os.archlinuxarm.org has a TLS cert mismatch (cert SAN doesn't cover the
hostname). ALARM officially distributes over HTTP, not HTTPS.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Use libarchive-tools (bsdtar) instead of BusyBox tar to extract the
ALARM tarball; bsdtar correctly preserves the /bin → usr/bin symlink
that is part of ALARM's merged-usr filesystem layout
- Verify /usr/bin/bash exists after extraction so download failures are
caught loudly instead of producing a silent empty rootfs
- Add SHELL ["/usr/bin/bash", "-c"] in stage 2: Docker's default RUN
invocation looks up /bin/sh, which requires the symlink to be resolved
in the container init — using the absolute path bypasses that entirely
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Stage 1 (alpine/arm64) downloads the official Arch Linux ARM rootfs via
curl — Docker caches this layer so it only runs once. Stage 2 (scratch)
COPYs the extracted filesystem in, then builds OrionOS natively in that
ALARM environment.
Also fixes DisableSandbox placement (insert into [options] section via
sed, not appended to file end where it lands in [aur] and is ignored).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
menci/archlinuxarm:aarch64 doesn't exist on Docker Hub.
lopsided/archlinux is a maintained multi-arch image with native arm64 support.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
nmemmertandClaude Sonnet 4.6