refactor(images): compose AZL4 images from hierarchical KIWI profiles - #18530
Conversation
There was a problem hiding this comment.
Pull request overview
Introduces a shared KIWI hierarchy for Azure Linux 4 image profiles.
Changes:
- Centralizes profile inheritance, configuration, repositories, and packages.
- Registers 22 image profiles against one KIWI entry point.
- Adds hierarchy documentation and an interactive HTML viewer.
Reviewed changes
Copilot reviewed 9 out of 9 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
base/images/AzureLinux.kiwi |
Adds shared KIWI entry point. |
base/images/images.toml |
Registers images against shared profiles. |
base/images/profiles/profiles.xml |
Defines profile inheritance. |
base/images/profiles/config.xml |
Defines profile-specific image settings. |
base/images/profiles/packages.xml |
Defines shared package groups. |
base/images/README.md |
Documents hierarchy composition. |
base/images/image-profile-matrix.md |
Maps images to profiles. |
base/images/profile-package-tables.md |
Documents package membership. |
base/images/image-hierarchy.html |
Adds interactive hierarchy viewer. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 17 out of 17 changed files in this pull request and generated 3 comments.
Suppressed comments (2)
base/images/teams/installer.xml:48
- The shared installer package block drops all seven
<file>declarations from the existing definition. As a result, the image lacks its network config, Anaconda config/launcher, kickstarts, and post-install scripts; the installer hook also expects/usr/local/bin/anaconda-launcher.sh. Restore these declarations using paths relative to the new shared description directory.
<package name="vim-minimal" />
</packages>
base/images/repositories/core.xml:7
- These profiles use PMC beta as their local build-time source, contrary to the registry comment and the established image definitions, which use azl4-dev locally and rely on Koji to override the repository (for example
base/images/vm-base/vm-base.kiwi:82-92andbase/images/container-base/container-base.kiwi:110-120). Local 1P/Marketplace builds would therefore consume older published packages rather than the current development set.
<repository type="rpm-md" alias="azurelinux-base" profiles="1p-vm-base-gen1,1p-vm-base-gen1-fips,1p-vm-base-gen2-fips,marketplace-gen2,marketplace-gen2-cvm,marketplace-gen2-fips">
<source path="https://packages.microsoft.com/azurelinux/4.0/beta/base/$basearch" />
Dan Streetman (ddstreetmicrosoft)
left a comment
Dan Streetman (ddstreetmicrosoft)
left a comment
There was a problem hiding this comment.
I left several review notes, and stopped before reviewing all of it since I think I'll need to re-review after some changes.
In addition to the review notes, I'm not clear on the specific image types getting built. It seems like you are creating marketplace images only for gen2? And then creating 1p images only for gen1? But that's not at all correct, both 1p and 3p images should be available for gen1 and gen2, unless I am completely misunderstanding things?
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 17 out of 17 changed files in this pull request and generated 2 comments.
Suppressed comments (5)
base/images/AzureLinux.kiwi:17
- Because this shared file is now the primary KIWI description, KIWI only auto-discovers sidecar hooks beside
base/images/AzureLinux.kiwi. The existing hooks remain atcontainer-base/config.shandvm-iso-installer/config.sh; XML includes do not import them. Consequently the distroless profiles no longer strip the package manager/RPM database, and the installer no longer creates its offline repository or kickstarts. Add a root hook that dispatches these profile-specific steps (or retain family entry points).
<include from="this://./teams/installer.xml" />
<include from="this://./teams/wsl.xml" />
<include from="this://./teams/container.xml" />
base/images/teams/installer.xml:22
- This relative template is now resolved from the shared description directory (
base/images), but the file exists only atbase/images/vm-iso-installer/grub_template.cfg. Point to that location so the installer build can load its GRUB template.
