diff --git a/.github/workflows/build-kernel.yml b/.github/workflows/build-kernel.yml
deleted file mode 100644
index 852a7e7..0000000
--- a/.github/workflows/build-kernel.yml
+++ /dev/null
@@ -1,168 +0,0 @@
-name: Build or Retrieve Linux Kernel
-
-on:
-  workflow_call:
-    inputs:
-      kernel_version:
-        description: 'Linux Kernel version to build'
-        required: true
-        type: string
-      defconfig_file:
-        description: 'Path to defconfig JSON'
-        required: true
-        type: string
-      registry:
-        default: 'ghcr.io'
-        required: false
-        type: string
-      arch:
-        type: string
-        required: true
-        default: '["amd64", "arm64"]'
-      runner-arch-map:
-        type: string
-        default: '{"amd64":"ubuntu-22.04", "arm64":"ubuntu-22.04-arm"}'
-        # default: '[{"amd64":"base-dind-2204-amd64", "arm64":"base-dind-2204-arm64"}]'
-    secrets:
-      GIT_CLONE_PAT:
-        required: false
-      # harbor_user:
-      #   required: false
-      # harbor_secret:
-      #   required: false
-
-  # workflow_dispatch:
-  #   inputs:
-  #     kernel_version:
-  #       description: 'Linux Kernel version to build'
-  #       required: true
-  #       type: string
-  #     defconfig_file:
-  #       description: 'Path to defconfig JSON'
-  #       required: true
-  #       type: string
-  #     registry:
-  #       default: 'ghcr.io'
-  #       required: false
-  #       type: string
-  #     arch:
-  #       type: string
-  #       required: true
-  #       default: '["amd64", "arm64"]'
-  #     runner-arch-map:
-  #       type: string
-  #       # default: '[{"amd64":"ubuntu-22.04", "arm64":"ubuntu-22.04-arm"}]'
-  #       default: '[{"amd64":"base-dind-2204-amd64", "arm64":"base-dind-2204-arm64"}]'
-  #   secrets:
-  #     GIT_CLONE_PAT:
-  #       required: false
-  #     harbor_user:
-  #       required: false
-  #     harbor_secret:
-  #       required: false
-      
-env:    
-  REGISTRY: ${{ github.event.inputs.registry || 'ghcr.io' }}
-  # NOTE: We assume that a project named after the repo owner exists in the
-  # registry. The image will be uploaded as <repo_name> under the <repo_owner>
-  # project.
-  REGISTRY_IMAGE: ${{ github.repository }}
-
-jobs:
-  check-artifact:
-    runs-on: ${{ fromJSON(inputs.runner-arch-map)[inputs.arch] }}
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Load defconfig JSON
-        id: defconfig
-        run: |
-          DEFCONFIG=$(jq -c . "${{ inputs.defconfig_file }}")
-          echo "defconfig=$DEFCONFIG" >> $GITHUB_OUTPUT
-      
-      - name: Check if Kernel Artifact Exists
-        id: check
-        run: |
-          echo "Checking for existing artifacts..."
-
-          # Compute the hash of the defconfig contents
-          CONFIG_HASH=$(echo -n "${{ steps.defconfig.outputs.defconfig }}" | md5sum | cut -d ' ' -f 1)
-          echo "Config hash: $CONFIG_HASH"
-
-          # Build the artifact name based on kernel_version and defconfig hash
-          EXPECTED_ARTIFACT="linux-kernel-${{ inputs.kernel_version }}-${CONFIG_HASH}"
-          echo "Expected artifact name: $EXPECTED_ARTIFACT"
-
-          # List artifacts from previous successful runs of the 'Build Linux Kernel' workflow
-          ARTIFACTS=$(curl -s -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \
-            -H "Accept: application/vnd.github.v3+json" \
-            "https://api.github.com/repos/${{ github.repository }}/actions/runs?status=completed&workflow=Build%20Linux%20Kernel" \
-            | jq -r '.workflow_runs[].artifacts_url' | xargs -I {} curl -s -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \
-            -H "Accept: application/vnd.github.v3+json" \
-            {} \
-            | jq -r '.artifacts[].name')
-
-          if echo "$ARTIFACTS" | grep -q "$EXPECTED_ARTIFACT"; then
-            echo "Kernel artifact already exists! Skipping build."
-            echo "exists=true" >> $GITHUB_OUTPUT
-          else
-            echo "No matching artifact found. Proceeding with build."
-            echo "exists=false" >> $GITHUB_OUTPUT
-          fi
-
-      - name: Check if Kernel Artifact Exists
-        id: check-fc
-        run: |
-          echo "Checking for existing artifacts..."
