rucoder · eriknordmark · Jul 28, 2026 · Jul 28, 2026 · Jul 28, 2026 · Jul 28, 2026
diff --git a/.spdxignore b/.spdxignore
@@ -7,6 +7,7 @@ pkg/installer/vendor/
 pkg/kube/descheduler-job.yaml
 pkg/kube/descheduler_rbac.yaml
 pkg/kube/eve-bridge/vendor/
+pkg/kube/kube-init/vendor/
 pkg/kube/lh-cfg-v1.6.2.yaml
 pkg/kube/nvidia-container-runtime/nvidia-device-plugin-18.0.yml
 pkg/kube/sriov/sriov-device-plugin.yaml

diff --git a/Makefile b/Makefile
@@ -18,7 +18,7 @@ uniq = $(if $1,$(firstword $1) $(call uniq,$(filter-out $(firstword $1),$1)))
 
 # you are not supposed to tweak these variables -- they are effectively R/O
 HV_DEFAULT=kvm
-GOVER ?= 1.25.11
+GOVER ?= 1.25.12
 PKGBASE=github.com/lf-edge/eve
 GOMODULE=$(PKGBASE)/pkg/pillar
 GOTREE=$(CURDIR)/pkg/pillar
@@ -307,7 +307,7 @@ QEMU_OPTS_NO_DISPLAY=-display none
 QEMU_OPTS_VGA_DISPLAY_amd64=-vga std
 QEMU_OPTS_VGA_DISPLAY_arm64=-device virtio-gpu-pci -usb -device usb-ehci,id=ehci -device usb-kbd,bus=ehci.0
 QEMU_OPTS_VGA_DISPLAY_riscv64=-vga std
-QEMU_OPTS_COMMON= -m $(QEMU_MEMORY) -smp 4  $(QEMU_OPTS_BIOS) \
+QEMU_OPTS_COMMON= -m $(QEMU_MEMORY) -smp 8  $(QEMU_OPTS_BIOS) \
         -pidfile $(QEMU_PID_FILE) \
         -serial mon:stdio      \
         -global ICH9-LPC.noreboot=false -watchdog-action reset \

diff --git a/build-tools/src/scripts/Dockerfile b/build-tools/src/scripts/Dockerfile
@@ -1,4 +1,4 @@
-ARG GOVER=1.25.11
+ARG GOVER=1.25.12
 # Pin the Alpine minor version to match eve-alpine (3.22) so this builder tracks
 # the same toolchain/libc as the real EVE build; the unpinned golang:*-alpine
 # tag floats to whatever Alpine is newest.

diff --git a/eve-tools/bpftrace-compiler/root/Dockerfile b/eve-tools/bpftrace-compiler/root/Dockerfile
@@ -5,9 +5,9 @@ ARG EVE_KERNEL
 # hadolint ignore=DL3006
 FROM ${EVE_KERNEL} AS kernel
 
-FROM lfedge/eve-bpftrace:44a21d005fa06c52d34e5f0e5073db3268d5e212 AS eve-bpftrace
+FROM lfedge/eve-bpftrace:db21ca8a24d3f4e9f2e3fccc558ec0ffcf2ec137 AS eve-bpftrace
 
-FROM lfedge/eve-alpine:f9b45a5a3b3a18a8503cbe6d1258a1025450fe0e AS bpftrace
+FROM lfedge/eve-alpine:b79fd3384162534a9bdb99506adb2f19f60f26db AS bpftrace
 
 # hadolint ignore=DL3018
 RUN apk add --no-cache --initdb binutils make gcc g++ git perl musl-dev cmake zlib-dev bcc-dev libbpf-dev cereal flex bison llvm17-libs llvm17-dev llvm17-static clang17-dev clang17-static pahole gtest-dev bash

diff --git a/pkg/alpine/Dockerfile b/pkg/alpine/Dockerfile
@@ -45,7 +45,7 @@ RUN apk update
 
 FROM lfedge/eve-alpine-base:77cc1495c875b7468dbf4123210abf86a1ffb852-07a6e7df6 AS compactor
 ARG TARGETARCH
-ARG GO_VERSION=1.25.11
+ARG GO_VERSION=1.25.12
 
