkgdir"/usr/share/doc/linux-doc-"$pkgver"/"$nondoc"
-	done
-	# create /usr/share/doc/linux-doc symlink
-	cd "$pkgdir"/usr/share/doc; ln -s linux-doc-"$pkgver" linux-doc
-}
-
-# subflavors install in $subpkgdir
-virt() {
-	_package virt "$subpkgdir"
-}
-
-_dev() {
-	local _flavor=$(echo $subpkgname | sed -E 's/(^linux-|-dev$)//g')
-	local _builddir="$srcdir"/build-$_flavor.$CARCH
-	local _abi_release="$(make -C "$_builddir" -s kernelrelease)"
-	# copy the only the parts that we really need for build 3rd party
-	# kernel modules and install those as /usr/src/linux-headers,
-	# simlar to what ubuntu does
-	#
-	# this way you dont need to install the 300-400 kernel sources to
-	# build a tiny kernel module
-	#
-	pkgdesc="Headers and script for third party modules for $_flavor kernel"
-	depends="$_depends_dev"
-	local dir="$subpkgdir"/usr/src/linux-headers-"$_abi_release"
-	set_kbuild_timestamp
-
-	# first we import config, run prepare to set up for building
-	# external modules, and create the scripts
-	mkdir -p "$dir"
-	cp -a "$_builddir"/.config "$_builddir"/localversion-alpine \
-		"$dir"/
-
-	install -D -t "$dir"/certs "$_builddir"/certs/signing_key.x509 || :
-
-	make -C "$builddir" \
-		O="$dir" \
-		ARCH="$(_kernelarch $CARCH)" \
-		AWK="${AWK:-mawk}" \
-		prepare modules_prepare scripts
-
-	# remove the stuff that points to real sources. we want 3rd party
-	# modules to believe this is the sources
-	rm "$dir"/Makefile "$dir"/source
-
-	# copy the needed stuff from real sources
-	#
-	# this is taken from ubuntu kernel build script
-	# http://kernel.ubuntu.com/git/ubuntu/ubuntu-zesty.git/tree/debian/rules.d/3-binary-indep.mk
-	cd "$builddir"
-	find .  -path './include/*' -prune \
-		-o -path './scripts/*' -prune -o -type f \
-		\( -name 'Makefile*' -o -name 'Kconfig*' -o -name 'Kbuild*' -o \
-		   -name '*.sh' -o -name '*.pl' -o -name '*.lds' -o -name 'Platform' \) \
-		-print | cpio -pdm "$dir"
-
-	cp -a scripts include "$dir"
-
-	find "arch/$_karch" -name include -type d -print | while IFS='' read -r folder; do
-		find "$folder" -type f
-	done | sort -u | cpio -pdm "$dir"
-
-	install -Dm644 "$srcdir"/build-$_flavor.$CARCH/Module.symvers \
-		"$dir"/Module.symvers
-
-	# remove unneeded things
-	msg "Removing documentation..."
-	rm -r "$dir"/Documentation
-	find "$dir" -type f -name '*.o' -printf 'Removing %P\n' -delete
-	local _karch="$(_kernelarch $CARCH | sed 's/x86_64/x86/')"
-	msg "Removing unneeded arch headers..."
-	for i in "$dir"/arch/*; do
-		if [ "${i##*/}" != "$_karch" ]; then
-			echo "  ${i##*/}"