-
-          # Compute the hash of the defconfig contents
-          CONFIG_HASH=$(echo -n "${{ steps.defconfig.outputs.defconfig }}" | md5sum | cut -d ' ' -f 1)
-          echo "Config hash: $CONFIG_HASH"
-
-          # Build the artifact name based on kernel_version and defconfig hash
-          EXPECTED_ARTIFACT="linux-kernel-fc-${{ inputs.kernel_version }}-${CONFIG_HASH}"
-          echo "Expected artifact name: $EXPECTED_ARTIFACT"
-
-          # List artifacts from previous successful runs of the 'Build Linux Kernel' workflow
-          ARTIFACTS=$(curl -s -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \
-            -H "Accept: application/vnd.github.v3+json" \
-            "https://api.github.com/repos/${{ github.repository }}/actions/runs?status=completed&workflow=Build%20Linux%20Kernel" \
-            | jq -r '.workflow_runs[].artifacts_url' | xargs -I {} curl -s -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \
-            -H "Accept: application/vnd.github.v3+json" \
-            {} \
-            | jq -r '.artifacts[].name')
-
-          if echo "$ARTIFACTS" | grep -q "$EXPECTED_ARTIFACT"; then
-            echo "Kernel artifact already exists! Skipping build."
-            echo "exists=true" >> $GITHUB_OUTPUT
-          else
-            echo "No matching artifact found. Proceeding with build."
-            echo "exists=false" >> $GITHUB_OUTPUT
-          fi
-
-      - name: Build Linux Kernel
-        if: ${{ steps.check.outputs.exists == 'false' || steps.check-fc.outputs.exists == 'false' }}
-        run: |
-          git clone --depth 1 --branch v${{ inputs.kernel_version }} https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git linux-source
-          cd linux-source
-          sudo apt-get update
-          sudo apt-get install -y build-essential flex bison libssl-dev libelf-dev bc
-          echo "${{ inputs.defconfig }}" > .config
-          make olddefconfig
-          make -j$(nproc)
-          CONFIG_HASH=$(echo -n "${{ steps.defconfig.outputs.defconfig }}" | md5sum | cut -d ' ' -f 1)
-          echo "config_hash=${CONFIG_HASH}" >> $GITHUB_ENV
-
-      - name: Archive Kernel Artifact
-        if: ${{ steps.check.outputs.exists == 'false' || steps.check-fc.outputs.exists == 'false' }}
-        uses: actions/upload-artifact@v4
-        with:
-          name: linux-kernel-${{ inputs.kernel_version }}-${{ env.config_hash }}
-          path: linux-source/arch/x86/boot/bzImage
-
-      - name: Archive Kernel Artifact FC
-        if: ${{ steps.check.outputs.exists == 'false' || steps.check-fc.outputs.exists == 'false' }}
-        uses: actions/upload-artifact@v4
-        with:
-          name: linux-kernel-fc-${{ inputs.kernel_version }}-${{ env.config_hash }}
-          path: linux-source/vmlinux
diff --git a/.github/workflows/build-linux-kernels.yml b/.github/workflows/build-linux-kernels.yml
new file mode 100644
index 0000000..5f4a4f9
--- /dev/null
+++ b/.github/workflows/build-linux-kernels.yml
@@ -0,0 +1,511 @@
+name: Build kernels
+
+# Builds the Linux guest kernels laid out as linux_kernel/<name>/defconfig-<arch>
+# and publishes each directory as two signed multi-arch images, one with the
+# uncompressed and one with the compressed kernel, each at /.boot/kernel:
+#
+#   linux_kernel/<name>/defconfig-<arch> -> ghcr.io/<repo>/linux-kernel:<name>
+#                                           ghcr.io/<repo>/linux-kernel:<name>-compressed
+#
+# As in Kata Containers, the GPL source is the unmodified kernel.org release
+# named in the image labels plus the defconfig and this workflow; the image
+# also carries the kernel license and the expanded .config.
+#
+# A defconfig pins its kernel version with a `# KVER=x.y.z` line; without one
+# it gets the latest longterm release, resolved once per run. All defconfigs
+# in a directory must end up on the same version. On push and pull_request
+# only the changed directories are built; pull requests build without pushing
+# and get a comment linking the built kernels.
+# Kernels are reproducible: the source is verified against the kernel.org
+# release keys, the compiler is pinned by digest and build metadata is fixed.