 COPY --from=cache-build /etc/apk/repositories* /etc/apk/
 COPY --from=cache-build /etc/apk/keys /etc/apk/keys/

diff --git a/pkg/apparmor/Dockerfile b/pkg/apparmor/Dockerfile
@@ -3,7 +3,7 @@
 # Copyright (c) 2023 Zededa, Inc.
 # SPDX-License-Identifier: Apache-2.0
 
-FROM lfedge/eve-alpine:f9b45a5a3b3a18a8503cbe6d1258a1025450fe0e AS build
+FROM lfedge/eve-alpine:b79fd3384162534a9bdb99506adb2f19f60f26db AS build
 ENV BUILD_PKGS linux-headers musl-dev musl-utils musl-libintl git gcc g++ \
                autoconf autoconf-archive automake libtool make flex bison \
                bash sed gettext

diff --git a/pkg/bpftrace/Dockerfile b/pkg/bpftrace/Dockerfile
@@ -2,7 +2,7 @@
 
 # Copyright (c) 2024 Zededa, Inc.
 # SPDX-License-Identifier: Apache-2.0
-FROM lfedge/eve-alpine:f9b45a5a3b3a18a8503cbe6d1258a1025450fe0e AS build
+FROM lfedge/eve-alpine:b79fd3384162534a9bdb99506adb2f19f60f26db AS build
 
 ENV BUILD_PKGS libbpf-dev make gcc g++ git perl linux-headers musl-dev cmake elfutils-dev llvm17-libs llvm17-dev llvm17-gtest llvm17-static cereal flex bison clang17-extra-tools clang17-dev clang17-static pahole gtest-dev bash py3-setuptools zip zlib-dev
 

diff --git a/pkg/bsp-imx/Dockerfile b/pkg/bsp-imx/Dockerfile
@@ -4,10 +4,10 @@
 ARG BUILD_PKGS_BASE="bash binutils-dev build-base bc bison flex openssl-dev util-linux-dev swig gnutls-dev perl python3 python3-dev py3-setuptools py3-pycryptodome py3-elftools"
 
 # we use the same image in several places
-ARG EVE_ALPINE_IMAGE=lfedge/eve-alpine:f9b45a5a3b3a18a8503cbe6d1258a1025450fe0e
+ARG EVE_ALPINE_IMAGE=lfedge/eve-alpine:b79fd3384162534a9bdb99506adb2f19f60f26db
 
 # OPTEE-OS images
-FROM lfedge/eve-optee-os:49e5e408f4871941fe7d62948bba60fd7e332f1f AS optee-os
+FROM lfedge/eve-optee-os:dfda7b90187210c1070b88407dd3b0dcd41c1768 AS optee-os
 
 # hadolint ignore=DL3006
 FROM ${EVE_ALPINE_IMAGE} AS build-native

diff --git a/pkg/debug/Dockerfile b/pkg/debug/Dockerfile
@@ -8,9 +8,9 @@
 # has a fast path for stack unwinding. This also happens
 # to be a perfect place to put any other kind of debug info
 # into the package: see abuild/etc/abuild.conf.
-FROM lfedge/eve-recovertpm:05687ec09f5beb9d1d76d0529fbc0aa54993d21c AS recovertpm
-FROM lfedge/eve-bpftrace:44a21d005fa06c52d34e5f0e5073db3268d5e212 AS bpftrace
-FROM lfedge/eve-alpine:f9b45a5a3b3a18a8503cbe6d1258a1025450fe0e AS build
+FROM lfedge/eve-recovertpm:8bb16473b72f0440e75c6c2c5080c23dd1b5e161 AS recovertpm
+FROM lfedge/eve-bpftrace:db21ca8a24d3f4e9f2e3fccc558ec0ffcf2ec137 AS bpftrace
+FROM lfedge/eve-alpine:b79fd3384162534a9bdb99506adb2f19f60f26db AS build
 ENV BUILD_PKGS="abuild curl tar make linux-headers patch g++ git gcc gpg gettext gettext-static ncurses-dev jq autoconf openssl-dev zlib-dev zlib-static gpg-agent"
 # Feel free to add additional packages here, but be aware that
 # EVE's rootfs image can be no larger than 300Mb (and don't

diff --git a/pkg/dom0-ztools/Dockerfile b/pkg/dom0-ztools/Dockerfile
@@ -3,7 +3,7 @@
 # Copyright (c) 2025 Zededa, Inc.
 # SPDX-License-Identifier: Apache-2.0
 