<bootloader name="grub2" timeout="5" grub_template="grub_template.cfg" />
base/images/images.toml:7
- The registry rewrite removes the
vm-base-dev,container-base-dev,wsl-dev, andvm-iso-installer-devimages without updating consumers. In particular,scripts/build-vm-images.sh:12andscripts/demo-build.sh:27still invoke removed names, and this also eliminates the supported way to produce images carryingazurelinux-repos-dev. Retain equivalent dev leaf profiles/entries or update those workflows deliberately.
# Every image selects one leaf profile from the shared AzureLinux.kiwi
# hierarchy. Images with runtime package management ship azurelinux-repos.
# Distroless images intentionally omit repository packages.
base/images/image-hierarchy.html:233
- The first cell in each body row is the row label (for example, a profile name), but it is exposed as an ordinary data cell. Screen readers therefore cannot associate that label with the remaining cells. Mark the first cell as a row header (or render it as
<th scope="row">).
const td = tr.insertCell();
const value = row[column] || "";
appendInline(td, value);
if (value === "X") td.className = "selected";
base/images/images.toml:17
- This switches every existing image to a new build definition, so schema/profile resolution alone does not satisfy the repository's mandatory image validation: it does not execute hooks, create artifacts, or verify boot/runtime behavior. Build and run the configured test suites for the affected images before merging; the PR description explicitly says no full image builds were run.
definition = { type = "kiwi", path = "AzureLinux.kiwi", profile = "vm-base" }
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 24 out of 33 changed files in this pull request and generated 1 comment.
Suppressed comments (1)
base/images/images.toml:33
- Removing the
-devregistrations leaves repository callers broken:scripts/build-vm-images.sh:12still buildsvm-base-dev, whilescripts/demo-build.sh:27-31builds and loadscontainer-base-dev;scripts/common.sh:31also hard-codes the former output path. Those commands now fail because the image names no longer exist. Update these callers in this PR or retain compatible registry entries.
[images.container-base]
binujp
changed the title
binujp
changed the title
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 24 out of 33 changed files in this pull request and generated 1 comment.
Suppressed comments (1)
base/images/images.toml:7
- The new registry removes the existing
vm-base-dev,container-base-dev,wsl-dev, andvm-iso-installer-devimage IDs rather than registering all existing images as the summary states. Existingazldev image build <name>-devautomation will now fail and there is no profile that preserves the dev runtime-repository behavior; retain compatibility entries/profiles or document this breaking migration explicitly.
# Every image selects one leaf profile from the shared AzureLinux.kiwi
# hierarchy. Images with runtime package management ship azurelinux-repos.
# Distroless images intentionally omit repository packages.
| <?xml version="1.0" encoding="utf-8"?> | ||
| <image> | ||
| <repository type="rpm-md" alias="azurelinux-base"> | ||
| <source path="https://packages.microsoft.com/azurelinux/4.0/beta/base/$basearch" /> |
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 24 out of 33 changed files in this pull request and generated 1 comment.
Suppressed comments (1)
Previously missed (1) — in code that hasn't changed since the last review.
scripts/build-vm-images.sh:8
- The glob is inside the quotes, so the shell treats
*literally and this cleanup silently leaves the previousvm-basework tree in place. Quote only the directory prefix so each stale entry is removed before rebuilding.
| <keytable>us</keytable> | ||
| <timezone>UTC</timezone> | ||
| <release-version>4.0</release-version> | ||
| <type image="iso" flags="dmsquash" filesystem="ext4" kernelcmdline="console=ttyAMA0,115200 console=tty0 enforcing=0 audit=0 inst.text inst.lang=en_US.UTF-8 inst.nokill" firmware="uefi" hybridpersistent="false" mediacheck="true"> |
ca992e0 to
3189de3
Compare
a942132 to
705d466
Compare
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 23 out of 24 changed files in this pull request and generated 1 comment.