-			rm -r "$i"
-		fi
-	done
-
-	mkdir -p "$subpkgdir"/lib/modules/"$_abi_release"
-	ln -sf /usr/src/linux-headers-"$_abi_release" \
-		"$subpkgdir"/lib/modules/"$_abi_release"/build
-}
-
-sha512sums="
-458b2c34d46206f9b4ccbac54cc57aeca1eaecaf831bc441e59701bac6eadffc17f6ce24af6eadd0454964e843186539ac0d63295ad2cc32d112b60360c39a35  linux-6.6.tar.xz
-58bf9e84fb01f811f0cada7f7953d111908f0b0650648d6a3522061fe08c9fe284c9315515ae386189253e37d0c92419f78048d6568e2e426654b1e61010685f  0001-powerpc-boot-wrapper-Add-z-notext-flag-for-ppc64le.patch
-763dcb40f698d43b0bb856f44493973e840b66efe62a8fd41a08b6e3fa38cf903e059d107be3735ab2f38a0f27bdb0262798e5e530a1905f96195cd8bcf62fdf  0002-x86-Compress-vmlinux-with-zstd-19-instead-of-22.patch
-75f232b6becee7d36d360ffaf2aaa837d13518f9ec620ca159bcb2a0e98eb18a77631406a9b44244ea0164a7ed59fad583823909681e9b894a012f9d13365b69  0003-kexec-add-kexec_load_disabled-boot-option.patch
-2956050bb332411d00a285e9656618f2e34b631492bbc19bef54d83a6e91b8531f4e18830b9313cfe52fbf8a8ca6fb76cf55b3ddd146ca3b977046cf2fd10cad  0004-objtool-respect-AWK-setting.patch
-4b16f15b47b5e5835b926126e39723f519290469517875cfb2d2b857a93ad1344f0d1ba4b255289e20f4da9c867647526b344f752981cee0a48c51577badac3f  0005-powerpc-config-defang-gcc-check-for-stack-protector-.patch
-a7085f581773cd492d8ed76638abe0d81924107778c3eb87ea495fba9aff69b2f28cb01d0ca6101bd849641ccc8294c238486043f492dc44ee26d7111a6b76cc  1337-nftables-ipv6.patch
-a8286ac0cbff0736ab7d5503a19034b11d69d1faa84316bef69087102a009c27b9f54daf9d55d55112e8eef4f239d1dd3a34fe1b55c1aa078ca638a85e0ded1b  lts.aarch64.config
-2fd7ce3f044f72718b51c7db81bb0f720630a8a4164b97036bfe1a0816efc6903ca83f580543ea4bdca6031d912af9138c44f90722ceff8d5e928412ad23a609  lts.armv7.config
-b2534172f8eeb14edb5855c59e806ce07fdfbc1a5a4fe206dd037f17aa21b894d927c1cdcf7c87bb364efd491bb226e3ee21e7f46d26a1afc05f9385260985eb  lts.x86.config
-eff52f6533953312290456124f11e3532dbcbc389a46556c638c7a2d77a0ced2d6316e159c2f0d9bc026fd1a06520f70dd9b1c748fd618e825f4da2cfdf42cad  lts.x86_64.config
-243eb831ef4cf7ae8c18e80433447ddfc437b3eda51c8a584e1d0006b214aac77b1801e66860e6cdcbba04b7c9a15c66cd602811cdf30cb7edf0f43778fb1922  lts.ppc64le.config
-60327486c2668ee24041f86a22d3856dcac3c9e358f4e16a16f6d302d79095ca5a08c4011141050eafe06ba2d1c3eccd142b79ffa469338e213ae2156e29aa44  lts.s390x.config
-4697069b98b81243a18d97ed668a00c08504b55255e4d4392a0f1e63403b6d72036d440b4e54c63c8932ca243164729486e1cea229bd8baf5201fb969f838450  lts.loongarch64.config