-FROM lfedge/eve-alpine:f9b45a5a3b3a18a8503cbe6d1258a1025450fe0e AS zfs
+FROM lfedge/eve-alpine:b79fd3384162534a9bdb99506adb2f19f60f26db AS zfs
 ENV BUILD_PKGS="git patch ca-certificates util-linux build-base gettext-dev libtirpc-dev automake autoconf \
     libtool linux-headers attr-dev e2fsprogs-dev glib-dev openssl-dev util-linux-dev coreutils"
 ENV PKGS="ca-certificates util-linux libintl libuuid libtirpc libblkid libcrypto3 zlib"

diff --git a/pkg/edgeview/Dockerfile b/pkg/edgeview/Dockerfile
@@ -2,12 +2,12 @@
 # SPDX-License-Identifier: Apache-2.0
 
 # hadolint ignore=DL3006
-FROM lfedge/eve-alpine:f9b45a5a3b3a18a8503cbe6d1258a1025450fe0e AS runtime
+FROM lfedge/eve-alpine:b79fd3384162534a9bdb99506adb2f19f60f26db AS runtime
 ENV PKGS alpine-baselayout musl-utils iproute2 iptables
 RUN eve-alpine-deploy.sh
 
 # hadolint ignore=DL3029
-FROM --platform=$BUILDPLATFORM lfedge/eve-alpine:f9b45a5a3b3a18a8503cbe6d1258a1025450fe0e AS build
+FROM --platform=$BUILDPLATFORM lfedge/eve-alpine:b79fd3384162534a9bdb99506adb2f19f60f26db AS build
 ARG TARGETARCH
 
 COPY src/  /edge-view/.

diff --git a/pkg/eve/Dockerfile.in b/pkg/eve/Dockerfile.in
@@ -1,4 +1,4 @@
-FROM lfedge/eve-alpine:f9b45a5a3b3a18a8503cbe6d1258a1025450fe0e AS tools
+FROM lfedge/eve-alpine:b79fd3384162534a9bdb99506adb2f19f60f26db AS tools
 ENV PKGS="qemu-img tar u-boot-tools coreutils dosfstools"
 RUN eve-alpine-deploy.sh
 

diff --git a/pkg/fscrypt/Dockerfile b/pkg/fscrypt/Dockerfile
@@ -2,7 +2,7 @@
 
 # SPDX-License-Identifier: Apache-2.0
 
-FROM lfedge/eve-alpine:f9b45a5a3b3a18a8503cbe6d1258a1025450fe0e AS build-base
+FROM lfedge/eve-alpine:b79fd3384162534a9bdb99506adb2f19f60f26db AS build-base
 
 FROM build-base AS build-amd64
 FROM build-base AS build-arm64

diff --git a/pkg/fw/Dockerfile b/pkg/fw/Dockerfile
@@ -1,7 +1,7 @@
 # syntax=docker/dockerfile-upstream:1.5.0-rc2-labs
 ARG PLATFORM=generic
 
-FROM lfedge/eve-alpine:f9b45a5a3b3a18a8503cbe6d1258a1025450fe0e AS build-base
+FROM lfedge/eve-alpine:b79fd3384162534a9bdb99506adb2f19f60f26db AS build-base
 
 ARG TARGETARCH
 
@@ -122,7 +122,7 @@ RUN if [ "${TARGETARCH}" = "arm64" ]; then \
 
 # generate initrd for Intel's and AMD's microcode
 # it makes sense only for x86_64 platform
-FROM --platform=${TARGETPLATFORM} lfedge/eve-alpine:f9b45a5a3b3a18a8503cbe6d1258a1025450fe0e AS ucode-build-common
+FROM --platform=${TARGETPLATFORM} lfedge/eve-alpine:b79fd3384162534a9bdb99506adb2f19f60f26db AS ucode-build-common
 RUN mkdir -p /boot /tmp/ucode/intel /tmp/ucode/amd /usr/share/licenses/ucode
 # Ensure /sbom-out/lib/apk/db/installed exists for all archs so the COPY in
 # compactor-common works even when no ucode registrations run (arm64/riscv64).
@@ -170,7 +170,7 @@ FROM ucode-build-common AS ucode-build-arm64
 FROM ucode-build-common AS ucode-build-riscv64
 FROM ucode-build-${TARGETARCH} AS ucode-build
 
