Building with additional extensions?

[mchaker]

Hi, how does one add extensions besides gvisor to this image?

I tried building with the commands from the README but got stuck on the "make ... installer" step with some Make errors referring to number of arguments (number of EXTENSIONS container images I added?):

make EXTENSIONS="ghcr.io/siderolabs/gvisor:20250505.0@sha256:d7503b59603f030b972ceb29e5e86979e6c889be1596e87642291fee48ce380c ghcr.io/siderolabs/util-linux-tools:2.41.1 ghcr.io/siderolabs/iscsi-tools:v0.2.0" REGISTRY="my-local-registry" REGISTRY_USERNAME="my_user" installer

...

for platform in linux/arm64; do \
        arch=$(basename "${platform}") && \
        docker run --rm -t -v /dev:/dev -v /Users/mahdi/github/talos-rpi5/talos-builder/checkouts/talos/_out:/secureboot:ro -v /Users/mahdi/github/talos-rpi5/talos-builder/checkouts/talos/_out:/out -e SOURCE_DATE_EPOCH=1757825627 --network=host --privileged my-local-registry/my_user/imager:v1.10.7-1-g9377e46e0 installer --arch $arch --base-installer-image my-local-registry/my_user/installer-base:v1.10.7-1-g9377e46e0 --base-installer-image my-local-registry/my_user/installer-base:v1.10.7-1-g9377e46e0 --overlay-name=rpi5 --overlay-image=my-local-registry/my_user/sbc-raspberrypi5:7d04484-v1.10.0-1-ge21c9f2 --system-extension-image=ghcr.io/siderolabs/gvisor:20250505.0@sha256:d7503b59603f030b972ceb29e5e86979e6c889be1596e87642291fee48ce380c ghcr.io/siderolabs/util-linux-tools:2.41.1 ghcr.io/siderolabs/iscsi-tools:v0.2.0 ; \
done
Live child 0x6000015142a0 (image-installer) PID 78016
Error: accepts 1 arg(s), received 3

...

Do I need to wrap the extension image string in single quotes? Do I need to use commas/is there a specific separator character I should use?

Thanks :)

[mchaker]

And trying to run this command:

make EXTENSIONS="ghcr.io/siderolabs/gvisor:20250505.0@sha256:d7503b59603f030b972ceb29e5e86979e6c889be1596e87642291fee48ce380c,ghcr.io/siderolabs/util-linux-tools:2.41.1,ghcr.io/siderolabs/iscsi-tools:v0.2.0" REGISTRY_USERNAME="mchaker" installer

results in this error (how do I pass in a github token/password to the nested docker push step?)

make[3]: Leaving directory '/Users/mahdi/github/talos-rpi5/talos-builder/checkouts/talos'
make[2]: Leaving directory '/Users/mahdi/github/talos-rpi5/talos-builder/checkouts/talos'
make[2]: Entering directory '/Users/mahdi/github/talos-rpi5/talos-builder/checkouts/talos'
v1.10.7-1-g9377e46e0: Pulling from mchaker/imager
Digest: sha256:2db8965c133a33c9c3dd5a9ae1929bd944e140cf09b359eb8a384fe31b207875
Status: Image is up to date for ghcr.io/mchaker/imager:v1.10.7-1-g9377e46e0
ghcr.io/mchaker/imager:v1.10.7-1-g9377e46e0

◲ error pulling image ghcr.io/mchaker/sbc-raspberrypi5:7d04484-v1.10.0-1-ge21c9f2: GET https://ghcr.io/token?scope=repository%3Amchaker%2Fsbc-raspberrypi5%3Apull&service=ghcr.io: UNAUTHORIZED: authentication required
Error: error pulling image ghcr.io/mchaker/sbc-raspberrypi5:7d04484-v1.10.0-1-ge21c9f2: GET https://ghcr.io/token?scope=repository%3Amchaker%2Fsbc-raspberrypi5%3Apull&service=ghcr.io: UNAUTHORIZED: authentication required

make[2]: *** [Makefile:455: image-installer] Error 1
make[2]: Leaving directory '/Users/mahdi/github/talos-rpi5/talos-builder/checkouts/talos'
make[1]: *** [Makefile:476: installer] Error 2
make[1]: Leaving directory '/Users/mahdi/github/talos-rpi5/talos-builder/checkouts/talos'
make: *** [Makefile:104: installer] Error 2

