🏗️ ci: Build And Publish arm64 Images Alongside amd64

[FlorianFiebig]

Summary

The Images workflow builds linux/amd64 only, so arm64 hosts have to build the images themselves. That includes EKS on Graviton, ECS and Fargate on arm64, and the Lambda MicroVM path, which is arm64 only and currently tells the operator to build the runner image locally.

This builds every image for both architectures and joins them into one manifest per image, so a host pulls the one it runs. Fixes #334.

How it works

plan     images[7] x {amd64, arm64} -> matrix[14]
build    sha-<commit>-amd64 / -arm64   (native runner, own buildcache-<arch>)
merge    sha-<commit>                  (manifest listing both)
promote  main -> sha-<commit>          (unchanged)

Each leg runs on a runner of its own architecture, so nothing builds under emulation, and checks for and pushes only its own tag, so a re-run rebuilds only what is missing. The merge job joins all seven images and is safe to re-run. Promote is unchanged, because .github/scripts/image-revision.sh already reads a revision label through a manifest list.

Type of change

• Feature
• Tests / tooling / CI

Testing

Fork run, all 14 legs green in 12 minutes: https://github.com/FlorianFiebig/code-interpreter/actions/runs/38718035570

The baked KVM runner took 9 minutes on arm64 against 11 on amd64, with 105336 MiB free disk at its lowest, so timeout and disk have room. Its log confirms real work and not a cache hit: the buildcache-arm64 import found nothing and CPython compiled in 335 seconds.

test-sandbox.sh against the arm64 image on Apple Silicon, direct NsJail path: 12 of 12 passed, including numpy, statsmodels, chDB, the geospatial stack, Bun, blocked network, EPERM on sched_setaffinity, and a blocked escape attempt. Worth checking because an aarch64 wheel can install cleanly and still fail in the sandbox, as the onnxruntime note in docker/package-init.sh records.

A fork run skips merge and promote, so those were run against a local registry: annotations, both platforms in the index, the revision read back, the retag of main, and a missing tag exiting 3.

Tested environments/configuration:

• Runners: ubuntu-24.04 and ubuntu-24.04-arm
• Local: macOS on Apple Silicon, Docker 29, native linux/arm64

Automated tests:

Not applicable; no application code changes. nsjail-ipc-tests already covers ubuntu-24.04-arm.

Screenshots / recordings

No user-facing change.

Risk / compatibility

The arm64 KVM runner image has never been booted. Booting a libkrun guest needs an arm64 host with /dev/kvm, which neither Apple Silicon nor GitHub's arm runners have. Happy to hold that one image back until someone runs it on Graviton.

Build caches move to :buildcache-<arch>, so amd64 starts cold once and the old tags can be deleted.

Re-running the workflow on a commit built before this change rebuilds it and replaces its sha- tag with a manifest. Later commits are unaffected.

Checklist

• I reviewed my own changes
• Relevant tests have been added or updated
• Existing relevant tests pass
• The change does not introduce new warnings or errors
• User-facing or complex behavior is documented where necessary
• Required dependency changes have been merged/published
• Required documentation PR: N/A, the "Prebuilt images" section in README.md is updated here