Talos Firecracker Extension

This repo builds a Talos system extension that adds:

• firecracker
• jailer

In plain terms: it gives a Talos node the Firecracker binaries so that higher-level systems can start lightweight microVMs.

What This Does

1. Downloads Firecracker release tarballs for amd64 and arm64
2. Verifies tarball checksums before extracting
3. Packages binaries into a Talos extension image
4. Publishes multi-arch images to GHCR on tagged releases
5. Signs the pushed image digest recursively with Cosign so Image Factory can verify it

How Release Flow Works

flowchart LR
  A[Push to main] --> B[CI: lint + build]
  B --> C[Release Please opens/updates PR]
  C --> D[You review and merge release PR]
  D --> E[Tag created]
  E --> F[Publish workflow]
  F --> G[GHCR image + Cosign signature + GitHub Release]

Loading

Release Secrets

The publish workflow needs these repository secrets:

• COSIGN_PRIVATE_KEY: private key from cosign generate-key-pair
• COSIGN_PASSWORD: password for the private key, or empty string if generated without one
• TALOS_IMAGES_DISPATCH_TOKEN: existing token used to trigger talos-images

Mount the matching cosign.pub into Image Factory as OMNI_IMAGE_FACTORY_COSIGN_PUBLIC_KEY_FILE.

When rotating COSIGN_PRIVATE_KEY, rotate the Image Factory public key in the same change and retire all previously published GHCR tags before releasing the next version. This prevents the factory from accepting artifacts signed by the retired key.

Quick Start

Build locally:

docker buildx build --platform linux/amd64,linux/arm64 -t talos-ext-firecracker:test .

Run local checks:

pre-commit run --all-files

Install git hooks:

pre-commit install
pre-commit install --hook-type commit-msg

Key Files

• Dockerfile: downloads, verifies, and installs Firecracker binaries
• manifest.yaml: Talos extension metadata
• .github/workflows/ci.yml: lint/build checks
• .github/workflows/release-please.yml: automated release PRs
• .github/workflows/release.yml: publish on tags

Links

• Talos extensions docs: https://www.talos.dev/latest/talos-guides/configuration/system-extensions/
• Firecracker docs: https://firecracker-microvm.github.io/
• Container image: https://ghcr.io/syscode-labs/talos-ext-firecracker