[CI] Build GB10 ARM64 image with Gitea Actions #2

2026-07-30T09:39:43Z

karylab_agents commented

2026-07-30 09:39:43 +00:00

Summary

build the vLLM OpenAI image as linux/arm64 on the dedicated x86 Gitea runner
use QEMU and Docker Buildx so the GB10 nodes only need to pull the result
compile only the SM12x CUDA family target used by the working GB10 deployment
publish both an immutable gb10-<12-char-sha> tag and the moving latest tag
persist expensive BuildKit layers in a registry-backed buildcache tag
verify the published manifest after every successful build

Security model

The build runner controls the x86 host Docker socket and is therefore root-equivalent on that host. The workflow intentionally has no pull_request trigger and uses the dedicated vllm-x86-builder runner label. Only reviewed code pushed to karylab/gb10, or an authorized manual dispatch, can run it.

Required infrastructure

deploy the dedicated gitea/act_runner:2.0.0 Portainer stack on the x86 build host
register the runner with label vllm-x86-builder
create repository Actions secret REGISTRY_TOKEN from a PAT limited to write:package
Gitea repository Actions and Packages units must remain enabled

Published image:

git.karylab.com/karylab_agents/vllm-gb10:<tag>

Validation

actionlint 1.7.12: passed; the dedicated Gitea runner label was explicitly allowed
git diff --check: passed
full image build not run yet because the repository currently has no registered runner

AI assistance

Codex assisted with the workflow design and static validation. A human maintainer should review the runner security boundary, registry retention, and the first ARM64 build result.

## Summary - build the vLLM OpenAI image as `linux/arm64` on the dedicated x86 Gitea runner - use QEMU and Docker Buildx so the GB10 nodes only need to pull the result - compile only the SM12x CUDA family target used by the working GB10 deployment - publish both an immutable `gb10-<12-char-sha>` tag and the moving `latest` tag - persist expensive BuildKit layers in a registry-backed `buildcache` tag - verify the published manifest after every successful build ## Security model The build runner controls the x86 host Docker socket and is therefore root-equivalent on that host. The workflow intentionally has no `pull_request` trigger and uses the dedicated `vllm-x86-builder` runner label. Only reviewed code pushed to `karylab/gb10`, or an authorized manual dispatch, can run it. ## Required infrastructure - deploy the dedicated `gitea/act_runner:2.0.0` Portainer stack on the x86 build host - register the runner with label `vllm-x86-builder` - create repository Actions secret `REGISTRY_TOKEN` from a PAT limited to `write:package` - Gitea repository Actions and Packages units must remain enabled Published image: `git.karylab.com/karylab_agents/vllm-gb10:<tag>` ## Validation - `actionlint 1.7.12`: passed; the dedicated Gitea runner label was explicitly allowed - `git diff --check`: passed - full image build not run yet because the repository currently has no registered runner ## AI assistance Codex assisted with the workflow design and static validation. A human maintainer should review the runner security boundary, registry retention, and the first ARM64 build result.

karylab commented

2026-07-30 09:41:14 +00:00

發到karylab/gb10分支

karylab_agents changed target branch from main to karylab/gb10

2026-07-30 09:44:56 +00:00

karylab_agents added 2 commits 2026-07-30 09:44:56 +00:00

Add automated GB10 ARM64 image build

New PR Bot / update-description (pull_request_target) Successful in 2s

Details

New PR Bot / reminder-comment (pull_request_target) Failing after 2s

Details

e0539c7002

Target the GB10 integration branch 754cbfbd86

karylab merged commit 3f7fd53d20 into karylab/gb10

2026-07-30 09:46:02 +00:00

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Karylab-cklius/vllm#2

Allow edits from maintainers