fix(images): match SteamCMD platform descriptors to executable support #921

Finding

The published SteamCMD base advertises linux/arm64 in both its OCI index and child configuration. The arm64 child contains x86-64 Bash and dpkg binaries and a 32-bit Intel SteamCMD executable. A native ARM worker can select that child successfully and then fail to start a game. A builder with QEMU registered can hide the error.

Reproduced on November 11, 2026

The pinned Dockerfile foundation is a single amd64 manifest. The image workflow uses QEMU during its multi-platform build. The 12 component images verified by the panel release consumer have a separate publication path. SteamCMD foundation · Image workflow.

Five official game templates inherited the SteamCMD foundation at the audit snapshot. At catalog commit 48b8b65c, the pinned ARK Survival Evolved, Squad, The Isle, Mount & Blade II Bannerlord and Nuclear Option game images each advertised only amd64. Their templates contained no architecture placement constraint. On mixed clusters with no operator-level worker constraint, these five games can therefore land on a node that cannot pull their image. The wrongly advertised arm64 descriptor was verified on the published common base itself. Official catalog · Game build platform.

After this report, upstream switched ARK Survival Evolved to a pinned hermsi/ark-server image and removed its Gameplane Dockerfile. Four in-tree game images still use the SteamCMD foundation at platform commit 7413822. The five-image result above applies to the original pins. Module change · Platform change.

Inspect the advertised arm64 image without executing its contents:

image=ghcr.io/gameplanepanel/gameplane/common-steamcmd@sha256:bae9c352d48a1da0a9207bd0aa00e309ef78521151c6f8910026a99ef28f565c
docker pull --platform linux/arm64 "$image"
container=$(docker create --platform linux/arm64 --network none --entrypoint /bin/false "$image")
scratch=$(mktemp -d)
trap 'docker rm "$container" >/dev/null' EXIT
docker cp -L "${container}:/bin/bash" "$scratch/bash"
docker cp "${container}:/usr/lib/games/steam/steamcmd" "$scratch/steamcmd"
readelf -h "$scratch/bash" "$scratch/steamcmd"

Acceptance

Publish platform descriptors and official module placement rules that reflect executable support. Inventory the derived game images and record the impact on mixed-architecture clusters, including already-pinned artifacts. Qualify each advertised platform by running the actual game image startup path on a matching worker with known emulator settings. Any supported emulated path needs an explicit runtime contract and its own startup and performance evidence. Include a regression check capable of detecting a mislabeled image even when its OCI config agrees with the index.

Observed while qualifying #867. The independent APT mirror repair is #920.