-b79a6cf6578c49b582931e0f38564e69714bfa2b03c7615301e4cdf0ba9617bf42e01952f4a8a99d82c68733c0aed8b45b4e72ba0a175ce75dc8a14f12fe0f83  virt.aarch64.config
-fdd8ff5bac36fc6421c3e71af89346c9a84fedfebc49e61353185561c9737bd59f9692fb09af553eaee5dd104e6f170e9cb460c0a54ee429cffe9a7b150b0379  virt.armv7.config
-4dab1bb85d5eaf95ee85beae150c888140583feb1f5bbaec1cf17e2ff73d604590b5aee4edb51caec2ae28adbcf451e88cf3d39bff01887e28ae05c2e104535e  virt.ppc64le.config
-2110f9a8b62af734f67e1024b598645433786bceec2517ca529bd705ebabb3265395ea1e4416260b69778f4c8a5e90db10877d7136841a06c41ffff3279cfb8f  virt.x86.config
-c9f51f49e82f14f1ce5420c9c7deca77b2b54b3c2ff1d2ad377b57a028689c614c573f7d413c960c62a6d0c0463fbd17c1ae8d25c7c70c09217946f2c7c4ef11  virt.x86_64.config
-9feecb9b368461c27c93cdc852d30caaa53fedb6f7c8cf066feb5ec35a87b016250b7573d17b1cdb992df80a840b5bc80d4aa84a00b631ac4bfaa8b64bc23cda  patch-6.6.58.xz
-"
--- a/kubezero/linux-lts/lts.aarch64.config
+++ b/kubezero/linux-lts/lts.aarch64.config
--- a/kubezero/linux-lts/lts.armv7.config
+++ b/kubezero/linux-lts/lts.armv7.config
--- a/kubezero/linux-lts/lts.loongarch64.config
+++ b/kubezero/linux-lts/lts.loongarch64.config
@ -1,888 +0,0 @@
-# CONFIG_LOCALVERSION_AUTO is not set
-CONFIG_SYSVIPC=y
-CONFIG_POSIX_MQUEUE=y
-CONFIG_NO_HZ=y
-CONFIG_HIGH_RES_TIMERS=y
-CONFIG_BPF_SYSCALL=y
-CONFIG_BPF_JIT=y
-CONFIG_PREEMPT=y
-CONFIG_BSD_PROCESS_ACCT=y
-CONFIG_BSD_PROCESS_ACCT_V3=y
-CONFIG_TASKSTATS=y
-CONFIG_TASK_DELAY_ACCT=y
-CONFIG_TASK_XACCT=y
-CONFIG_TASK_IO_ACCOUNTING=y
-CONFIG_LOG_BUF_SHIFT=18
-CONFIG_NUMA_BALANCING=y
-CONFIG_MEMCG=y
-CONFIG_BLK_CGROUP=y
-CONFIG_CFS_BANDWIDTH=y
-CONFIG_RT_GROUP_SCHED=y
-CONFIG_CGROUP_PIDS=y
-CONFIG_CGROUP_FREEZER=y
-CONFIG_CGROUP_HUGETLB=y
-CONFIG_CPUSETS=y
-CONFIG_CGROUP_DEVICE=y
-CONFIG_CGROUP_CPUACCT=y
-CONFIG_CGROUP_PERF=y
-CONFIG_CGROUP_BPF=y
-CONFIG_NAMESPACES=y
-CONFIG_USER_NS=y
-CONFIG_CHECKPOINT_RESTORE=y
-CONFIG_SCHED_AUTOGROUP=y
-CONFIG_RELAY=y
-CONFIG_BLK_DEV_INITRD=y
-CONFIG_EXPERT=y
-CONFIG_KALLSYMS_ALL=y
-CONFIG_PERF_EVENTS=y
-CONFIG_KEXEC=y
-CONFIG_CRASH_DUMP=y
-CONFIG_NUMA=y
-CONFIG_RANDOMIZE_BASE=y
-CONFIG_HIBERNATION=y
-CONFIG_ACPI_SPCR_TABLE=y
-CONFIG_ACPI_TAD=y
-CONFIG_ACPI_DOCK=y
-CONFIG_ACPI_IPMI=m
-CONFIG_ACPI_PCI_SLOT=y
-CONFIG_ACPI_HOTPLUG_MEMORY=y
-CONFIG_JUMP_LABEL=y
-CONFIG_MODULES=y
-CONFIG_MODULE_FORCE_LOAD=y
-CONFIG_MODULE_UNLOAD=y
-CONFIG_MODULE_FORCE_UNLOAD=y
-CONFIG_MODVERSIONS=y
-CONFIG_BLK_DEV_THROTTLING=y
-CONFIG_PARTITION_ADVANCED=y
-CONFIG_BSD_DISKLABEL=y
-CONFIG_UNIXWARE_DISKLABEL=y
-CONFIG_IOSCHED_BFQ=y
-CONFIG_BINFMT_MISC=m
-CONFIG_ZSWAP=y
-CONFIG_ZSWAP_COMPRESSOR_DEFAULT_ZSTD=y
