feat(fc-kernels): add the 6.1.158-android guest kernel flavour

Co-authored-by: Ryan Sana <ssanaeekohroudi@e2b.dev>
GitOrigin-RevId: de8d84ca927ec488c4435a66af357a3653a15133

Author: 2 people

firecracker/fc-kernels/README.md

@@ -49,6 +49,10 @@ Then add the version to `kernel_versions.txt` and build.
 
 `make build` builds every version in the file, so keep the list to the versions you still want built. Dropping a pin is safe: published artifacts are never overwritten or deleted, and a template records the kernel version it was built with.
 
+## Flavours
+
+A flavour is the same upstream tree and patches built under a different config, named `<version>-<flavour>`: `6.1.158-android` is `6.1.158` with binder, DMA-BUF heaps, Android's networking options and a small patch that answers Android's ashmem ioctls on memfd files instead of an ashmem driver, so a sandbox can run Android in a container. `build.sh` takes the upstream tag and the `patches/` directory from the stem (`6.1.158`) and everything else — the config, the output directory, and so the published name a template selects — from the full name. Seed a flavour's config from its stem's and settle it the same way as a new version (`sudo env CONFIG_ONLY=1 ./build.sh 6.1.158-android`, per architecture). A flavour is a sibling of its stem, not a patch release: the weekly bump neither seeds from it nor bumps it. A flavour may also carry patches of its own under `patches/<version>-<flavour>/`; they apply after the stem's, and a change there rebuilds only that flavour.
+
 ## New kernel in E2B's infra
 _Note: these steps should give you a new kernel on your self-hosted E2B using https://github.com/e2b-dev/infra_
 

firecracker/fc-kernels/build.sh

@@ -8,6 +8,8 @@ set -euo pipefail
 #   ./build.sh <kernel_version> [arch]    # build a single version
 #
 # arch is one of: x86_64 (default), arm64 (kernel-style names).
+# A version may carry a flavour, 6.1.158-android: the upstream tag and the patches
+# come from its stem (6.1.158), the config and the output from the full name.
 # Output: builds/vmlinux-<version>/<output_arch>/vmlinux.bin where
 # <output_arch> is the Go/OCI name (amd64/arm64) used by the orchestrator.
 #
@@ -66,6 +68,11 @@ get_tag() {
   return 1
 }
 
+# The upstream version a pin is built from: 6.1.158 for 6.1.158-android.
+version_stem() {
+  echo "${1%%-*}"
+}
+
 # The salt Kconfig carries into the vmlinux as an ELF note, naming what the
 # binary was built from. It is a plain string symbol, so olddefconfig keeps
 # whatever the config it reads says: a config seeded from another version names
@@ -115,17 +122,22 @@ build_version() {
 
   cp "$SCRIPT_DIR/configs/${target_arch}/${version}.config" .config
 
-  local tag=""
+  local stem tag=""
+  stem="$(version_stem "$version")"
   # get_tag greps, so no match is a non-zero exit, not just empty output.
-  tag="$(get_tag "$version")" || true
+  tag="$(get_tag "$stem")" || true
   if [ -z "$tag" ]; then
     echo "No amzn tag for kernel version $version" >&2
     return 1
   fi
   echo "Checking out $tag for kernel version: $version"
   git checkout -f "$tag"
+  # A patch that adds files leaves them untracked; the next build's apply would refuse them.
+  git clean -fdq
 
-  apply_patches "$version"
+  apply_patches "$stem"
+  # A flavour may carry patches of its own, applied after its stem's.
+  [ "$version" = "$stem" ] || apply_patches "$version"
 
   local make_opts="" cross=""
   if [[ "$target_arch" == "arm64" ]]; then