From fd5d73f9b3500c43b10ec7a23b77fada18f1b5d8 Mon Sep 17 00:00:00 2001 From: CMGS Date: Fri, 11 Sep 2026 16:11:18 +0900 Subject: [PATCH 1/2] os-image: fetch apt over HTTPS in the base image archive.ubuntu.com and security.ubuntu.com stopped answering on port 80 from three networks at once (GCP us-east4 twice, a home ISP) while their HTTPS frontends kept serving; a guest running apt-get update against the default http:// sources then stalled 30 s per index and blew the DAX benchmark's budget. Every flavor inherits the base sources, and ca-certificates is already installed before the first apt-get. --- os-image/base/24.04/Dockerfile | 2 ++ 1 file changed, 2 insertions(+) diff --git a/os-image/base/24.04/Dockerfile b/os-image/base/24.04/Dockerfile index 0a49571..42ff632 100644 --- a/os-image/base/24.04/Dockerfile +++ b/os-image/base/24.04/Dockerfile @@ -19,6 +19,8 @@ ENV DEBIAN_FRONTEND=noninteractive ARG INPUTS_HASH= RUN --mount=type=secret,id=sandbox_install_agent \ + # [Apt] HTTPS mirrors: Canonical's port-80 frontends drop out at times; 443 stays up. + sed -i 's|http://|https://|g' /etc/apt/sources.list.d/ubuntu.sources && \ apt-get update && apt-get install -y --no-install-recommends \ systemd \ systemd-sysv \ From 5fa8a1317879ff32f4e0bbc0e75045c2c9623d02 Mon Sep 17 00:00:00 2001 From: CMGS Date: Fri, 11 Sep 2026 16:12:48 +0900 Subject: [PATCH 2/2] os-image: switch the apt sources after ca-certificates is installed The pristine ubuntu image has no CA bundle, so an https apt-get update before the first install fails; the build fetches over http and the shipped image carries https sources. --- os-image/base/24.04/Dockerfile | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/os-image/base/24.04/Dockerfile b/os-image/base/24.04/Dockerfile index 42ff632..1f9e626 100644 --- a/os-image/base/24.04/Dockerfile +++ b/os-image/base/24.04/Dockerfile @@ -19,8 +19,6 @@ ENV DEBIAN_FRONTEND=noninteractive ARG INPUTS_HASH= RUN --mount=type=secret,id=sandbox_install_agent \ - # [Apt] HTTPS mirrors: Canonical's port-80 frontends drop out at times; 443 stays up. - sed -i 's|http://|https://|g' /etc/apt/sources.list.d/ubuntu.sources && \ apt-get update && apt-get install -y --no-install-recommends \ systemd \ systemd-sysv \ @@ -82,7 +80,9 @@ RUN --mount=type=secret,id=sandbox_install_agent \ 'WantedBy=sysinit.target' \ > /etc/systemd/system/silkd.service && \ systemctl enable silkd.service && \ - rm -rf /var/lib/apt/lists/* + rm -rf /var/lib/apt/lists/* && \ + # [Apt] HTTPS mirrors for the shipped image: Canonical's port-80 frontends drop out at times; 443 stays up. + sed -i 's|http://|https://|g' /etc/apt/sources.list.d/ubuntu.sources COPY --from=boot /boot/ /boot/ COPY --chmod=0755 --from=silkd /silkd /usr/local/bin/silkd