What
Firecracker binary is never present in the agent runtime, in either
delivery path:
- `Dockerfile.agent` builds only `/agent` (`cmd/agent`) + `/opt/imp/guest-agent`.
Never installs or copies a `firecracker` binary. Confirmed live: image
`ghcr.io/syscode-labs/imp-agent:v0.5.0`, `which firecracker` → not found.
- `charts/imp/templates/agent/daemonset.yaml` mounts `/dev/kvm` via hostPath
but has no hostPath mount for a firecracker binary on the host either.
No `FC_BIN` env set in the DaemonSet — relies entirely on
`exec.LookPath("firecracker")` (see `internal/agent/firecracker_driver.go`
`NewFirecrackerDriver`), which can never succeed as currently packaged.
Why it matters
- `NewFirecrackerDriver` fails to construct in real deployments (agent
`main.go` calls `os.Exit(1)` on this error) — agent can never actually run
microVMs today outside `IMP_STUB_DRIVER=true`.
- Confirmed on `unraid-lab` (real cluster, `/dev/kvm` present, verified
during `add-imp-kvm-install-preflight` validation): the new KVM install
preflight (`internal/capability`, `charts/imp/templates/agent/preflight-job.yaml`)
correctly fails the release because the binary genuinely isn't there — the
preflight is doing its job, this is the real underlying gap it exposed.
Where to fix
Pick one (or combine):
- Bake it into the image — add a build stage to `Dockerfile.agent` that
installs a firecracker release binary, matching the
`talos-ext-firecracker` version/architecture used elsewhere in the repo
chain (see repo memory: `imp-talos-repo-chain.md` for the
talos-ext-firecracker → imp-guest-kernel → talos-images → imp build order).
- hostPath mount from the Talos system extension — mirror the `dev-kvm`
hostPath pattern in `charts/imp/templates/agent/daemonset.yaml`, mount
wherever `talos-ext-firecracker` installs the binary on the node, and set
`FC_BIN` in the DaemonSet env to that path. Also wire the same mount +
`FC_BIN` into `charts/imp/templates/agent/preflight-job.yaml` so the
preflight probes the same path the agent will actually use.
Whichever path is chosen, `charts/imp/values.yaml` `agent.env` probably
needs a new field for the binary path/hostPath (parallel to
`agent.env.kernelPath`), and the KVM preflight Job should consume the same
value so it tests what production actually uses.
Repro
```
kubectl run fc-check --rm -i --restart=Never
--image=ghcr.io/syscode-labs/imp-agent:v0.5.0
--command -- sh -c "which firecracker || echo NO_FIRECRACKER_IN_IMAGE"
```
What
Firecracker binary is never present in the agent runtime, in either
delivery path:
Never installs or copies a `firecracker` binary. Confirmed live: image
`ghcr.io/syscode-labs/imp-agent:v0.5.0`, `which firecracker` → not found.
but has no hostPath mount for a firecracker binary on the host either.
No `FC_BIN` env set in the DaemonSet — relies entirely on
`exec.LookPath("firecracker")` (see `internal/agent/firecracker_driver.go`
`NewFirecrackerDriver`), which can never succeed as currently packaged.
Why it matters
`main.go` calls `os.Exit(1)` on this error) — agent can never actually run
microVMs today outside `IMP_STUB_DRIVER=true`.
during `add-imp-kvm-install-preflight` validation): the new KVM install
preflight (`internal/capability`, `charts/imp/templates/agent/preflight-job.yaml`)
correctly fails the release because the binary genuinely isn't there — the
preflight is doing its job, this is the real underlying gap it exposed.
Where to fix
Pick one (or combine):
installs a firecracker release binary, matching the
`talos-ext-firecracker` version/architecture used elsewhere in the repo
chain (see repo memory: `imp-talos-repo-chain.md` for the
talos-ext-firecracker → imp-guest-kernel → talos-images → imp build order).
hostPath pattern in `charts/imp/templates/agent/daemonset.yaml`, mount
wherever `talos-ext-firecracker` installs the binary on the node, and set
`FC_BIN` in the DaemonSet env to that path. Also wire the same mount +
`FC_BIN` into `charts/imp/templates/agent/preflight-job.yaml` so the
preflight probes the same path the agent will actually use.
Whichever path is chosen, `charts/imp/values.yaml` `agent.env` probably
needs a new field for the binary path/hostPath (parallel to
`agent.env.kernelPath`), and the KVM preflight Job should consume the same
value so it tests what production actually uses.
Repro
```
kubectl run fc-check --rm -i --restart=Never
--image=ghcr.io/syscode-labs/imp-agent:v0.5.0
--command -- sh -c "which firecracker || echo NO_FIRECRACKER_IN_IMAGE"
```