[mchaker]

Trying to run this:

make EXTENSIONS="ghcr.io/siderolabs/gvisor:20250505.0@sha256:d7503b59603f030b972ceb29e5e86979e6c889be1596e87642291fee48ce380c ghcr.io/siderolabs/util-linux-tools:2.41.1 ghcr.io/siderolabs/iscsi-tools:v0.2.0" REGISTRY_USERNAME="mchaker" installer

Results in this:

...

make[3]: Leaving directory '/Users/mahdi/github/talos-rpi5/talos-builder/checkouts/talos'
make[2]: Leaving directory '/Users/mahdi/github/talos-rpi5/talos-builder/checkouts/talos'
make[2]: Entering directory '/Users/mahdi/github/talos-rpi5/talos-builder/checkouts/talos'
v1.10.7-1-g9377e46e0: Pulling from mchaker/imager
Digest: sha256:85d637027365b5943e0e5a1708651c3d550c573f69260f391146446932b95fca
Status: Image is up to date for ghcr.io/mchaker/imager:v1.10.7-1-g9377e46e0
ghcr.io/mchaker/imager:v1.10.7-1-g9377e46e0
Error: accepts 1 arg(s), received 3
make[2]: *** [Makefile:455: image-installer] Error 1
make[2]: Leaving directory '/Users/mahdi/github/talos-rpi5/talos-builder/checkouts/talos'
make[1]: *** [Makefile:476: installer] Error 2
make[1]: Leaving directory '/Users/mahdi/github/talos-rpi5/talos-builder/checkouts/talos'
make: *** [Makefile:104: installer] Error 2

[mchaker]

Feature request

I ended up modifying the Makefile in this repo to list out each --system-extension-image= flag in the IMAGER_ARGS and docker command in the installer target in the Makefile.

Would it be possible to add support for multiple system-extension-image values? :)

[JimFawkes]

Hi @mchaker,

I have the same issue and would like to add a few more extensions. Did you solve the issue with your modifications to the Makefile? If so, could you share them here?

[mchaker]

Sure thing - here are my modifications to the Makefile in this repo, to get longhorn working:

diff --git a/Makefile b/Makefile
index bebde78..1ef9012 100644
--- a/Makefile
+++ b/Makefile
@@ -105,7 +105,7 @@ installer:
                        REGISTRY=$(REGISTRY) USERNAME=$(REGISTRY_USERNAME) PUSH=true \
                        PKG_KERNEL=$(REGISTRY)/$(REGISTRY_USERNAME)/kernel:$(PKGS_TAG) \
                        INSTALLER_ARCH=arm64 PLATFORM=linux/arm64 \
-                       IMAGER_ARGS="--overlay-name=rpi5 --overlay-image=$(REGISTRY)/$(REGISTRY_USERNAME)/sbc-raspberrypi5:$(SBCOVERLAY_TAG) --system-extension-image=$(EXTENSIONS)" \
+                       IMAGER_ARGS="--overlay-name=rpi5 --overlay-image=$(REGISTRY)/$(REGISTRY_USERNAME)/sbc-raspberrypi5:$(SBCOVERLAY_TAG) --system-extension-image ghcr.io/siderolabs/gvisor:20250505.0@sha256:d7503b59603f030b972ceb29e5e86979e6c889be1596e87642291fee48ce380c --system-extension-image ghcr.io/siderolabs/util-linux-tools:2.41.1 --system-extension-image ghcr.io/siderolabs/iscsi-tools:v0.2.0" \
                        kernel initramfs imager installer-base installer && \
                docker \
                        run --rm -t -v ./_out:/out -v /dev:/dev --privileged $(REGISTRY)/$(REGISTRY_USERNAME)/imager:$(TALOS_TAG) \
@@ -113,7 +113,9 @@ installer:
                        --base-installer-image="$(REGISTRY)/$(REGISTRY_USERNAME)/installer:$(TALOS_TAG)" \
                        --overlay-name="rpi5" \
                        --overlay-image="$(REGISTRY)/$(REGISTRY_USERNAME)/sbc-raspberrypi5:$(SBCOVERLAY_TAG)" \
-                       --system-extension-image="$(EXTENSIONS)"
+                       --system-extension-image="ghcr.io/siderolabs/gvisor:20250505.0@sha256:d7503b59603f030b972ceb29e5e86979e6c889be1596e87642291fee48ce380c" \
+                       --system-extension-image="ghcr.io/siderolabs/util-linux-tools:2.41.1" \
+                       --system-extension-image="ghcr.io/siderolabs/iscsi-tools:v0.2.0"

