Building

Everything builds natively for the Docker daemon’s architecture (arm64 or amd64):

  make jool          # Jool modules for natkit.yml's kernel (lk-kernel); or let linuxkit pull them from GHCR
make               # out/natkit-<arch>-efi.img
make test          # natkit-init against a mock IMDS/EC2/SSM
make ami           # needs AWS credentials, AWS_REGION, NATKIT_BUCKET and the vmimport role
  

CI link

.github/workflows/build.yml builds both architectures on every push. Tags (v*) and manual runs also register the AMIs and run scripts/boot-test.sh, which checks:

• an EIP and a static ENI;
• a client in a private subnet whose egress must be the EIP;
• a failover to a second instance;
• CloudWatch agent metrics;
• NAT64, when the test subnets have IPv6.

tofu/ci creates the CI role, test VPC and instance profile. See the README for the repository variables.