-FROM lfedge/eve-alpine:f9b45a5a3b3a18a8503cbe6d1258a1025450fe0e AS compactor-common
+FROM lfedge/eve-alpine:b79fd3384162534a9bdb99506adb2f19f60f26db AS compactor-common
 ENTRYPOINT []
 WORKDIR /
 # Reset the APK DB so the final image only reports source-built/firmware packages
@@ -254,7 +254,7 @@ RUN if [ "$TARGETARCH" = "arm64" ]; then \
     fi
 
 
-FROM lfedge/eve-alpine:f9b45a5a3b3a18a8503cbe6d1258a1025450fe0e AS compactor-full
+FROM lfedge/eve-alpine:b79fd3384162534a9bdb99506adb2f19f60f26db AS compactor-full
 # Reset the APK DB so the final image only reports source-built/firmware packages
 RUN rm -f /lib/apk/db/installed && register-sbom-pkg.sh -o /
 COPY --from=build /sbom-out/lib/apk/db/installed /tmp/sbom-fw

diff --git a/pkg/gpt-tools/Dockerfile b/pkg/gpt-tools/Dockerfile
@@ -1,4 +1,4 @@
-FROM lfedge/eve-alpine:f9b45a5a3b3a18a8503cbe6d1258a1025450fe0e AS build
+FROM lfedge/eve-alpine:b79fd3384162534a9bdb99506adb2f19f60f26db AS build
 ENV BUILD_PKGS="gcc make file patch libc-dev linux-headers openssl-dev g++ tar coreutils"
 # util-linux-static on riscv64 is broken; we build libuuid from source instead (see below).
 ENV BUILD_PKGS_amd64="util-linux-static util-linux-dev"

@@ -2,7 +2,7 @@
 # Copyright (c) 2025-2026 Zededa, Inc.
 # SPDX-License-Identifier: Apache-2.0
 
-FROM lfedge/eve-alpine:f9b45a5a3b3a18a8503cbe6d1258a1025450fe0e AS grub-build-base
+FROM lfedge/eve-alpine:b79fd3384162534a9bdb99506adb2f19f60f26db AS grub-build-base
 ENV BUILD_PKGS="automake \
                make \
                bison \

diff --git a/pkg/guacd/Dockerfile b/pkg/guacd/Dockerfile
@@ -1,6 +1,6 @@
 # Copyright (c) 2023 Zededa, Inc.
 # SPDX-License-Identifier: Apache-2.0
-FROM lfedge/eve-alpine:f9b45a5a3b3a18a8503cbe6d1258a1025450fe0e AS build
+FROM lfedge/eve-alpine:b79fd3384162534a9bdb99506adb2f19f60f26db AS build
 ENV BUILD_PKGS cairo-dev jpeg-dev libpng-dev gcc make libc-dev openssl-dev libvncserver-dev file patch
 ENV PKGS alpine-baselayout musl-utils libtasn1-progs p11-kit cairo jpeg libpng libvncserver
 RUN eve-alpine-deploy.sh

diff --git a/pkg/installer/Dockerfile b/pkg/installer/Dockerfile
@@ -28,10 +28,10 @@ RUN cargo sbom > sbom.spdx.json
 
 RUN cp "/usr/local/my-installer/target/$CARGO_BUILD_TARGET/release/installer" /usr/local/my-installer/target/installer
 
-FROM lfedge/eve-debug:dfe86811a844dc212800f2346f95bc200bc1637a AS debug
+FROM lfedge/eve-debug:2eecb77c2a7b039e5896c2ca433d6ac6add938ff AS debug
 