Suppressed comments (2)
distro/azurelinux.distro.toml:35
kiwi-config-overrideis absent fromDistroVersionDefinition, whose schema rejects additional properties (external/schemas/azldev.schema.json:513-556). This Stage 2 entry will fail the repository's strictazldev config dumpvalidation until the pinned azldev/schema supports it.
kiwi-config-override = "kiwi/azl4/stage2/azurelinux-4.0-kiwi-override.yml"
distro/azurelinux.distro.toml:53
- The authoritative schema does not allow
kiwi-config-overrideon a distro version (external/schemas/azldev.schema.json:513-556hasadditionalProperties: false). Consequently this production Stage 2 field is rejected by strict config validation; update the pinned azldev/schema before adding it.
kiwi-config-override = "kiwi/azl4/stage2-prod/azurelinux-4.0-kiwi-override.yml"
| release-ver = "4.0" | ||
| mock-config-x86_64 = "mock/azl4/stage1/azurelinux-4.0-x86_64.cfg" | ||
| mock-config-aarch64 = "mock/azl4/stage1/azurelinux-4.0-aarch64.cfg" | ||
| kiwi-config-override = "kiwi/azl4/stage1/azurelinux-4.0-kiwi-override.yml" |
705d466 to
ffb552a
Compare
There was a problem hiding this comment.
🟡 Changes recommended
The promised Marketplace CVM profile is absent, and FIPS images omit their new capability declaration.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Review details
Suppressed comments (2)
base/images/images.toml:200
- This image selects the
Fipsprofile andlisa-fips, but its capability set omitsfips-enabled. Capability-filtered tests and validation services receive only capabilities declared true, so they will not recognize this as a FIPS target. Declarefips-enabled = true.
[images.marketplace-gen2-fips.capabilities]
machine-bootable = true
container = false
systemd = true
runtime-package-management = true
base/images/images.toml:163
- This image selects the
Fipsprofile andlisa-fips, but its capability set omitsfips-enabled. Capability-filtered tests and validation services receive only capabilities declared true, so they will not recognize this as a FIPS target. Declarefips-enabled = true.
[images.1p-vm-base-gen2-fips.capabilities]
machine-bootable = true
container = false
systemd = true
runtime-package-management = true
- Files reviewed: 38/39 changed files
- Comments generated: 2
- Review effort level: Balanced
ffb552a to
f5a4fca
Compare
There was a problem hiding this comment.
🟡 Changes recommended
Capability metadata, LISA test registration, and generated schema validation have unresolved correctness issues.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Review details
Suppressed comments (1)
base/images/images.toml:118
- These legacy LISA suites have no
[test-suites.<name>.lisa]configuration. In the pinned azldev,RunLisaSuitereturns an error for such a suite, so the defaultazldev image testcommand will fail for every newly registered VM image after running the pytest suite. Supply framework/test-case configuration, or register these as metadata-only tests through the mechanism expected by the external orchestrator rather than as runnable legacy suites.
{ name = "lisa-main" },
{ name = "lisa-xfs" },
{ name = "lisa-perf" },
{ name = "lisa-smoke" },
{ name = "lisa-kernel-ltp" },
- Files reviewed: 38/39 changed files
- Comments generated: 3
- Review effort level: Balanced
| [images.wsl] | ||
| description = "WSL Image" | ||
| definition = { type = "kiwi", path = "wsl/wsl.kiwi", profile = "wsl" } | ||
| definition = { type = "kiwi", path = "AzureLinux.kiwi", profile = "wsl" } |
| "installer-media": { | ||
| "type": "boolean", | ||
| "title": "Installer media", | ||
| "description": "Whether the image is installer media that installs another OS rather than a directly runnable end-state image" |
| }, | ||
| "type": "object", | ||
| "required": [ | ||
| "name" | ||
| ] |
|
/azp run |
|
Azure Pipelines: 2 pipeline(s) were filtered out due to trigger conditions. |
Christopher Co (christopherco)
left a comment
Christopher Co (christopherco)
left a comment
There was a problem hiding this comment.
Hierarchical profile changes and the specific 1P and 3P image output profiles LGTM.
I left one suggestion to merge in azldev 0.4.0 to get the kiwi config override in an official azldev release.
