chore: import upstream snapshot with attribution

kernel/Makefile

@@ -0,0 +1,74 @@
+# Copyright © 2025-2026 Apple Inc. and the Containerization project authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#   https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+KSOURCE ?= https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-6.18.5.tar.xz
+KIMAGE ?= kernel-build:0.1
+MAKEFILE_DIR := $(patsubst %/,%,$(dir $(abspath $(lastword $(MAKEFILE_LIST)))))
+GIT_VERSION := $(shell git -C $(MAKEFILE_DIR) rev-parse --short=12 HEAD 2>/dev/null || echo unknown)
+TARGET_ARCH ?=
+
+# Resolve the effective target arch (TARGET_ARCH override, else host).
+EFFECTIVE_ARCH := $(if $(TARGET_ARCH),$(TARGET_ARCH),$(shell uname -m))
+ifneq (,$(filter $(EFFECTIVE_ARCH),aarch64))
+EFFECTIVE_ARCH := arm64
+endif
+ifneq (,$(filter $(EFFECTIVE_ARCH),amd64))
+EFFECTIVE_ARCH := x86_64
+endif
+
+# Compressed (vmlinuz) for x86_64 bzImage; uncompressed (vmlinux) for arm64 Image.
+ifeq ($(EFFECTIVE_ARCH),x86_64)
+KERNEL_OUTPUT := vmlinuz-x86_64
+else
+KERNEL_OUTPUT := vmlinux-arm64
+endif
+
+BIN_DIR := $(abspath $(MAKEFILE_DIR)/../bin)
+
+.DEFAULT_GOAL := all
+
+.PHONY: all
+all: kernel-build-image
+all: kernel-build
+all: kernel-install
+
+.PHONY: kernel-build-image
+kernel-build-image:
+	container build $(MAKEFILE_DIR)/image -f $(MAKEFILE_DIR)/image/Dockerfile -t ${KIMAGE}
+
+.PHONY: kernel-build
+kernel-build:
+ifeq (,$(wildcard $(MAKEFILE_DIR)/source.tar.xz))
+	curl -SsL -o $(MAKEFILE_DIR)/source.tar.xz ${KSOURCE}
+endif
+	container run \
+		--cpus 8 \
+		--rm \
+		--memory 16g \
+		-v $(MAKEFILE_DIR):/kernel \
+		--env LOCALVERSION=-cz-${GIT_VERSION} \
+		$(if $(TARGET_ARCH),--env TARGET_ARCH=$(TARGET_ARCH),) \
+		--cwd /kernel \
+		${KIMAGE} \
+		/bin/bash -c "./build.sh"
+
+.PHONY: kernel-install
+kernel-install:
+	@mkdir -p $(BIN_DIR)
+	@cp -L $(MAKEFILE_DIR)/$(KERNEL_OUTPUT) $(BIN_DIR)/$(KERNEL_OUTPUT)
+	@echo "Installed $(KERNEL_OUTPUT) -> $(BIN_DIR)/$(KERNEL_OUTPUT)"
+
+.PHONY: x86_64
+x86_64:
+	$(MAKE) all TARGET_ARCH=x86_64

kernel/README.md

@@ -0,0 +1,24 @@
+# Containerization Kernel Configuration
+
+This directory includes an optimized kernel configuration to produce a fast and lightweight kernel for container use.
+
+- `config-arm64` and `config-x86_64` include the per-arch kernel `CONFIG_` options.
+- `Makefile` includes the kernel version and source package URL.
+- `build.sh` scripts the kernel build process.
+- `image/` includes the configuration for an image with build tooling.
+
+## Building
+
+1. The build process relies on having the `container` tool installed (https://github.com/apple/container/releases).
+2. Run `make`. This should create the image used for building the resulting Linux kernel, and then run a container with that image to perform the kernel build.
+
+### Target architecture
+
+The build target is selected by the `TARGET_ARCH` make variable, which accepts either `arm64` or `x86_64`. When unset, it falls back to the build host's architecture (as reported by `uname -m`, with `aarch64`/`amd64` normalized to `arm64`/`x86_64`).
+
+- `make` (default) → builds for the host arch
+- `make TARGET_ARCH=arm64` → `vmlinux-arm64` (uncompressed `Image`)
+- `make TARGET_ARCH=x86_64` → `vmlinuz-x86_64` (compressed `bzImage`, cross-compiled inside the arm64 container)
+- `make x86_64` → convenience alias for `make TARGET_ARCH=x86_64`
+
+The `z` suffix on the x86 name follows Linux convention for a compressed kernel image. The resulting kernel is copied into the repo's `bin/` directory.