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - 'linux_kernel/**'
+      - '.github/workflows/build-linux-kernels.yml'
+  pull_request:
+    branches:
+      - main
+    paths:
+      - 'linux_kernel/**'
+      - '.github/workflows/build-linux-kernels.yml'
+  workflow_dispatch:
+    inputs:
+      filter:
+        description: "Only build this kernel (generic or linux_kernel/generic); empty builds all"
+        type: string
+        default: ''
+
+permissions:
+  contents: read
+
+# A new push to a pull request cancels its previous run. Pushes and manual
+# runs each get their own group so they always finish: a run only builds the
+# kernels its push changed, so a cancelled or replaced run would never publish
+# them, and a cancel mid-publish could leave images pushed but unsigned.
+concurrency:
+  group: >-
+    ${{ github.event_name == 'pull_request'
+    && format('{0}-{1}', github.workflow, github.event.pull_request.number)
+    || github.run_id }}
+  cancel-in-progress: true
+
+env:
+  REGISTRY: ghcr.io
+  REGISTRY_IMAGE: ghcr.io/${{ github.repository }}/linux-kernel
+  GCC_IMAGE: gcc:15.2.0@sha256:3ae15afe768b06d0c0fe088d822ba5f8045c26630bdacc8d8e7713cf5d8e7289
+
+jobs:
+  discover:
+    name: Discover kernels to build
+    runs-on: ubuntu-22.04
+    permissions:
+      contents: read
+      pull-requests: read # paths-filter lists PR files through the API
+    outputs:
+      builds: ${{ steps.scan.outputs.builds }}
+      images: ${{ steps.scan.outputs.images }}
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+
+    # Lists the changed files on push and pull_request. Manual runs build
+    # every kernel, or only the one named in the filter input, so they skip it.
+    - name: Find changed kernels
+      id: changes
+      if: ${{ github.event_name != 'workflow_dispatch' }}
+      uses: dorny/paths-filter@0e4a8c6effa4802afeda77dc8d303f8176d7dfad # v3.0.4
+      with:
+        list-files: json
+        filters: |
+          kernels:
+            - 'linux_kernel/**'
+          workflow:
+            - '.github/workflows/build-linux-kernels.yml'
+
+    # Emits one build per defconfig and one image per directory, e.g.
+    #   builds: [{"name":"generic","arch":"amd64","kver":"6.18.57"}, ...]
+    #   images: [{"name":"generic","kver":"6.18.57","arches":["amd64","arm64"]}]
+    # On push and pull_request only the linux_kernel/<name>/ directories with
+    # changed files are built, unless this workflow changed, which builds
+    # every kernel.
+    - name: Discover kernels
+      id: scan
+      env:
+        MODE: >-
+          ${{ (github.event_name == 'workflow_dispatch' || steps.changes.outputs.workflow == 'true')
+          && 'all' || 'changed' }}
+        CHANGED_FILES: ${{ steps.changes.outputs.kernels_files }}
+        FILTER: ${{ inputs.filter }}
+      run: |
+        set -euo pipefail
+
+        CHANGED_DIRS=null
+        if [ "$MODE" = changed ]; then
+          CHANGED_DIRS=$(jq -c 'map(split("/")[0:2] | join("/")) | unique' <<< "${CHANGED_FILES:-[]}")
+        fi
+
+        # Accept the filter as a name (generic) or a path (linux_kernel/generic/).