And I recall the plan is to follow up this PR with a small change to rename vm-base to 1p-vm-base-gen2?
| finalization workflow. | ||
|
|
||
| Generated by `azldev docs agent`; do not hand-edit. Generated for azldev version `v0.3.0`. | ||
| Generated by `azldev docs agent`; do not hand-edit. Generated for azldev version `v0.3.1-0.20260901161635-86bf3523c4f0`. |
There was a problem hiding this comment.
suggestion (non-blocking): Ideally, we should sequence the changes so azldev v0.4.0 release lands #18689 , and so we don't need these generated SKILL.md diffs from an unreleased version of azldev.
There was a problem hiding this comment.
Agreed. Just merged that PR, so this can be rebased on top of that -- and discard the temporary commit pinning.
There was a problem hiding this comment.
Let me do the rebase and address some other concerns. The addition of the override can be merged into the gen1 image addition commit.
That is correct, however I had not thought of that as a rename. It could very well be that since 1p-vm-base-gen1 and vm-base' resolved package lists are very close. |
Took a pass at what the rename would entail. We now have a VmBaseCore profile which will have to be folded into CloudCore or into a new profile. That is not a large refactor and can be put under "rename". I would rather not bring in those changes at this stage. |
Introduce reusable repository, package, and boot layers modeled after Fedora's shared KIWI image definitions. These primitives make adding and manipulating image profiles easier without duplicating complete definitions. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 62b1622c-d79a-4fb3-9d0c-f8ca5478a97c
Compose vm-base, container, WSL, and minimal-os images from the shared KIWI description while keeping the ISO installer standalone. Remove superseded family definitions and dispatch shared hooks from the description root. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 62b1622c-d79a-4fb3-9d0c-f8ca5478a97c
Add the planned Gen1, Gen1 FIPS, and Gen2 FIPS first-party images using shared package, boot, and cloud layers. Register their static and LISA test suites. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 62b1622c-d79a-4fb3-9d0c-f8ca5478a97c
Add Gen2, Gen2 confidential VM, and Gen2 FIPS Marketplace images using shared package, UEFI, FIPS, and cloud layers. Register their static and LISA test suites. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 62b1622c-d79a-4fb3-9d0c-f8ca5478a97c
Document the Fedora-inspired shared-description model, the standalone ISO installer exception, and image-family test conventions. Extend family matching so related profile variants share targeted tests. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 62b1622c-d79a-4fb3-9d0c-f8ca5478a97c
f5a4fca to
fa132a0
Compare
Dan Streetman (ddstreetmicrosoft)
left a comment
Dan Streetman (ddstreetmicrosoft)
left a comment
There was a problem hiding this comment.
Let's get this thing merged.
There was a problem hiding this comment.
🟡 Changes recommended
The KIWI guidance scope excludes the new XML, shell, and registry files, and the PR summary contains a stale installer-centralization claim.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Review details
Suppressed comments (1)
.github/instructions/kiwi.instructions.md:32
- The implementation now explicitly keeps the ISO installer and its payloads under
vm-iso-installer/, but the PR summary still claims that installer payloads were centralized at the shared description root. Please update the PR description so it reflects the final standalone-installer design.
The ISO installer remains a standalone description under
`base/images/vm-iso-installer/` because its distinct composition and workflow
do not fit naturally into the shared image hierarchy.
- Files reviewed: 23/24 changed files
- Comments generated: 1
- Review effort level: Balanced
| `AzureLinux.kiwi` includes reusable fragments from `repositories/`, | ||
| `components/`, and `teams/`. Includes remain flat in the root description; | ||
| profile requirements express inheritance between fragments. | ||
|
|
||
| Runtime repository selection is independent from image build inputs. Kiwi | ||
| `<repository>` entries provide packages during local builds, and koji overrides | ||
| them for distro builds. | ||
| Shared KIWI hook scripts and `<file>` sources live directly under |
|
/azp run |
|
Azure Pipelines: 2 pipeline(s) were filtered out due to trigger conditions. |
Summary
AzureLinux.kiwientry point for 8 AZL4 image profilesValidation
$ azldev image list