kernel/build.sh

@@ -0,0 +1,50 @@
+#!/bin/bash
+# Copyright © 2025-2026 Apple Inc. and the Containerization project authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#   https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -e
+
+TARGET_ARCH="${TARGET_ARCH:-$(uname -m)}"
+
+case "${TARGET_ARCH}" in
+  aarch64|arm64)
+    CONFIG=config-arm64
+    KARCH=arm64
+    CROSS_COMPILE=aarch64-linux-gnu-
+    IMAGE_PATH=arch/arm64/boot/Image
+    OUTPUT_NAME=vmlinux-arm64
+    ;;
+  x86_64|amd64)
+    CONFIG=config-x86_64
+    KARCH=x86_64
+    CROSS_COMPILE=x86_64-linux-gnu-
+    IMAGE_PATH=arch/x86/boot/bzImage
+    OUTPUT_NAME=vmlinuz-x86_64
+    ;;
+  *)
+    echo "Unsupported target architecture: ${TARGET_ARCH}" >&2
+    exit 1
+    ;;
+esac
+
+mkdir -p /kbuild
+tar -xf /kernel/source.tar.xz -C /kbuild --strip-components=1
+cp "/kernel/${CONFIG}" /kbuild/.config
+
+(
+  cd /kbuild
+  make ARCH="${KARCH}" CROSS_COMPILE="${CROSS_COMPILE}" olddefconfig && \
+    make ARCH="${KARCH}" CROSS_COMPILE="${CROSS_COMPILE}" -j$((`nproc`-1)) LOCALVERSION="${LOCALVERSION}" && \
+    cp "${IMAGE_PATH}" "/kernel/${OUTPUT_NAME}"
+)

kernel/image/Dockerfile

@@ -0,0 +1,30 @@
+FROM ubuntu:focal
+
+RUN apt-get update && apt-get install -y \
+    autoconf \
+    bc \
+    binutils-multiarch \
+    binutils-aarch64-linux-gnu \
+    binutils-x86-64-linux-gnu \
+    bison \
+    flex \
+    gcc \
+    xz-utils \
+    gcc-aarch64-linux-gnu \
+    gcc-x86-64-linux-gnu \
+    git \
+    libncurses-dev \
+    make \
+    openssl \
+    python-is-python3 \
+&&  apt-get clean \
+&&  rm -rf /var/lib/apt/lists/*
+
+COPY sources.list /etc/apt/sources.list
+
+RUN apt-get update \
+&&  dpkg --add-architecture arm64 \
+&&  dpkg --add-architecture amd64 \
+&&  apt-get install -y libelf-dev:arm64 libelf-dev:amd64 \
+&&  apt-get clean \
+&&  rm -rf /var/lib/apt/lists/*

kernel/image/sources.list

@@ -0,0 +1,15 @@
+deb [arch=arm64] http://ports.ubuntu.com/ focal main restricted
+deb [arch=arm64] http://ports.ubuntu.com/ focal-updates main restricted
+deb [arch=arm64] http://ports.ubuntu.com/ focal universe
+deb [arch=arm64] http://ports.ubuntu.com/ focal-updates universe
+deb [arch=arm64] http://ports.ubuntu.com/ focal multiverse
+deb [arch=arm64] http://ports.ubuntu.com/ focal-updates multiverse
+deb [arch=arm64] http://ports.ubuntu.com/ focal-backports main restricted universe multiverse
+
+deb [arch=amd64] http://archive.ubuntu.com/ubuntu/ focal main
+deb [arch=amd64] http://archive.ubuntu.com/ubuntu/ focal-updates main restricted
+deb [arch=amd64] http://archive.ubuntu.com/ubuntu/ focal universe
+deb [arch=amd64] http://archive.ubuntu.com/ubuntu/ focal-updates universe
+deb [arch=amd64] http://archive.ubuntu.com/ubuntu/ focal multiverse
+deb [arch=amd64] http://archive.ubuntu.com/ubuntu/ focal-updates multiverse
+deb [arch=amd64] http://archive.ubuntu.com/ubuntu/ focal-backports main restricted universe multiverse