+        FILTER=${FILTER#linux_kernel/}
+        FILTER=${FILTER%/}
+
+        LTS=$(curl -sSf https://www.kernel.org/releases.json | jq -r '
+          [.releases[] | select(.moniker == "longterm") | .version]
+          | max_by(split(".") | map(tonumber))')
+        echo "Latest longterm release: $LTS"
+
+        ENTRIES=$(find linux_kernel -mindepth 2 -maxdepth 2 -type f -name 'defconfig-*' | sort \
+          | while read -r f; do
+              kver=$(sed -n 's/^#[[:space:]]*KVER=\([0-9.]*\)[[:space:]]*$/\1/p' "$f" | head -n1)
+              echo "$(cut -d/ -f2 <<< "$f") ${f##*/defconfig-} ${kver:-$LTS}"
+            done)
+
+        BUILDS=$(jq -R -s -c --argjson changed "$CHANGED_DIRS" --arg filter "$FILTER" '
+          split("\n")
+          | map(select(length > 0) | split(" ") | {name: .[0], arch: .[1], kver: .[2]})
+          | map(select(($changed == null) or (("linux_kernel/" + .name) as $d | any($changed[]; . == $d))))
+          | map(select(($filter == "") or .name == $filter))
+        ' <<< "$ENTRIES")
+
+        if [ -n "$FILTER" ] && [ "$BUILDS" = "[]" ]; then
+          echo "::error::No kernel named '${FILTER}': expected linux_kernel/${FILTER}/defconfig-<arch>"
+          exit 1
+        fi
+
+        UNKNOWN=$(jq -r 'map(select(.arch != "amd64" and .arch != "arm64")
+          | "linux_kernel/\(.name)/defconfig-\(.arch)") | join(" ")' <<< "$BUILDS")
+        if [ -n "$UNKNOWN" ]; then
+          echo "::error::Unsupported architecture (use defconfig-amd64 or defconfig-arm64): ${UNKNOWN}"
+          exit 1
+        fi
+
+        MIXED=$(jq -r 'group_by(.name)[] | select(map(.kver) | unique | length > 1)
+          | "\(.[0].name): \(map("\(.arch)=\(.kver)") | join(", "))"' <<< "$BUILDS")
+        if [ -n "$MIXED" ]; then
+          echo "::error::Defconfigs in one directory must use the same kernel version: $MIXED"
+          exit 1
+        fi
+
+        IMAGES=$(jq -c 'group_by(.name) | map({name: .[0].name, kver: .[0].kver, arches: map(.arch)})' <<< "$BUILDS")
+
+        echo "Kernels to build: $BUILDS"
+        echo "builds=$BUILDS" >> "$GITHUB_OUTPUT"
+        echo "images=$IMAGES" >> "$GITHUB_OUTPUT"
+
+  build:
+    name: build ${{ matrix.name }}/${{ matrix.arch }}
+    needs: discover
+    if: ${{ needs.discover.outputs.builds != '[]' }}
+    runs-on: ${{ matrix.arch == 'arm64' && 'ubuntu-22.04-arm' || 'ubuntu-22.04' }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include: ${{ fromJSON(needs.discover.outputs.builds) }}
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+
+    # Releases are signed over the uncompressed tarball: x.y by Linus Torvalds,
+    # stable x.y.z by Greg Kroah-Hartman. Their keys are fetched over WKD, but
+    # only a signature by one of the pinned primary keys below is accepted.
+    - name: Fetch and verify kernel source
+      env:
+        KVER: ${{ matrix.kver }}
+      run: |
+        set -euo pipefail
+        URL="https://cdn.kernel.org/pub/linux/kernel/v${KVER%%.*}.x/linux-${KVER}"
+        curl -sSfLO "${URL}.tar.xz"
+        curl -sSfLO "${URL}.tar.sign"
+
+        GNUPGHOME=$(mktemp -d)
+        export GNUPGHOME
+        gpg --batch --auto-key-locate clear,wkd --locate-keys torvalds@kernel.org gregkh@kernel.org
+        # gpg explains a failure (bad signature, missing key) on stderr, and
+        # the || true lets it reach the error below instead of exiting here.
+        SIGNER=$(xz -dc "linux-${KVER}.tar.xz" \
+          | gpg --batch --status-fd 1 --verify "linux-${KVER}.tar.sign" - \
+          | awk '$2 == "VALIDSIG" { print $NF }') || true
+        case "$SIGNER" in
+          ABAF11C65A2970B130ABE3C479BE3E4300411886) echo "Signed by Linus Torvalds" ;;
+          647F28654894E3BD457199BE38DBBDC86092693E) echo "Signed by Greg Kroah-Hartman" ;;
+          *) echo "::error::linux-${KVER}.tar.xz is not signed by a trusted key"; exit 1 ;;
+        esac
+
+        tar -xf "linux-${KVER}.tar.xz"
+
+    # Expands the defconfig, fails if any =y symbol lost its dependencies (a
+    # missing built-in would leave the guest unable to mount its root), and
+    # builds the kernel both uncompressed (vmlinux on x86, booted via PVH;
+    # Image on arm64) and compressed (bzImage; Image.gz), since monitors
+    # differ in which they boot. The compressed target depends on the
+    # uncompressed one, so one make builds both. The build runs in the pinned
+    # compiler image at a fixed path with fixed KBUILD metadata so it is
+    # reproducible; bc, bison, flex and libelf only build host tools and do
+    # not end up in the kernel.