-CONFIG_Z3FOLD=y
-# CONFIG_COMPAT_BRK is not set
-CONFIG_MEMORY_HOTPLUG=y
-CONFIG_MEMORY_HOTPLUG_DEFAULT_ONLINE=y
-CONFIG_MEMORY_HOTREMOVE=y
-CONFIG_KSM=y
-CONFIG_TRANSPARENT_HUGEPAGE=y
-CONFIG_USERFAULTFD=y
-CONFIG_NET=y
-CONFIG_PACKET=y
-CONFIG_TLS=m
-CONFIG_TLS_DEVICE=y
-CONFIG_XFRM_USER=y
-CONFIG_NET_KEY=y
-CONFIG_XDP_SOCKETS=y
-CONFIG_IP_MULTICAST=y
-CONFIG_IP_ADVANCED_ROUTER=y
-CONFIG_IP_MULTIPLE_TABLES=y
-CONFIG_IP_ROUTE_MULTIPATH=y
-CONFIG_IP_ROUTE_VERBOSE=y
-CONFIG_IP_PNP=y
-CONFIG_IP_PNP_DHCP=y
-CONFIG_IP_PNP_BOOTP=y
-CONFIG_IP_PNP_RARP=y
-CONFIG_NET_IPIP=m
-CONFIG_NET_IPGRE_DEMUX=m
-CONFIG_NET_IPGRE=m
-CONFIG_NET_IPGRE_BROADCAST=y
-CONFIG_IP_MROUTE=y
-CONFIG_IP_MROUTE_MULTIPLE_TABLES=y
-CONFIG_IP_PIMSM_V1=y
-CONFIG_IP_PIMSM_V2=y
-CONFIG_INET_ESP=m
-CONFIG_INET_UDP_DIAG=y
-CONFIG_TCP_CONG_ADVANCED=y
-CONFIG_TCP_CONG_BBR=m
-CONFIG_IPV6_ROUTER_PREF=y
-CONFIG_IPV6_ROUTE_INFO=y
-CONFIG_INET6_ESP=m
-CONFIG_IPV6_MROUTE=y
-CONFIG_NETWORK_PHY_TIMESTAMPING=y
-CONFIG_NETFILTER=y
-CONFIG_BRIDGE_NETFILTER=m
-CONFIG_NETFILTER_NETLINK_LOG=m
-CONFIG_NF_CONNTRACK=m
-CONFIG_NF_CONNTRACK_AMANDA=m
-CONFIG_NF_CONNTRACK_FTP=m
-CONFIG_NF_CONNTRACK_NETBIOS_NS=m
-CONFIG_NF_CONNTRACK_SNMP=m
-CONFIG_NF_CONNTRACK_PPTP=m
-CONFIG_NF_CONNTRACK_TFTP=m
-CONFIG_NF_CT_NETLINK=m
-CONFIG_NF_TABLES=m
-CONFIG_NFT_NUMGEN=m
-CONFIG_NFT_CT=m
-CONFIG_NFT_CONNLIMIT=m
-CONFIG_NFT_LOG=m
-CONFIG_NFT_LIMIT=m
-CONFIG_NFT_MASQ=m
-CONFIG_NFT_REDIR=m
-CONFIG_NFT_NAT=m
-CONFIG_NFT_TUNNEL=m
-CONFIG_NFT_QUEUE=m
-CONFIG_NFT_QUOTA=m
-CONFIG_NFT_REJECT=m
-CONFIG_NFT_COMPAT=m
-CONFIG_NFT_HASH=m
-CONFIG_NFT_XFRM=m
-CONFIG_NFT_SOCKET=m
-CONFIG_NFT_OSF=m
-CONFIG_NFT_TPROXY=m
-CONFIG_NFT_SYNPROXY=m
-CONFIG_NETFILTER_XT_SET=m
-CONFIG_NETFILTER_XT_TARGET_AUDIT=m
-CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m
-CONFIG_NETFILTER_XT_TARGET_CLASSIFY=m
-CONFIG_NETFILTER_XT_TARGET_CONNMARK=m
-CONFIG_NETFILTER_XT_TARGET_CT=m
-CONFIG_NETFILTER_XT_TARGET_DSCP=m
-CONFIG_NETFILTER_XT_TARGET_HMARK=m
-CONFIG_NETFILTER_XT_TARGET_IDLETIMER=m
-CONFIG_NETFILTER_XT_TARGET_LED=m
-CONFIG_NETFILTER_XT_TARGET_LOG=m
-CONFIG_NETFILTER_XT_TARGET_MARK=m
-CONFIG_NETFILTER_XT_TARGET_NFQUEUE=m
-CONFIG_NETFILTER_XT_TARGET_TRACE=m
-CONFIG_NETFILTER_XT_TARGET_SECMARK=m
-CONFIG_NETFILTER_XT_TARGET_TCPMSS=m
-CONFIG_NETFILTER_XT_TARGET_TCPOPTSTRIP=m
-CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=m
-CONFIG_NETFILTER_XT_MATCH_BPF=m
-CONFIG_NETFILTER_XT_MATCH_CGROUP=m
-CONFIG_NETFILTER_XT_MATCH_CLUSTER=m
-CONFIG_NETFILTER_XT_MATCH_COMMENT=m