 # Dockerfile to build installer img initrd
-FROM lfedge/eve-alpine:f9b45a5a3b3a18a8503cbe6d1258a1025450fe0e AS build
+FROM lfedge/eve-alpine:b79fd3384162534a9bdb99506adb2f19f60f26db AS build
 SHELL ["/bin/ash", "-eo", "pipefail", "-c"]
 ENV BUILD_PKGS="mkinitfs grep patch make coreutils musl-dev gcc g++ perl \
     autoconf automake libtool file bsd-compat-headers libc-dev \

diff --git a/pkg/ipxe/Dockerfile b/pkg/ipxe/Dockerfile
@@ -1,4 +1,4 @@
-FROM lfedge/eve-alpine:f9b45a5a3b3a18a8503cbe6d1258a1025450fe0e AS build
+FROM lfedge/eve-alpine:b79fd3384162534a9bdb99506adb2f19f60f26db AS build
 
 ENV BUILD_PKGS="patch make gcc perl util-linux-dev git mtools linux-headers musl-dev xz-dev"
 RUN eve-alpine-deploy.sh

diff --git a/pkg/kdump/Dockerfile b/pkg/kdump/Dockerfile
@@ -1,6 +1,6 @@
 # Copyright (c) 2023 Zededa, Inc.
 # SPDX-License-Identifier: Apache-2.0
-FROM lfedge/eve-alpine:f9b45a5a3b3a18a8503cbe6d1258a1025450fe0e AS build
+FROM lfedge/eve-alpine:b79fd3384162534a9bdb99506adb2f19f60f26db AS build
 
 ENV BUILD_PKGS patch curl make gcc perl util-linux-dev git mtools linux-headers musl-dev xz-dev elfutils-dev libbz2
 ENV PKGS xz-libs elfutils-dev libbz2

diff --git a/pkg/kexec/Dockerfile b/pkg/kexec/Dockerfile
@@ -1,4 +1,4 @@
-FROM lfedge/eve-alpine:f9b45a5a3b3a18a8503cbe6d1258a1025450fe0e AS build
+FROM lfedge/eve-alpine:b79fd3384162534a9bdb99506adb2f19f60f26db AS build
 
 ENV BUILD_PKGS patch curl make gcc perl util-linux-dev git mtools linux-headers musl-dev xz-dev elfutils-dev libbz2
 ENV PKGS xz-libs util-linux elfutils-dev libbz2

diff --git a/pkg/kube/Dockerfile b/pkg/kube/Dockerfile
@@ -19,12 +19,12 @@
 # hadolint ignore=DL3029
 FROM --platform=linux/amd64 ghcr.io/k8snetworkplumbingwg/sriov-cni@sha256:fce504e683275ab59215065ddf6433ca80d1b4b53f0d4b0cdf037da6701c7cb4 AS sriov-cni-bin
 
-FROM lfedge/eve-alpine:f9b45a5a3b3a18a8503cbe6d1258a1025450fe0e AS build
+FROM lfedge/eve-alpine:b79fd3384162534a9bdb99506adb2f19f60f26db AS build
 
 ARG TARGETARCH
-ENV PKGS alpine-baselayout musl-utils iproute2 iptables curl openrc \
+ENV PKGS="alpine-baselayout musl-utils iproute2 iptables curl openrc \
          open-iscsi libvirt libvirt-client util-linux grep findutils jq \
-         cni-plugins nfs-utils inotify-tools
+         cni-plugins nfs-utils inotify-tools"
 RUN eve-alpine-deploy.sh
 
 ENV ETCDCTL_VERSION=v3.5.5
@@ -62,25 +62,25 @@ COPY stale-mount-cleanup /plugins/stale-mount-cleanup
 WORKDIR /plugins/stale-mount-cleanup
 RUN GO111MODULE=on CGO_ENABLED=0 go build -v -ldflags "-s -w" -mod=vendor -o /out/usr/bin/stale-mount-cleanup .
 
+# kube-init is the Go daemon that replaces cluster-init.sh. The
+# binary built here is the container's entrypoint; k3s-sctl is the
+# operator-facing CLI client that talks to its control socket.
+COPY kube-init /plugins/kube-init
+WORKDIR /plugins/kube-init
+RUN GO111MODULE=on CGO_ENABLED=0 go build -v -ldflags "-s -w" -mod=vendor -o /out/usr/bin/kube-init . && \
+    GO111MODULE=on CGO_ENABLED=0 go build -v -ldflags "-s -w" -mod=vendor -o /out/usr/bin/k3s-sctl ./cmd/k3s-sctl
+
 FROM scratch
 COPY --from=build /out/ /
 RUN mkdir -p /usr/bin/kube/
 
