Talos Firecracker Extension

This repo builds a Talos system extension that adds:

• firecracker
• jailer
• /usr/local/share/imp/vmlinux (Firecracker CI guest kernel, 6.1.155)

In plain terms: it gives a Talos node the Firecracker binaries so that higher-level systems can start lightweight microVMs.

What This Does

1. Downloads Firecracker release tarballs and the pinned Firecracker CI guest kernel for amd64 and arm64
2. Verifies all artifact checksums before installing them
3. Packages Firecracker, Jailer, and the Imp guest kernel into a Talos extension image
4. Publishes multi-arch images to GHCR on tagged releases
5. Signs the pushed image digest recursively with Cosign so Image Factory can verify it

How Release Flow Works

flowchart LR
  A[Push to main] --> B[CI: lint + build]
  B --> C[Release Please opens/updates PR]
  C --> D[You review and merge release PR]
  D --> E[Tag created]
  E --> F[Publish workflow]
  F --> G[GHCR image + Cosign signature + GitHub Release]

Loading

Release Secrets

The publish workflow needs these repository secrets:

• COSIGN_PRIVATE_KEY: private key from cosign generate-key-pair
• COSIGN_PASSWORD: password for the private key, or empty string if generated without one
• TALOS_IMAGES_DISPATCH_TOKEN: existing token used to trigger talos-images

Mount the matching cosign.pub into Image Factory as OMNI_IMAGE_FACTORY_COSIGN_PUBLIC_KEY_FILE.

When rotating COSIGN_PRIVATE_KEY, rotate the Image Factory public key in the same change and retire all previously published GHCR tags before releasing the next version. This prevents the factory from accepting artifacts signed by the retired key.

Quick Start

Use With Imp

The Imp Helm chart must mount the kernel installed by this extension:

agent:
  env:
    kernelPath: /usr/local/share/imp/vmlinux

This path is Talos-specific. Local and Kind-based Imp tests provision their own kernel at /var/lib/imp/vmlinux and should retain that configuration.

Build locally:

docker buildx build --platform linux/amd64,linux/arm64 -t talos-ext-firecracker:test .

Run local checks:

./hack/verify.sh
pre-commit run --all-files

Install git hooks:

pre-commit install
pre-commit install --hook-type commit-msg

Key Files

• Dockerfile: downloads, verifies, and installs Firecracker, Jailer, and the pinned Imp guest kernel
• manifest.yaml: Talos extension metadata
• hack/verify.sh: validates artifact pins and installed paths
• .github/workflows/ci.yml: lint/build checks
• .github/workflows/release-please.yml: automated release PRs
• .github/workflows/release.yml: publish on tags

Links

• Talos extensions docs: https://www.talos.dev/latest/talos-guides/configuration/system-extensions/
• Firecracker docs: https://firecracker-microvm.github.io/
• Container image: https://ghcr.io/syscode-labs/talos-ext-firecracker