PastureStack etcd image

PastureStack is an independent community effort to preserve, audit, and modernize the Rancher 1.6 ecosystem. It is not affiliated with or endorsed by Rancher Labs or SUSE.

Upstream: rancher/image-build-etcd. This GitHub fork retains the upstream Git history, authorship, dates, and license notices unchanged; PastureStack maintenance is consolidated into one commit after the preserved upstream boundary.

This repository is a standalone image proof of concept for etcd, etcdctl, and etcdutl. It builds the verified k3s-io/etcd source tag v3.6.14-k3s1 at commit 0ca4081495717183b0741606dbaa6e330cdcf5bc.

This image is not a direct replacement for the preserved production Catalog entry. Catalog wiring, upgrade sequencing, persisted-data compatibility, rollback behavior, and multi-node interoperability remain separate migration gates.

Pinned build inputs

Input	Pinned value
Source	github.com/k3s-io/etcd
Source tag	v3.6.14-k3s1
Source commit	0ca4081495717183b0741606dbaa6e330cdcf5bc
Source date epoch	1784841121
Go toolchain	1.26.5
Security override	golang.org/x/text v0.39.0
Target platforms	linux/amd64, linux/arm64

The Dockerfile verifies the source commit and the official Go archive checksum before compiling. It disables VCS build metadata, removes the Go build ID, uses -trimpath, limits compilation to two concurrent package jobs by default, and normalizes final-image file timestamps. The builder runs on BuildKit's native build platform and cross-compiles for the requested target architecture, so an ARM64 image build does not need to execute an ARM64 Go toolchain on an AMD64 builder.

After verifying the source commit, the build raises only the server, etcdctl, and etcdutl module selection for golang.org/x/text to v0.39.0. The version, Go checksum-database records, and dependency license hash are pinned in the Dockerfile. This narrowly scoped build-time override removes the vulnerable v0.37.0 selected by the upstream tag without changing etcd source files.

Build

The default local image name is pasturestack/etcd-image:v3.6.14-k3s1-poc.

make image-build
make log

The build target is local-only and does not push an image. CI/CD and update automation are outside this POC.

Standalone smoke test

make image-smoke

The smoke test:

• runs etcd --version and etcdctl version with --network none;
• starts one uniquely named, network-isolated container;
• stores test data only in that container's writable layer;
• checks the loopback endpoint with the image's own etcdctl; and
• removes the container without creating or mounting a volume.

Never point the smoke test at an existing etcd data directory.

Reproducibility check

make image-reproducibility

This target performs two no-cache, single-platform builds and requires their local image IDs to match. It removes both comparison tags afterward. Matching IDs demonstrate reproducibility for the tested builder and platform; they do not guarantee that upstream downloads will remain available indefinitely or that different Docker/BuildKit versions will serialize images identically.

Runtime shape

• Entrypoint: /usr/local/bin/etcd
• Client utility: /usr/local/bin/etcdctl
• Snapshot and data utility: /usr/local/bin/etcdutl
• Working directory: /var/lib/etcd
• Runtime identity: numeric user and group 65532:65532
• Base filesystem: scratch
• Default image contains no shell, package manager, or CA bundle

Repository and upstream legal evidence is included under /usr/share/licenses/pasturestack-etcd-image/. The repository's root LICENSE has a known integrity defect and has intentionally not been repaired or replaced; see LICENSE-STATUS.md before redistribution.

Documentation

• ORIGIN.md — history and upstream source attribution
• COMPATIBILITY.md — verified and unverified boundaries
• SECURITY.md — safe test and deployment boundaries
• LICENSE-STATUS.md — isolated license-integrity evidence