Running amd64 images on arm with virtualization

[maxwnewcomer]

Is it expected for the amd64 images to be runnable with either Docker VMM or the Apple Virtualization Framework (w/ or w/o Rosetta) on arm64 machines?

I've been able to do this by

1. Pulling the latest amd64 image

docker pull --platform=linux/amd64 ghcr.io/siderolabs/talos:latest

2. running the cluster as so (verified that the amd64 images are running in docker, tried both Docker VMM + Apple VF on my M2 Macbook)

talosctl cluster create --arch amd64 --image ghcr.io/siderolabs/talos:latest

with the following last log being infinitely printed:

2024-12-02 21:52:24 [talos] 2024/12/03 03:52:24 service[kubelet](Starting): Starting service
2024-12-02 21:52:24 [talos] 2024/12/03 03:52:24 service[kubelet](Waiting): Waiting for service "cri" to be "up", time sync, network
2024-12-02 21:52:25 [talos] 2024/12/03 03:52:25 service[apid](Waiting): Waiting for api certificates
2024-12-02 21:52:25 [talos] 2024/12/03 03:52:25 service[cri](Running): Health check successful
2024-12-02 21:52:25 [talos] 2024/12/03 03:52:25 service[kubelet](Preparing): Running pre state
2024-12-02 21:52:39 [talos] task startAllServices (1/1): 2024/12/03 03:52:39 service "apid" to be "up", service "kubelet" to be "up"
2024-12-02 21:52:40 [talos] 2024/12/03 03:52:40 service[kubelet](Preparing): Creating service runner
2024-12-02 21:52:40 [talos] 2024/12/03 03:52:40 service[kubelet](Waiting): Error running Containerd(kubelet), going to restart forever: failed to create task: "kubelet": failed to create shim task: OCI runtime create failed: runc create failed: unable to start container process: error during container init: unable to init seccomp: error loading seccomp filter into kernel: error loading seccomp filter: invalid argument

The reason I would like to do this is for local development of openebs (which currently only supports the amd64 architecture). Also interested in exploring adding arm capabilities to that project as an alternate solution, asking here first because of the --arch flag in talosctl cluster create.

[smira]

Looks like Talos tries to install seccomp filters matching the architecture it's running, but your host kernel doesn't understand it, as it's actually a different arch? Anyways it looks like it's not a full virtualization.

You might hit similar issues with other stuff, so I'd suggest getting a native environment.

[maxwnewcomer]

Sounds good, thanks for the info!