Add a Node golden-image tier

The base tier ships no language toolchain, so setup-node downloads Node every
run. Add a firerunner-node tier that bakes Node.js LTS into the golden rootfs
from the official static tarball, mirroring GitHub's hosted tool cache. Fix the
tiers table, which claimed the base tier shipped Node when the script never
installed it.

Author: linyiru

images/README.md

@@ -20,16 +20,30 @@ milliseconds and is thrown away after the run.
 ## Tiers
 
 Different workloads need different images. Each tier is a separate golden rootfs
-selected by the runner labels a workflow requests.
+selected by the runner label a workflow requests (`runs-on: <tier>`). In the
+scale-set model GitHub routes a job to the scale set whose name matches that
+label, so each tier runs as its own firerunner instance/scale set.
 
 | Tier                      | vCPU / RAM (suggested) | Contents                                              | Use for                                                     |
 | ------------------------- | ---------------------- | ---------------------------------------------------- | ----------------------------------------------------------- |
-| `firerunner-4c8g`         | 4 / 8 GiB              | actions/runner, git, Node LTS + pnpm, build-essential | typical JS/TS builds, tests, lint                           |
+| `firerunner-4c8g`         | 4 / 8 GiB              | actions/runner, git, curl, jq, build-essential base   | generic jobs; toolchains fetched by `setup-*` per workflow  |
+| `firerunner-node`         | 2 / 4 GiB              | everything above **+ Node.js LTS + npm** (baked)      | JS/TS builds where `setup-node` should hit a local toolchain |
 | `firerunner-8c16g-docker` | 8 / 16 GiB            | everything above **+ Docker Engine (dind-capable)**  | jobs using `container:`, service containers, `docker build` |
 
-The Docker tier exists because some pipelines rely on `docker build`, job
-`container:` and service containers, which need a real Docker daemon inside the
-guest.
+The base tier deliberately ships no language toolchain — a workflow's `setup-go`
+/ `setup-node` fetches one per run. Baking a toolchain (the `firerunner-node`
+tier) removes that download, mirroring GitHub's hosted **tool cache**
+(`/opt/hostedtoolcache`). The Docker tier exists because some pipelines rely on
+`docker build`, job `container:` and service containers, which need a real
+Docker daemon inside the guest.
+
+### Running several tiers on one host
+
+Each tier is a distinct scale set, so a host running more than one firerunner
+instance must give each its own network identity or their nftables tables and
+guest subnets collide. Set, per extra instance: `FR_NAME` (the tier label),
+`FR_GOLDEN` (its rootfs), and non-overlapping `FR_TAP_PREFIX`, `FR_NET_BASE`
+(second IP octet, e.g. 17), `FR_NFT_TABLE` and `FR_WORKDIR`.
 
 ## What the boot service does (MMDS → JIT)
 
@@ -58,13 +72,19 @@ sudo ./build-rootfs.sh \
   --tier firerunner-4c8g \
   --runner-version 2.320.0 \
   --out /var/lib/firerunner/golden-4c8g.ext4
+
+# Node tier (bakes Node.js LTS); --node-version overrides the default:
+sudo ./build-rootfs.sh \
+  --tier firerunner-node \
+  --node-version 22.11.0 \
+  --out /var/lib/firerunner/golden-node.ext4
 ```
 
 `build-rootfs.sh` creates/formats the ext4 image, debootstraps a minimal Debian
 base (systemd + git/curl/iproute2), installs `actions/runner` and runs its
 `installdependencies.sh`, drops in the boot service + a static resolv.conf,
-enables the service, and (for the docker tier) installs Docker. The result is an
-immutable file firerunner reflink-clones per job. Requires `debootstrap`,
+enables the service, and (per tier) installs Docker or bakes Node.js. The result
+is an immutable file firerunner reflink-clones per job. Requires `debootstrap`,
 `mkfs.ext4`, `curl` and `tar` on the host.
 
 ## Rebuild policy

images/build-rootfs.sh

@@ -18,6 +18,7 @@ ASSETS="$HERE/assets"
 
 TIER="firerunner-4c8g"
 RUNNER_VERSION=""            # empty => resolve latest from GitHub releases
+NODE_VERSION="22.11.0"       # Node LTS baked into the firerunner-node tier
 OUT=""
 SIZE_MB=8192
 DNS_SERVERS="1.1.1.1 8.8.8.8"
@@ -30,6 +31,7 @@ while [[ $# -gt 0 ]]; do
   case "$1" in
     --tier)           TIER="$2"; shift 2 ;;
     --runner-version) RUNNER_VERSION="$2"; shift 2 ;;
+    --node-version)   NODE_VERSION="$2"; shift 2 ;;
     --out)            OUT="$2"; shift 2 ;;
     --size-mb)        SIZE_MB="$2"; shift 2 ;;
     --dns-servers)    DNS_SERVERS="${2//,/ }"; shift 2 ;;
@@ -44,8 +46,8 @@ done
 [[ -n "$OUT" ]] || die "--out is required"
 
 case "$TIER" in
-  firerunner-4c8g|firerunner-8c16g-docker) ;;
-  *) die "unknown tier: $TIER (want firerunner-4c8g or firerunner-8c16g-docker)" ;;
+  firerunner-4c8g|firerunner-8c16g-docker|firerunner-node) ;;
+  *) die "unknown tier: $TIER (want firerunner-4c8g, firerunner-8c16g-docker or firerunner-node)" ;;
 esac
 
 for t in mkfs.ext4 curl tar debootstrap; do
@@ -137,6 +139,18 @@ if [[ "$TIER" == "firerunner-8c16g-docker" ]]; then
   in_chroot systemctl enable docker.service
 fi
 
+# 6b. (node tier) bake Node.js LTS so runs-on:firerunner-node jobs find node/npm
+#     on PATH without a setup-node download (mirrors GitHub's hosted tool cache).
+#     Installed from the official static tarball into /usr/local (no apt, no
+#     nodesource) to keep the image minimal; --strip-components lands node in
+#     /usr/local/bin.
+if [[ "$TIER" == "firerunner-node" ]]; then
+  echo ">> installing Node.js v$NODE_VERSION for the node tier"
+  node_url="https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-x64.tar.gz"
+  curl -fsSL "$node_url" | tar -xz -C "$MNT/usr/local" --strip-components=1
+  in_chroot /usr/local/bin/node --version
+fi
+
 # Trim apt caches to keep the image lean.
 in_chroot apt-get clean || true
 rm -rf "$MNT/var/lib/apt/lists/"* "$MNT/var/cache/apt/archives/"*.deb