[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6993GCFCDMTVDJCQJ1ZCDDD":3,"skill-same:01M6993GCFCDMTVDJCQJ1ZCDDD":48},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":20,"linkOnly":21,"markdownContent":22,"markdownBody":23,"frontMatter":24,"refName":25,"commitSha":26,"skillDirectory":27,"forksCount":28,"repositoryHtmlUrl":29,"repositoryHomepageUrl":6,"ownerHtmlUrl":30,"ownerBlogUrl":31,"ownerDescription":32,"updatedAt":33,"install":34,"resources":47},"01M6993GCFCDMTVDJCQJ1ZCDDD","build-initrd",null,"Initrd repack and guest binary management. Use when adding or changing a guest binary, modifying capsem-init, or iterating on the initrd without a full rebuild.","google\u002Fcapsem","google","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F1342004?v=4","01M698VYEFDM0VJBZDYYJ2T83S","Google","01M69939YZJTP726NQK4NZNB48",186,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fcapsem\u002Fblob\u002Fmain\u002Fskills\u002Fbuild-initrd\u002FSKILL.md",[],[19],"build initrd","2026-11-10 10:12:30",false,"---\nname: build-initrd\ndescription: Initrd repack and guest binary management. Use when adding or changing a guest binary, modifying capsem-init, or iterating on the initrd without a full rebuild.\n---\n\n# Initrd Repack\n\n`just exec` composes `capsem-gate pack-initrd` before boot. The gate stages the\nconfigured guest binaries, atomically repacks the host initrd, regenerates its\nmanifest and hash aliases, and then materializes runtime config. `capsem-init`\nprefers these initrd copies over the rootfs copies.\n\nThe authoritative inventory and paths are `[initrd]` in `config\u002Fgate.toml`.\nDo not add a second list to a recipe, test, or gate module.\n\n## Currently repacked binaries\n\n| Binary | What it does |\n|--------|-------------|\n| `capsem-init` | PID 1 init script |\n| `capsem-pty-agent` | PTY-over-vsock bridge agent |\n| `capsem-net-proxy` | TCP-to-vsock relay for air-gapped HTTPS proxying |\n| `capsem-dns-proxy` | UDP\u002FTCP DNS-to-vsock relay |\n| `capsem-mcp-server` | MCP stdio-to-vsock relay for AI agent tool access |\n| `capsem-sysutil` | Guest suspend helper via vsock:5004; in-VM shutdown commands are disabled |\n| `capsem-bench-rs` | Rust guest benchmark helper |\n| `capsem-doctor` | VM self-diagnostic suite (bash script) |\n| `capsem-bench` | Guest benchmark driver (bash script) |\n| `capsem_bench\u002F` | Python benchmark support tree |\n| `diagnostics\u002F` | pytest test files for capsem-doctor |\n\n## Adding a new guest binary\n\nUpdate two authorities, then their behavior tests:\n\n1. **`[initrd].binaries` in `config\u002Fgate.toml`** -- the repacker, static gate,\n   build-chain test, and release asset rail all consume it.\n2. **`guest\u002Fartifacts\u002Fcapsem-init`** -- add the initrd-first deployment\u002Ffallback\n   behavior if the new process is launched during boot.\n\nUpdate this table and add the relevant unit, archive, and in-VM behavior tests.\n\n## When to use which build path\n\n| Changed | Command | Why |\n|---------|---------|-----|\n| Guest binary source (Rust agent code) | `just exec` | Auto-repacks initrd with new binary |\n| `capsem-init` script | `just exec` | Init script is repacked into initrd |\n| `guest\u002Fartifacts\u002Fdiagnostics\u002F*.py` | `just exec \"capsem-doctor\"` | Test files repacked into initrd |\n| `guest\u002Fartifacts\u002Fcapsem-bashrc` | `just build-assets [arch]` | Baked into rootfs, not initrd |\n| Runtime package set (`config\u002Fdocker\u002Fimage\u002Fbuild.toml` `runtime_apt_packages`) | `just build-assets [arch]` | Baked into the runtime rootfs asset |\n| Application tools (AI CLIs, language toolchains) | an OCI image under `images\u002F` | Not part of the runtime; see `\u002Fbuild-images` |\n\n## Guest binary security\n\nAll guest binaries are deployed read-only:\n- **Rootfs**: `chmod 555` in Dockerfile template (rootfs mounted read-only)\n- **Initrd override**: `[initrd].binary_mode` in the gate repacker and `capsem-init` after copying to tmpfs\n- Guest processes cannot modify these binaries at runtime\n\n## How initrd repack works\n\nThe initrd is a gzip+cpio archive. `build_system\u002Fbuilder\u002Fgate\u002Finitrd.py`:\n\n1. Resolves the exact content-addressed Rust payload generation under the\n   configured `cache\u002Ftarget\u002Fbuild\u002Flinux-agent\u002F\u003Carch>\u002F` tree. Source bytes,\n   modes, paths, toolchain inputs, and the sealed builder image define the\n   generation; checkout timestamps never do.\n2. Unpacks the exact target into a temporary directory.\n3. Replaces the config-owned binaries, files, trees, and init script at their\n   configured modes.\n4. Packs beside the target and uses `AtomicReplace`, preserving old hardlinks.\n5. Regenerates the manifest and hash aliases whenever it mutates public assets.\n\nThe complete IronBank asset graph has a visible `assets.pack-initrds` frontier\nafter both architecture lanes and before merge\u002Fboot. It repacks every\narchitecture's private target. The CI-facing `build-assets rootfs|all`\nrail uses the same primitive before upload; `kernel` intentionally keeps its\nminimal initrd until the following rootfs step.\n\nAt boot, `capsem-init` checks if a binary exists in the initrd bundle (`\u002Fbinary`) before falling back to the rootfs path. This means initrd copies always take priority.\n\n## Lesson: permissions are set in TWO places\n\nGuest binary permissions must be 555 (read+execute, no write). There are two independent places that set permissions and both must agree:\n\n1. **Dockerfile.rootfs.j2** -- `chmod 555` when copying into the runtime rootfs asset\n2. **`[initrd].binary_mode` through the gate repacker** -- mode on the initrd copy\n\nThe initrd copy wins at runtime because it overlays the rootfs. Keep both\nlocations at 555 and prove the final archive with\n`tests\u002Fcapsem-build-chain\u002Ftest_pack_initrd.py`.\n","# Initrd Repack\n\n`just exec` composes `capsem-gate pack-initrd` before boot. The gate stages the\nconfigured guest binaries, atomically repacks the host initrd, regenerates its\nmanifest and hash aliases, and then materializes runtime config. `capsem-init`\nprefers these initrd copies over the rootfs copies.\n\nThe authoritative inventory and paths are `[initrd]` in `config\u002Fgate.toml`.\nDo not add a second list to a recipe, test, or gate module.\n\n## Currently repacked binaries\n\n| Binary | What it does |\n|--------|-------------|\n| `capsem-init` | PID 1 init script |\n| `capsem-pty-agent` | PTY-over-vsock bridge agent |\n| `capsem-net-proxy` | TCP-to-vsock relay for air-gapped HTTPS proxying |\n| `capsem-dns-proxy` | UDP\u002FTCP DNS-to-vsock relay |\n| `capsem-mcp-server` | MCP stdio-to-vsock relay for AI agent tool access |\n| `capsem-sysutil` | Guest suspend helper via vsock:5004; in-VM shutdown commands are disabled |\n| `capsem-bench-rs` | Rust guest benchmark helper |\n| `capsem-doctor` | VM self-diagnostic suite (bash script) |\n| `capsem-bench` | Guest benchmark driver (bash script) |\n| `capsem_bench\u002F` | Python benchmark support tree |\n| `diagnostics\u002F` | pytest test files for capsem-doctor |\n\n## Adding a new guest binary\n\nUpdate two authorities, then their behavior tests:\n\n1. **`[initrd].binaries` in `config\u002Fgate.toml`** -- the repacker, static gate,\n   build-chain test, and release asset rail all consume it.