-CONFIG_NETFILTER_XT_MATCH_CONNBYTES=m
-CONFIG_NETFILTER_XT_MATCH_CONNLABEL=m
-CONFIG_NETFILTER_XT_MATCH_CONNLIMIT=m
-CONFIG_NETFILTER_XT_MATCH_CONNMARK=m
-CONFIG_NETFILTER_XT_MATCH_CONNTRACK=m
-CONFIG_NETFILTER_XT_MATCH_CPU=m
-CONFIG_NETFILTER_XT_MATCH_DCCP=m
-CONFIG_NETFILTER_XT_MATCH_DEVGROUP=m
-CONFIG_NETFILTER_XT_MATCH_DSCP=m
-CONFIG_NETFILTER_XT_MATCH_ESP=m
-CONFIG_NETFILTER_XT_MATCH_HASHLIMIT=m
-CONFIG_NETFILTER_XT_MATCH_HELPER=m
-CONFIG_NETFILTER_XT_MATCH_IPCOMP=m
-CONFIG_NETFILTER_XT_MATCH_IPRANGE=m
-CONFIG_NETFILTER_XT_MATCH_IPVS=m
-CONFIG_NETFILTER_XT_MATCH_LENGTH=m
-CONFIG_NETFILTER_XT_MATCH_LIMIT=m
-CONFIG_NETFILTER_XT_MATCH_MAC=m
-CONFIG_NETFILTER_XT_MATCH_MARK=m
-CONFIG_NETFILTER_XT_MATCH_MULTIPORT=m
-CONFIG_NETFILTER_XT_MATCH_NFACCT=m
-CONFIG_NETFILTER_XT_MATCH_OSF=m
-CONFIG_NETFILTER_XT_MATCH_OWNER=m
-CONFIG_NETFILTER_XT_MATCH_POLICY=m
-CONFIG_NETFILTER_XT_MATCH_PKTTYPE=m
-CONFIG_NETFILTER_XT_MATCH_QUOTA=m
-CONFIG_NETFILTER_XT_MATCH_RATEEST=m
-CONFIG_NETFILTER_XT_MATCH_REALM=m
-CONFIG_NETFILTER_XT_MATCH_SOCKET=m
-CONFIG_NETFILTER_XT_MATCH_STATE=m
-CONFIG_NETFILTER_XT_MATCH_STATISTIC=m
-CONFIG_NETFILTER_XT_MATCH_STRING=m
-CONFIG_NETFILTER_XT_MATCH_TCPMSS=m
-CONFIG_NETFILTER_XT_MATCH_TIME=m
-CONFIG_NETFILTER_XT_MATCH_U32=m
-CONFIG_IP_SET=m
-CONFIG_IP_VS=m
-CONFIG_IP_VS_IPV6=y
-CONFIG_IP_VS_PROTO_TCP=y
-CONFIG_IP_VS_PROTO_UDP=y
-CONFIG_IP_VS_PROTO_ESP=y
-CONFIG_IP_VS_PROTO_AH=y
-CONFIG_IP_VS_PROTO_SCTP=y
-CONFIG_IP_VS_RR=m
-CONFIG_IP_VS_WRR=m
-CONFIG_IP_VS_NFCT=y
-CONFIG_NF_TABLES_IPV4=y
-CONFIG_NFT_DUP_IPV4=m
-CONFIG_NFT_FIB_IPV4=m
-CONFIG_NF_TABLES_ARP=y
-CONFIG_IP_NF_IPTABLES=m
-CONFIG_IP_NF_MATCH_AH=m
-CONFIG_IP_NF_MATCH_ECN=m
-CONFIG_IP_NF_MATCH_RPFILTER=m
-CONFIG_IP_NF_MATCH_TTL=m
-CONFIG_IP_NF_FILTER=m
-CONFIG_IP_NF_TARGET_REJECT=m
-CONFIG_IP_NF_TARGET_SYNPROXY=m
-CONFIG_IP_NF_NAT=m
-CONFIG_IP_NF_TARGET_MASQUERADE=m
-CONFIG_IP_NF_TARGET_NETMAP=m
-CONFIG_IP_NF_TARGET_REDIRECT=m
-CONFIG_IP_NF_MANGLE=m
-CONFIG_IP_NF_TARGET_ECN=m
-CONFIG_IP_NF_TARGET_TTL=m
-CONFIG_IP_NF_RAW=m
-CONFIG_IP_NF_SECURITY=m
-CONFIG_IP_NF_ARPTABLES=m
-CONFIG_IP_NF_ARPFILTER=m
-CONFIG_IP_NF_ARP_MANGLE=m
-CONFIG_NF_TABLES_IPV6=y
-CONFIG_NFT_DUP_IPV6=m
-CONFIG_NFT_FIB_IPV6=m
-CONFIG_IP6_NF_IPTABLES=y
-CONFIG_IP6_NF_MATCH_AH=m
-CONFIG_IP6_NF_MATCH_EUI64=m
-CONFIG_IP6_NF_MATCH_FRAG=m
-CONFIG_IP6_NF_MATCH_OPTS=m
-CONFIG_IP6_NF_MATCH_IPV6HEADER=m
-CONFIG_IP6_NF_MATCH_MH=m
-CONFIG_IP6_NF_MATCH_RPFILTER=m
-CONFIG_IP6_NF_MATCH_RT=m
-CONFIG_IP6_NF_MATCH_SRH=m
				`@ -0,0 +1 @@`
				`runtime-endpoint: unix:///run/containerd/containerd.sock`