From 609b1ad2af1988f0ecb59ee94d104393e782dcf0 Mon Sep 17 00:00:00 2001 From: yuanhe Date: Sat, 11 Jul 2026 16:52:41 +0800 Subject: [PATCH] Fix arm64 sandbox image build: drop TARGETARCH default in runtime stage MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit sandbox-image-release.yml's (local, parsar-sandbox, ...) matrix leg failed on its first run after merge: /tmp/install-agents.sh: line 72: /usr/local/bin/claude: No such file or directory Root cause: infra/sandbox/Dockerfile's runtime stage declared `ARG TARGETARCH=amd64`. BuildKit auto-populates TARGETARCH per target platform for every node in a multi-platform build graph, but a hardcoded default on a re-declared ARG shadows that auto-injection instead of merely being a fallback — every platform, including the arm64 build graph node, silently resolved TARGETARCH=amd64. install-agents.sh then downloaded the x86_64 Claude Code binary and tried to run it on an aarch64 rootfs; the kernel can't find the ELF interpreter for a wrong-architecture binary, which surfaces as ENOENT rather than the more obvious "exec format error". Fix: bare `ARG TARGETARCH` (no default), matching the go-builder stage's existing correct pattern. Verified without a full slow QEMU-emulated build (this repro alone took over the CI job's whole ~5min budget): built two throwaway one-line Dockerfiles differing only in the ARG TARGETARCH declaration, each targeting --platform linux/arm64. `ARG TARGETARCH=amd64` printed "amd64" (reproducing the bug in isolation); bare `ARG TARGETARCH` printed "arm64" (confirms the fix). Co-Authored-By: Claude Sonnet 5 --- infra/sandbox/Dockerfile | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/infra/sandbox/Dockerfile b/infra/sandbox/Dockerfile index 6ffc1aa..44142cf 100644 --- a/infra/sandbox/Dockerfile +++ b/infra/sandbox/Dockerfile @@ -78,7 +78,15 @@ RUN CGO_ENABLED=0 GOOS=linux GOARCH=${TARGETARCH} GOFLAGS=-trimpath \ # Stage 2: runtime — the actual sandbox image. ############################################################################### FROM ${BASE_IMAGE} -ARG TARGETARCH=amd64 +# Bare, no default: BuildKit auto-populates this per target platform for +# every multi-platform build graph node. A hardcoded default here (we +# used to have =amd64, reasoning "e2b is amd64-only anyway") SHADOWS +# that auto-injection instead of just being a fallback — it silently +# forced every platform, including arm64 build graph nodes, to resolve +# TARGETARCH=amd64, downloading x86_64 CLI binaries onto an aarch64 +# rootfs (fails at exec time: "No such file or directory", the classic +# symptom of a missing ELF interpreter for the wrong architecture). +ARG TARGETARCH # --- Base tools --- # curl/ca-certificates for downloads, jq for JSON, git for repo ops,