michal/lab
1
0
Fork 0
Code Issues Pull Requests 3 Actions Packages Projects Releases Wiki Activity

bastion: serve full-driver iPXE for UEFI x86_64, replace stale PV binaries
Some checks failed
CI/CD / lint (push) Successful in 1m15s
Details
CI/CD / typecheck (push) Successful in 1m18s
Details
CI/CD / test (push) Successful in 2m20s
Details
CI/CD / build (push) Successful in 2m31s
Details
CI/CD / publish-rpm (push) Failing after 28s
Details
CI/CD / publish-deb (push) Successful in 26s
Details

Browse Source 
snponly.efi rides the firmware's NII/UNDI stack, and on some NICs that
stack cannot receive unicast frames: DHCP (broadcast) succeeds, then every
ARP reply is lost and the boot.ipxe HTTP fetch times out. Observed on
thebeast's onboard NIC 2026-10-19 -- tcpdump on labmaster showed it
answering every ARP request within microseconds while iPXE re-asked for
ten seconds and gave up. The full build probes native NIC drivers first
and falls back to snp/nii, so hardware that worked before is unaffected.

The data dir is a persistent volume, so copy-if-missing would have kept
serving the old snponly binary forever; image-shipped binaries now replace
on content change (copyIfChanged).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DceLLgGmyS7zTGLaLNjQBd
This commit is contained in:
Michal
2026-10-20 00:45:12 +01:00
parent bb0bca274c
commit cd36825ad4
2 changed files with 26 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
bastion/Dockerfile.bastion
View File

@@ -35,7 +35,7 @@ FROM --platform=$BUILDPLATFORM fedora:43 AS ipxe-builder
RUN dnf install -y git gcc make perl-interpreter xz-devel gcc-aarch64-linux-gnu && dnf clean all
RUN git clone --depth=1 https://github.com/ipxe/ipxe.git /tmp/ipxe
RUN cd /tmp/ipxe/src && make bin-x86_64-efi/snp.efi && \
RUN cd /tmp/ipxe/src && make bin-x86_64-efi/snp.efi bin-x86_64-efi/ipxe.efi && \
make CROSS_COMPILE=aarch64-linux-gnu- bin-arm64-efi/snp.efi
# ── Stage 2: Production runtime (Fedora -- needs dnsmasq) ───────
@@ -58,6 +58,15 @@ RUN dnf install -y \
# boot from CD-ROM/USB -- it requires PXE chainloading)
COPY --from=ipxe-builder /tmp/ipxe/src/bin-x86_64-efi/snp.efi /usr/share/ipxe/ipxe-snp-x86_64.efi
COPY --from=ipxe-builder /tmp/ipxe/src/bin-arm64-efi/snp.efi /usr/share/ipxe/arm64-efi/ipxe-snp.efi
# Full iPXE build (native NIC drivers + snp + nii fallback), served as the
# default UEFI x86_64 PXE binary. snponly rides the firmware's NII/UNDI stack,
# and on some NICs that stack cannot RECEIVE UNICAST frames: DHCP (broadcast)
# works, then every ARP reply is lost and HTTP times out. Observed on
# thebeast's onboard NIC 2026-10-19 (tcpdump: labmaster answered every ARP
# request within microseconds, iPXE kept re-asking). A native driver bypasses
# the firmware stack entirely; NICs without one still fall back to snp/nii,
# so machines that worked before are unaffected.
COPY --from=ipxe-builder /tmp/ipxe/src/bin-x86_64-efi/ipxe.efi /usr/share/ipxe/ipxe-full-x86_64.efi
# Install pnpm
RUN npm install -g pnpm@9