[Sethcran]

@mchaker Any chance you have or can make the built image available anywhere? Currently trying to build it, but running into the other issue with building on an amd64 architecture since most of my machines are amd64 instead of arm64.

[mchaker]

@Sethcran Of course! I think this is the version that worked for me:
https://github.com/users/mchaker/packages/container/installer/514778156?tag=v1.10.7-rpi5

[harryprayiv]

I am trying to build an image that has all of the required elements but I am getting stuck on the kernel build.

Here's how I modified my makefile:

TALOS_VERSION = v1.11.3
SBCOVERLAY_VERSION = main

REGISTRY ?= ghcr.io
REGISTRY_USERNAME ?= talos-rpi5

TAG ?= $(shell git describe --tags --exact-match)

EXTENSIONS ?= ghcr.io/siderolabs/gvisor:20250707.0@sha256:166ad280967f67b743337533efe38d87239f722637382fcf6d88b908bbbfee67

PKG_REPOSITORY = https://github.com/siderolabs/pkgs.git
TALOS_REPOSITORY = https://github.com/siderolabs/talos.git
SBCOVERLAY_REPOSITORY = https://github.com/talos-rpi5/sbc-raspberrypi5.git

CHECKOUTS_DIRECTORY := $(PWD)/checkouts
PATCHES_DIRECTORY := $(PWD)/patches

PKGS_TAG = $(shell cd $(CHECKOUTS_DIRECTORY)/pkgs && git describe --tag --always --dirty --match v[0-9]\*)
TALOS_TAG = $(shell cd $(CHECKOUTS_DIRECTORY)/talos && git describe --tag --always --dirty --match v[0-9]\*)
SBCOVERLAY_TAG = $(shell cd $(CHECKOUTS_DIRECTORY)/sbc-raspberrypi5 && git describe --tag --always --dirty)-$(PKGS_TAG)

#
# Help
#
.PHONY: help
help:
	@echo "checkouts : Clone repositories required for the build"
	@echo "patches   : Apply all patches"
	@echo "kernel    : Build kernel"
	@echo "overlay   : Build Raspberry Pi 5 overlay"
	@echo "installer : Build installer docker image and disk image"
	@echo "release   : Use only when building the final release, this will tag relevant images with the current Git tag."
	@echo "clean     : Clean up any remains"



#
# Checkouts
#
.PHONY: checkouts checkouts-clean
checkouts:
	git clone -c advice.detachedHead=false --branch "$(PKG_VERSION)" "$(PKG_REPOSITORY)" "$(CHECKOUTS_DIRECTORY)/pkgs"
	git clone -c advice.detachedHead=false --branch "$(TALOS_VERSION)" "$(TALOS_REPOSITORY)" "$(CHECKOUTS_DIRECTORY)/talos"
	git clone -c advice.detachedHead=false --branch "$(SBCOVERLAY_VERSION)" "$(SBCOVERLAY_REPOSITORY)" "$(CHECKOUTS_DIRECTORY)/sbc-raspberrypi5"

checkouts-clean:
	rm -rf "$(CHECKOUTS_DIRECTORY)/pkgs"
	rm -rf "$(CHECKOUTS_DIRECTORY)/talos"
	rm -rf "$(CHECKOUTS_DIRECTORY)/sbc-raspberrypi5"