\n2. **`guest\u002Fartifacts\u002Fcapsem-init`** -- add the initrd-first deployment\u002Ffallback\n   behavior if the new process is launched during boot.\n\nUpdate this table and add the relevant unit, archive, and in-VM behavior tests.\n\n## When to use which build path\n\n| Changed | Command | Why |\n|---------|---------|-----|\n| Guest binary source (Rust agent code) | `just exec` | Auto-repacks initrd with new binary |\n| `capsem-init` script | `just exec` | Init script is repacked into initrd |\n| `guest\u002Fartifacts\u002Fdiagnostics\u002F*.py` | `just exec \"capsem-doctor\"` | Test files repacked into initrd |\n| `guest\u002Fartifacts\u002Fcapsem-bashrc` | `just build-assets [arch]` | Baked into rootfs, not initrd |\n| Runtime package set (`config\u002Fdocker\u002Fimage\u002Fbuild.toml` `runtime_apt_packages`) | `just build-assets [arch]` | Baked into the runtime rootfs asset |\n| Application tools (AI CLIs, language toolchains) | an OCI image under `images\u002F` | Not part of the runtime; see `\u002Fbuild-images` |\n\n## Guest binary security\n\nAll guest binaries are deployed read-only:\n- **Rootfs**: `chmod 555` in Dockerfile template (rootfs mounted read-only)\n- **Initrd override**: `[initrd].binary_mode` in the gate repacker and `capsem-init` after copying to tmpfs\n- Guest processes cannot modify these binaries at runtime\n\n## How initrd repack works\n\nThe initrd is a gzip+cpio archive. `build_system\u002Fbuilder\u002Fgate\u002Finitrd.py`:\n\n1. Resolves the exact content-addressed Rust payload generation under the\n   configured `cache\u002Ftarget\u002Fbuild\u002Flinux-agent\u002F\u003Carch>\u002F` tree. Source bytes,\n   modes, paths, toolchain inputs, and the sealed builder image define the\n   generation; checkout timestamps never do.\n2. Unpacks the exact target into a temporary directory.\n3. Replaces the config-owned binaries, files, trees, and init script at their\n   configured modes.\n4. Packs beside the target and uses `AtomicReplace`, preserving old hardlinks.\n5. Regenerates the manifest and hash aliases whenever it mutates public assets.\n\nThe complete IronBank asset graph has a visible `assets.pack-initrds` frontier\nafter both architecture lanes and before merge\u002Fboot. It repacks every\narchitecture's private target. The CI-facing `build-assets rootfs|all`\nrail uses the same primitive before upload; `kernel` intentionally keeps its\nminimal initrd until the following rootfs step.\n\nAt boot, `capsem-init` checks if a binary exists in the initrd bundle (`\u002Fbinary`) before falling back to the rootfs path. This means initrd copies always take priority.\n\n## Lesson: permissions are set in TWO places\n\nGuest binary permissions must be 555 (read+execute, no write). There are two independent places that set permissions and both must agree:\n\n1. **Dockerfile.rootfs.j2** -- `chmod 555` when copying into the runtime rootfs asset\n2. **`[initrd].binary_mode` through the gate repacker** -- mode on the initrd copy\n\nThe initrd copy wins at runtime because it overlays the rootfs. Keep both\nlocations at 555 and prove the final archive with\n`tests\u002Fcapsem-build-chain\u002Ftest_pack_initrd.py`.