 # Kube general path for all manifests before applying to each cluster mode
 RUN mkdir -p /etc/kube/
-COPY cluster-init.sh /usr/bin/
-COPY cluster-utils.sh /usr/bin/
 COPY cgconfig.conf /etc
-COPY utils.sh /usr/bin/
-COPY pubsub.sh /usr/bin/
-COPY tie-breaker-utils.sh /usr/bin/
-COPY lib/* /usr/bin/
 RUN mkdir -p /etc/k3s-manifests
 COPY manifests/* /etc/k3s-manifests/
 
-
 # upgrades
-COPY cluster-update.sh /usr/bin/
 COPY update-component/expected_versions.yaml /etc/
 COPY update-component/settings_longhorn.yaml /etc/
 
@@ -89,22 +89,18 @@ RUN mkdir -p /etc/rancher/k3s
 COPY config.yaml /etc/rancher/k3s
 COPY debuguser-role-binding.yaml /etc/
 COPY k3s-pod-logs.sh /usr/bin/
-COPY registration-utils.sh /usr/bin/
 COPY all-kube-events.sh /usr/bin/
-COPY lib/* /usr/bin/kube/
 COPY cfg-manifests/03-enc-disable-local-path.yaml /etc/kube/
 COPY cfg-manifests/04-multinode-watch-cache.yaml /etc/kube/
 
-# kubevirt yaml files are patched files and will be removed later, look at cluster-init.sh
+# Manifests the daemon applies at first boot. Stays under /etc; the
+# Go components/ package reads them by path.
 COPY multus-daemonset.yaml /etc
 COPY kubevirt-operator.yaml /etc
 COPY kubevirt-features.yaml /etc
 COPY external-boot-image.tar /etc/
-COPY kubevirt-utils.sh /usr/bin/
-COPY vnc-proxy.sh /usr/bin/
 
 # Longhorn config
-COPY longhorn-utils.sh /usr/bin/
 COPY lh-cfg-v1.9.1.yaml /etc/
 COPY iscsid.conf /etc/iscsi/
 COPY longhorn-generate-support-bundle.sh /usr/bin/
@@ -115,7 +111,6 @@ COPY failover-events.sh /usr/bin/
 COPY cfg-manifests/longhorn-cfg.yaml /etc/
 
 # descheduler
-COPY descheduler-utils.sh /usr/bin/
 COPY descheduler_rbac.yaml /etc/
 COPY descheduler-policy-configmap.yaml /etc/
 
@@ -144,20 +139,22 @@ COPY sriov/sriov-device-plugin.yaml /etc/k3s-manifests/
 
 ARG TARGETARCH
 
-# Actual k3s install and config happens when this container starts during EVE boot up, look at cluster-init.sh
-### NOTE: the version of virtctl should match the version of kubevirt in cluster_init.sh, else PVC creation might fail due to incompatibility
+# k3s install + config happens at container start, inside kube-init.
+# k3s-control is the operator alias set (k3s-start / k3s-stop /
+# k3s-status); it just shells into k3s-sctl, which talks to the
+# daemon's control socket.
 COPY k3s-control.sh /usr/bin/k3s-control
-RUN chmod +x /usr/bin/k3s-control && \
+RUN chmod +x /usr/bin/k3s-control /usr/bin/k3s-sctl && \
     ln -s /usr/bin/k3s-control /usr/bin/k3s-stop && \
     ln -s /usr/bin/k3s-control /usr/bin/k3s-start && \
     ln -s /usr/bin/k3s-control /usr/bin/k3s-status
 
-ENV VIRTCTL_VERSION v1.7.3
+ENV VIRTCTL_VERSION=v1.7.3
 ADD https://github.com/kubevirt/kubevirt/releases/download/${VIRTCTL_VERSION}/virtctl-${VIRTCTL_VERSION}-linux-${TARGETARCH} .
 
 RUN install virtctl-${VIRTCTL_VERSION}-linux-${TARGETARCH} /usr/bin/virtctl
 # We installed under /usr/bin. Remove the downloaded version
 RUN rm -f ./virtctl-${VIRTCTL_VERSION}-linux-${TARGETARCH}
 
 ENTRYPOINT []
-CMD ["/usr/bin/cluster-init.sh"]
+CMD ["/usr/bin/kube-init"]