#
# Patches
#
.PHONY: patches-pkgs patches-talos patches
patches-pkgs:
	cd "$(CHECKOUTS_DIRECTORY)/pkgs" && \
		git am "$(PATCHES_DIRECTORY)/siderolabs/pkgs/0001-Patched-for-Raspberry-Pi-5.patch"

patches-talos:
	cd "$(CHECKOUTS_DIRECTORY)/talos" && \
		git am "$(PATCHES_DIRECTORY)/siderolabs/talos/0001-Patched-for-Raspberry-Pi-5.patch"

patches: patches-pkgs patches-talos



#
# Kernel
#
.PHONY: kernel
kernel:
	cd "$(CHECKOUTS_DIRECTORY)/pkgs" && \
		$(MAKE) \
			REGISTRY=$(REGISTRY) USERNAME=$(REGISTRY_USERNAME) PUSH=true \
			PLATFORM=linux/arm64 \
			kernel



#
# Overlay
#
.PHONY: overlay
overlay:
	@echo SBCOVERLAY_TAG = $(SBCOVERLAY_TAG)
	cd "$(CHECKOUTS_DIRECTORY)/sbc-raspberrypi5" && \
		$(MAKE) \
			REGISTRY=$(REGISTRY) USERNAME=$(REGISTRY_USERNAME) IMAGE_TAG=$(SBCOVERLAY_TAG) PUSH=true \
			PKGS_PREFIX=$(REGISTRY)/$(REGISTRY_USERNAME) PKGS=$(PKGS_TAG) \
			INSTALLER_ARCH=arm64 PLATFORM=linux/arm64 \
			sbc-raspberrypi5



#
# Installer/Image
#
.PHONY: installer
installer:
	cd "$(CHECKOUTS_DIRECTORY)/talos" && \
		$(MAKE) \
			REGISTRY=$(REGISTRY) USERNAME=$(REGISTRY_USERNAME) PUSH=true \
			PKG_KERNEL=$(REGISTRY)/$(REGISTRY_USERNAME)/kernel:$(PKGS_TAG) \
			INSTALLER_ARCH=arm64 PLATFORM=linux/arm64 \
			IMAGER_ARGS="--overlay-name=rpi5 --overlay-image=$(REGISTRY)/$(REGISTRY_USERNAME)/sbc-raspberrypi5:$(SBCOVERLAY_TAG) --system-extension-image ghcr.io/siderolabs/gvisor:20250707.0@sha256:166ad280967f67b743337533efe38d87239f722637382fcf6d88b908bbbfee67 --system-extension-image ghcr.io/siderolabs/util-linux-tools:2.41.1@sha256:cbab76fa4c387a2e524bc665066e2ff5622f56b32e9927e33004e54bc24495c8 --system-extension-image ghcr.io/siderolabs/iscsi-tools:v0.2.0@sha256:418f42812e90f06f3080bb76afbb19b5d4c05c41e02586d9b08293a94e32bb89" \
			kernel initramfs imager installer-base installer && \
		docker \
			run --rm -t -v ./_out:/out -v /dev:/dev --privileged $(REGISTRY)/$(REGISTRY_USERNAME)/imager:$(TALOS_TAG) \
			metal --arch arm64 \
			--base-installer-image="$(REGISTRY)/$(REGISTRY_USERNAME)/installer:$(TALOS_TAG)" \
			--overlay-name="rpi5" \
			--overlay-image="$(REGISTRY)/$(REGISTRY_USERNAME)/sbc-raspberrypi5:$(SBCOVERLAY_TAG)" \
			--system-extension-image="ghcr.io/siderolabs/gvisor:20250707.0@sha256:166ad280967f67b743337533efe38d87239f722637382fcf6d88b908bbbfee67" \
            --system-extension-image="ghcr.io/siderolabs/util-linux-tools:2.41.1@sha256:cbab76fa4c387a2e524bc665066e2ff5622f56b32e9927e33004e54bc24495c8" \
            --system-extension-image="ghcr.io/siderolabs/iscsi-tools:v0.2.0@sha256:418f42812e90f06f3080bb76afbb19b5d4c05c41e02586d9b08293a94e32bb89"