\n",{"name":5,"description":7},"main","d357170bb677125c80cebed720e62bf47bf083ad","skills\u002Fbuild-initrd",26,"https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fcapsem","https:\u002F\u002Fgithub.com\u002Fgoogle","https:\u002F\u002Fopensource.google\u002F","Google ❤️ Open Source","2026-11-04 04:36:10",{"source":8,"skillName":5,"commands":35,"prompt":45,"zipAvailable":46},[36,39,42],{"tool":37,"command":38},"npx","npx skills add google\u002Fcapsem --skill build-initrd",{"tool":40,"command":41},"bunx","bunx skills add google\u002Fcapsem --skill build-initrd",{"tool":43,"command":44},"pnpm","pnpm dlx skills add google\u002Fcapsem --skill build-initrd","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fcapsem\u002Fblob\u002Fmain\u002Fskills\u002Fbuild-initrd\u002FSKILL.md",true,[],[49,63,79,88,95,102],{"skillNo":50,"name":51,"nameZh":6,"description":52,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":53,"categories":54,"keywords":60,"publishedAt":20},"01M699558T2T4DJMBN08ZCQ79K","use-capsem","Run tasks in Capsem VMs through MCP. Use when an agent needs isolated execution, file analysis, or reports returned to the host.","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fcapsem\u002Fblob\u002Fmain\u002Fskills\u002Fuse-capsem\u002FSKILL.md",[55],{"categoryNo":56,"categoryName":57,"taxonomyType":58,"taxonomyTypeDesc":59},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[61,62],"use capsem","MCP",{"skillNo":64,"name":65,"nameZh":6,"description":66,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":67,"categories":68,"keywords":77,"publishedAt":20},"01M69953Z1CSVQ4N07QX529CZY","site-marketing","The marketing website, capsem.org. Use when editing copy, adding sections, or changing the site theme.","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fcapsem\u002Fblob\u002Fmain\u002Fskills\u002Fsite-marketing\u002FSKILL.md",[69,72],{"categoryNo":70,"categoryName":71,"taxonomyType":58,"taxonomyTypeDesc":59},"01JBSEEDCAT000000000000019","营销推广",{"categoryNo":73,"categoryName":74,"taxonomyType":75,"taxonomyTypeDesc":76},"01JBSEEDCAT000000000000035","市场营销","PROFESSION","适用职业",[78],"site marketing",{"skillNo":80,"name":81,"nameZh":6,"description":82,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":83,"categories":84,"keywords":85,"publishedAt":20},"01M69952B33KBBV37N8QTC4191","site-infra","The documentation site, docs.capsem.org. Use for user-directed Diátaxis documentation and Astro Starlight changes.","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fcapsem\u002Fblob\u002Fmain\u002Fskills\u002Fsite-infra\u002FSKILL.md",[],[86,87],"site infra","docs",{"skillNo":89,"name":90,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":91,"categories":92,"keywords":93,"publishedAt":20},"01M69950YKCZKCDB98JDQNBBRJ","site-architecture","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fcapsem\u002Fblob\u002Fmain\u002Fskills\u002Fsite-architecture\u002FSKILL.md",[],[94],"site architecture",{"skillNo":96,"name":97,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":98,"categories":99,"keywords":100,"publishedAt":20},"01M6994Z61JWZ0G2YRJTWFH933","release-process","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fcapsem\u002Fblob\u002Fmain\u002Fskills\u002Frelease-process\u002FSKILL.md",[],[101],"release process",{"skillNo":103,"name":104,"nameZh":6,"description":105,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":106,"categories":107,"keywords":115,"publishedAt":20},"01M6994XKHADM6FBTYTAPG7FYC","meta-skill-creation","Create, improve, and evaluate skills. Use when writing a new skill, editing an existing one, or tuning a description for better triggering.","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fcapsem\u002Fblob\u002Fmain\u002Fskills\u002Fmeta-skill-creation\u002FSKILL.md",[108,111,112],{"categoryNo":109,"categoryName":110,"taxonomyType":58,"taxonomyTypeDesc":59},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":56,"categoryName":57,"taxonomyType":58,"taxonomyTypeDesc":59},{"categoryNo":113,"categoryName":114,"taxonomyType":75,"taxonomyTypeDesc":76},"01JBSEEDCAT000000000000036","内容创作者",[116,117],"meta skill creation","writing"]