+    - name: Build kernel
+      env:
+        NAME: ${{ matrix.name }}
+        ARCH: ${{ matrix.arch }}
+        KVER: ${{ matrix.kver }}
+      run: |
+        set -euo pipefail
+        case "$ARCH" in
+          amd64) KARCH=x86_64 SRCARCH=x86 TARGET=bzImage IMG=vmlinux ZIMG=arch/x86/boot/bzImage ;;
+          arm64) KARCH=arm64 SRCARCH=arm64 TARGET=Image.gz IMG=arch/arm64/boot/Image ZIMG=arch/arm64/boot/Image.gz ;;
+          *) echo "::error::Unsupported architecture $ARCH"; exit 1 ;;
+        esac
+
+        mkdir -p out/uncompressed out/compressed
+        docker run --rm \
+          -v "$PWD/linux-${KVER}:/build/linux" \
+          -v "$PWD/linux_kernel/${NAME}/defconfig-${ARCH}:/defconfig:ro" \
+          -v "$PWD/out:/out" \
+          -w /build/linux \
+          -e KARCH="$KARCH" -e SRCARCH="$SRCARCH" -e TARGET="$TARGET" -e IMG="$IMG" -e ZIMG="$ZIMG" \
+          -e OWNER="$(id -u):$(id -g)" \
+          -e KBUILD_BUILD_TIMESTAMP='Thu Jan  1 00:00:00 UTC 1970' \
+          -e KBUILD_BUILD_USER=urunc \
+          -e KBUILD_BUILD_HOST=unikernel-build \
+          -e KBUILD_BUILD_VERSION=1 \
+          "$GCC_IMAGE" bash -euo pipefail -c '
+            apt-get update -qq
+            apt-get install -y -qq --no-install-recommends bc bison flex libelf-dev > /dev/null
+
+            cp /defconfig "arch/${SRCARCH}/configs/urunc_defconfig"
+            make ARCH="$KARCH" urunc_defconfig
+            MISSING=$(grep -E "^CONFIG_[A-Z0-9_]+=y$" /defconfig | grep -vxFf .config || true)
+            if [ -n "$MISSING" ]; then
+              echo "::error::Symbols not built in after expanding the defconfig:" $MISSING
+              exit 1
+            fi
+
+            make ARCH="$KARCH" -j"$(nproc)" "$TARGET"
+            cp "$IMG" /out/uncompressed/kernel
+            cp "$ZIMG" /out/compressed/kernel
+            cp .config /out/uncompressed/config
+            cp .config /out/compressed/config
+            chown -R "$OWNER" /out
+          '
+        echo "Built linux ${KVER} for ${ARCH}: $(du -h out/uncompressed/kernel | cut -f1) uncompressed, $(du -h out/compressed/kernel | cut -f1) compressed"
+
+        # Each format gets its own artifact holding exactly what its image
+        # ships: the kernel, the config and the license, since the GPL travels
+        # with the binary. source.sha256 records which tarball it was built
+        # from, and size/ the unzipped size for the pull request comment, as
+        # the artifacts API only reports the zipped one.
+        SUM=$(sha256sum "linux-${KVER}.tar.xz" | cut -d' ' -f1)
+        mkdir -p size
+        for variant in uncompressed compressed; do
+          dir="out/${variant}"
+          mkdir -p "${dir}/LICENSES/preferred" "${dir}/LICENSES/exceptions"
+          cp "linux-${KVER}/COPYING" "${dir}/"
+          cp "linux-${KVER}/LICENSES/preferred/GPL-2.0" "${dir}/LICENSES/preferred/"
+          cp "linux-${KVER}/LICENSES/exceptions/Linux-syscall-note" "${dir}/LICENSES/exceptions/"
+          echo "$SUM" > "${dir}/source.sha256"
+          find "$dir" -type f -printf '%s\n' | awk '{ total += $1 } END { print total }' > "size/${variant}"
+        done
+
+    - name: Upload uncompressed kernel
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+      with:
+        name: kernel-${{ matrix.name }}-${{ matrix.arch }}-uncompressed
+        path: out/uncompressed/
+
+    - name: Upload compressed kernel
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+      with:
+        name: kernel-${{ matrix.name }}-${{ matrix.arch }}-compressed
+        path: out/compressed/
+
+    - name: Upload kernel sizes
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+      with:
+        name: size-kernel-${{ matrix.name }}-${{ matrix.arch }}
+        path: size/
+
+  # Pull requests from this repository get one comment, updated on every push,
+  # linking the kernels each build produced. Pull requests from forks only
+  # get a read-only token, so they are skipped.
+  comment:
+    name: Comment on pull request
+    needs: [discover, build]
+    if: >-
+      ${{ !cancelled() && github.event_name == 'pull_request'
+      && github.event.pull_request.head.repo.full_name == github.repository
+      && needs.discover.result == 'success' && needs.discover.outputs.builds != '[]' }}
+    runs-on: ubuntu-22.04
+    permissions:
+      actions: read
+      pull-requests: write
+    steps:
+    # Fails when no build succeeded; the comment then reports every build as
+    # failed instead of not being posted.