#
# Release
#
.PHONY: release
release:
	docker pull $(REGISTRY)/$(REGISTRY_USERNAME)/installer:$(TALOS_TAG) && \
		docker tag $(REGISTRY)/$(REGISTRY_USERNAME)/installer:$(TALOS_TAG) $(REGISTRY)/$(REGISTRY_USERNAME)/installer:$(TAG) && \
		docker push $(REGISTRY)/$(REGISTRY_USERNAME)/installer:$(TAG)



#
# Clean
#
.PHONY: clean
clean: checkouts-clean

I am having issues on the part where I build the kernel. Here is the error message I get:

#45 pushing layers 0.1s done
#45 ERROR: failed to push ghcr.io/talos-rpi5/kernel:v1.11.0-1-g7e6e585: failed to authorize: failed to fetch anonymous token: unexpected status from GET request to https://ghcr.io/token?scope=repository%3Atalos-rpi5%2Fkernel%3Apull%2Cpush&service=ghcr.io: 403 Forbidden
------
 > exporting to image:
------
ERROR: failed to build: failed to solve: failed to fetch anonymous token: unexpected status from GET request to https://ghcr.io/token?scope=repository%3Atalos-rpi5%2Fkernel%3Apull%2Cpush&service=ghcr.io: 403 Forbidden
make[3]: *** [Makefile:173: target-kernel] Error 1
make[3]: Leaving directory '/home/bismuth/workdir/talos-builder/checkouts/pkgs'
make[2]: *** [Makefile:179: docker-kernel] Error 2
make[2]: Leaving directory '/home/bismuth/workdir/talos-builder/checkouts/pkgs'
make[1]: *** [Makefile:196: kernel] Error 2
make[1]: Leaving directory '/home/bismuth/workdir/talos-builder/checkouts/pkgs'
make: *** [Makefile:75: kernel] Error 2

Judging by the error message, I don't have permission to build an image(?). I am building this on NixOS with a flake provisioning all of the build software. So that could very well be introducing some issues I am not understanding.

I wonder if someone might share the latest 1.11.3 image with all of the extensions needed to use longhorn.

[ian-thompson-yv]

I have raised a PR to support multiple extensions in the Makefile PR #20

[swheettaos]

@ian-thompson-yv

FYI.. you created a PR #20 didn't answer the questions so it was never merged. I forked this repo .. and using your PR plus some more changes got it working.

I also updated the build workflow so you can just pass them there by adding them to the top of the build file and environment vars. It will auto look up the digest for you as part of the build so you just need to know the extension and version you want. Maybe not for everyone but I found this easier than doing the lookup myself with crane and then manually creating and environment var.

https://github.com/wheetazlab/talos-builder

I add how to use add extensions using the GHA workflow or local build to the Readme.md. Anyone is free to clone/fork and build your own or images.

You can use the images I built if you want:

https://github.com/wheetazlab/talos-builder/releases

****NOTE: The upgrage path doens't seem to work.. and from reseaching it, it looks like this is a bug in certain versions of 1.11.x but might be fixed in 1.11.6 but I may be wrong about this. I just know the upgrade on my systems didn't work.. I have to reflash the NVMe drive with the full image and reapply the configs.

It's got the following extensions already in the image:

iscsi-tools ghcr.io/siderolabs/iscsi-tools:v0.2.0
util-linux-tools ghcr.io/siderolabs/util-linux-tools:2.41.2

I've created my own PR PR#26

@ian-thompson-yv THANK YOU FOR ALL THE WORK UP FRONT .. I didn't have to change to much from your orginally PR.