+    - name: Download kernel sizes
+      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+      continue-on-error: true
+      with:
+        pattern: size-kernel-*
+        path: sizes
+
+    - name: Comment with the built kernels
+      uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
+      env:
+        BUILDS: ${{ needs.discover.outputs.builds }}
+      with:
+        script: |
+          const fs = require('fs');
+          const mib = bytes => `${(bytes / 2 ** 20).toFixed(1)} MiB`;
+          const builds = JSON.parse(process.env.BUILDS);
+          const { owner, repo } = context.repo;
+          const issue_number = context.issue.number;
+          const runUrl = `${context.serverUrl}/${owner}/${repo}/actions/runs/${context.runId}`;
+          const artifacts = await github.paginate(github.rest.actions.listWorkflowRunArtifacts,
+            { owner, repo, run_id: context.runId });
+
+          // One cell per format: a link to its artifact with both sizes.
+          const cell = (b, variant) => {
+            const name = `kernel-${b.name}-${b.arch}-${variant}`;
+            const a = artifacts.find(a => a.name === name);
+            if (!a) return 'build failed';
+            const sizeFile = `sizes/size-kernel-${b.name}-${b.arch}/${variant}`;
+            const unzipped = fs.existsSync(sizeFile)
+              ? `, ${mib(Number(fs.readFileSync(sizeFile, 'utf8')))} unzipped` : '';
+            return `[${name}](${runUrl}/artifacts/${a.id}) (${mib(a.size_in_bytes)} zipped${unzipped})`;
+          };
+          const rows = builds.map(b =>
+            `| \`${b.name}\` | ${b.arch} | ${b.kver} | ${cell(b, 'uncompressed')} | ${cell(b, 'compressed')} |`);
+          const names = [...new Set(builds.map(b => b.name))];
+          const marker = '<!-- kernels-build -->';
+          const body = [
+            marker,
+            '### Kernel builds',
+            '',
+            '| Kernel | Arch | Linux | Uncompressed | Compressed |',
+            '| --- | --- | --- | --- | --- |',
+            ...rows,
+            '',
+            `On merge: ${names.flatMap(n => [n, `${n}-compressed`])
+              .map(t => `\`${process.env.REGISTRY_IMAGE}:${t}\``).join(', ')}`,
+            '',
+            `[Workflow run](${runUrl})`,
+          ].join('\n');
+
+          const comments = await github.paginate(github.rest.issues.listComments,
+            { owner, repo, issue_number });
+          const existing = comments.find(c => c.body?.includes(marker));
+          if (existing) {
+            await github.rest.issues.updateComment({ owner, repo, comment_id: existing.id, body });
+          } else {
+            await github.rest.issues.createComment({ owner, repo, issue_number, body });
+          }
+
+  # One image per directory, published only if every arch of it built, so a
+  # failed build elsewhere does not hold back unrelated kernels.
+  publish:
+    name: publish ${{ matrix.name }}
+    needs: [discover, build]
+    if: >-
+      ${{ !cancelled() && github.event_name != 'pull_request'
+      && needs.discover.result == 'success' && needs.discover.outputs.images != '[]' }}
+    runs-on: ubuntu-22.04
+    permissions:
+      contents: read
+      id-token: write # for signing the images
+      packages: write
+    strategy:
+      fail-fast: false
+      matrix:
+        include: ${{ fromJSON(needs.discover.outputs.images) }}
+    steps:
+    # Full history, to check whether a newer commit changed this kernel.
+    - name: Checkout code
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      with:
+        fetch-depth: 0
+
+    - name: Download kernels
+      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+      with:
+        pattern: kernel-${{ matrix.name }}-*
+        path: dist
+
+    # Pin the buildkit daemon: different buildkit versions produce different
+    # layers from the same inputs, which would break reproducible images.
+    - name: Set up Docker Buildx
+      uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
+      with:
+        driver-opts: image=moby/buildkit:v0.34.0
+
+    - name: Install Cosign
+      uses: sigstore/cosign-installer@e1523de7571e31dbe865fd2e80c5c7c23ae71eb4 # v3.4.0
+
+    - name: Log into registry ${{ env.REGISTRY }}
+      uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
+      with:
+        registry: ${{ env.REGISTRY }}
+        username: ${{ github.actor }}
+        password: ${{ secrets.GITHUB_TOKEN }}
+
+    # As in Kata Containers, the kernel's GPL source is the unmodified
+    # kernel.org release plus this repository: each image ships the license
+    # and the expanded .config next to the kernel, and its labels name the
+    # exact tarball and defconfig it was built from. The commit is carried by
+    # the <name>-<kver>-<sha> tag and the signature rather than a label, so an
+    # unchanged kernel keeps its digest. The kernel version is part of that
+    # tag because an unpinned defconfig follows the latest LTS: re-running a
+    # commit after a new release then gets a new tag instead of moving the
+    # old one. The uncompressed and the compressed kernel are separate images,
+    # each at /.boot/kernel, so a pull fetches only the format the monitor
+    # boots: <name> and <name>-compressed, each also tagged -<kver> and
+    # -<kver>-<sha>. Per-arch images are pushed by digest only and combined
+    # into a signed index; bunnyfiles should pin the per-arch digest.
+    - name: Publish ${{ env.REGISTRY_IMAGE }}:${{ matrix.name }}
+      env:
+        NAME: ${{ matrix.name }}
+        KVER: ${{ matrix.kver }}
+        ARCHES: ${{ toJSON(matrix.arches) }}
+        SHA: ${{ github.sha }}
+        DEFAULT_BRANCH: ${{ github.ref == format('refs/heads/{0}', github.event.repository.default_branch) }}
+        MAIN: ${{ github.event.repository.default_branch }}
+      run: |
+        set -euo pipefail
+        TARBALL="https://cdn.kernel.org/pub/linux/kernel/v${KVER%%.*}.x/linux-${KVER}.tar.xz"
+        for arch in $(jq -r '.[]' <<< "$ARCHES"); do
+          for variant in uncompressed compressed; do
+            if [ ! -f "dist/kernel-${NAME}-${arch}-${variant}/kernel" ]; then
+              echo "::error::No ${variant} ${arch} kernel was built for ${NAME}"
+              exit 1
+            fi
+          done
+        done
+
+        # Runs on the default branch never cancel each other, so an older run
+        # can finish after a newer one. Only move the shared <name> and
+        # <name>-<kver> tags if no newer commit changed this kernel or this
+        # workflow; otherwise leave them to the newer run.
+        LATEST=false
+        if [ "$DEFAULT_BRANCH" = true ]; then
+          git fetch --quiet origin "$MAIN"
+          NEWER=$(git log --format=%h "${SHA}..FETCH_HEAD" -- \
+            "linux_kernel/${NAME}" .github/workflows/build-linux-kernels.yml)
+          if [ -z "$NEWER" ]; then
+            LATEST=true
+          else
+            echo "::notice::Newer commits change ${NAME} (${NEWER//$'\n'/, }); only tagging ${NAME}-${KVER}-${SHA}"
+          fi
+        fi
+
+        for variant in uncompressed compressed; do
+          TAG="${NAME}"
+          if [ "$variant" = compressed ]; then
+            TAG="${NAME}-compressed"
+          fi
+
+          KERNELS=()
+          for arch in $(jq -r '.[]' <<< "$ARCHES"); do
+            CTX="dist/kernel-${NAME}-${arch}-${variant}"
+            # FROM scratch + COPY needs no emulation for the foreign arch.
+            # Clamp every timestamp to the epoch so identical kernels produce
+            # identical image digests.
+            printf 'FROM scratch\nCOPY kernel config COPYING /.boot/\nCOPY LICENSES /.boot/LICENSES\n' \
+              | docker buildx build \
+                --platform "linux/${arch}" \
+                --file - \
+                --build-arg SOURCE_DATE_EPOCH=0 \
+                --label "org.opencontainers.image.version=${KVER}" \
+                --label "org.opencontainers.image.licenses=GPL-2.0-only WITH Linux-syscall-note" \
+                --label "org.opencontainers.image.source=https://github.com/${GITHUB_REPOSITORY}" \
+                --label "com.urunc.kernel.format=${variant}" \
+                --label "com.urunc.kernel.tarball=${TARBALL}" \
+                --label "com.urunc.kernel.tarball.sha256=$(cat "${CTX}/source.sha256")" \
+                --label "com.urunc.kernel.defconfig=linux_kernel/${NAME}/defconfig-${arch}" \
+                --provenance=false \
+                --output "type=image,name=${REGISTRY_IMAGE},push-by-digest=true,name-canonical=true,push=true,rewrite-timestamp=true" \
+                --metadata-file "meta-${variant}-${arch}.json" \
+                "$CTX"
+            KERNEL="${REGISTRY_IMAGE}@$(jq -r '."containerimage.digest"' "meta-${variant}-${arch}.json")"
+            echo "${variant} ${arch}: ${KERNEL}"
+            KERNELS+=("$KERNEL")
+          done
+
+          TAGS=(-t "${REGISTRY_IMAGE}:${TAG}-${KVER}-${SHA}")
+          if [ "$LATEST" = true ]; then
+            TAGS+=(-t "${REGISTRY_IMAGE}:${TAG}" -t "${REGISTRY_IMAGE}:${TAG}-${KVER}")
+          fi
+          docker buildx imagetools create "${TAGS[@]}" "${KERNELS[@]}"
+          DIGEST=$(docker buildx imagetools inspect "${REGISTRY_IMAGE}:${TAG}-${KVER}-${SHA}" --format '{{json .Manifest}}' | jq -r .digest)
+          echo "${variant} index: ${REGISTRY_IMAGE}@${DIGEST}"
+
+          # --recursive also signs each per-arch image, which is what
+          # bunnyfiles pin and what cosign verify gets pointed at.
+          cosign sign --yes --recursive "${REGISTRY_IMAGE}@${DIGEST}" \
+            -a "repo=${GITHUB_REPOSITORY}" \
+            -a "workflow=${GITHUB_WORKFLOW}" \
+            -a "ref=${SHA}" \
+            -a "kernel=${KVER}" \
+            -a "format=${variant}" \
+            -a "author=Nubificus LTD"
+        done
diff --git a/.github/workflows/oci.yml b/.github/workflows/oci.yml
index ac9e9fb..9e1cd22 100644
--- a/.github/workflows/oci.yml
+++ b/.github/workflows/oci.yml
@@ -130,22 +130,7 @@ jobs:
       postfix: ${{ matrix.postfix }}
     secrets: inherit
 
-  # build-linux-kernel:
-  #   strategy:
-  #     fail-fast: false
-  #     matrix:
-  #       archconfig: [ amd64, arm64 ]
-  #   uses: ./.github/workflows/build-kernel.yml
-  #   with:
-  #     kernel_version: "6.14"
-  #     # unikernel: ${{ matrix.unikernel }}
-  #     # hypervisor: ${{ matrix.hypervisor }}
-  #     defconfig_file: "configs/defconfig.json"
-  #     arch: ${{ matrix.archconfig }}
-  #   secrets: inherit
-
   build-linux-unikernels:
-    # needs: build-linux-kernel
     strategy:
       matrix:
         unikernel: [ nginx, redis ]
diff --git a/LICENSE b/LICENSE
new file mode 100644
index 0000000..d645695
--- /dev/null
+++ b/LICENSE
@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/README.md b/README.md
index 26ba712..a364c99 100644
--- a/README.md
+++ b/README.md
@@ -1 +1,143 @@
-# unikernel-build
\ No newline at end of file
+# unikernel-build
+
+## Linux kernels
+
+The guest kernels used by the Linux images are built from defconfigs in
+`linux_kernel/<name>/defconfig-<arch>`, where `<arch>` is `amd64` or `arm64`.
+A directory can hold one or both. Each directory is one kernel, published as
+two images signed with cosign: one with the uncompressed kernel and one with
+the compressed kernel, so each guest pulls only the format its monitor boots.
+Each image has an entry for every `defconfig-<arch>` file in the directory:
+
+```
+linux_kernel/<name>/defconfig-<arch>  ->  ghcr.io/urunc-dev/unikernel-build/linux-kernel:<name>
+                                          ghcr.io/urunc-dev/unikernel-build/linux-kernel:<name>-compressed
+```
+
+### Kernel version
+
+Pin the kernel version with a `# KVER=x.y.z` line in the defconfig:
+
+```
+# KVER=6.12.113
+CONFIG_LOCALVERSION="-urunc"
+...
+```
+
+Without that line the kernel is built from the latest
+[longterm release](https://www.kernel.org/category/releases.html) at build
+time. All defconfigs in one directory must end up on the same version.
+`make savedefconfig` drops comments, so re-add the `# KVER=` line after
+regenerating a defconfig.
+
+### Adding or changing a kernel
+
+1. Start from an existing defconfig in a kernel tree of the version you want,
+   change the configuration, and save it back as a defconfig. For example,
+   for amd64:
+
+   ```sh
+   cp linux_kernel/generic/defconfig-amd64 linux-<version>/arch/x86/configs/urunc_defconfig
+   cd linux-<version>
+   make ARCH=x86_64 urunc_defconfig
+   make ARCH=x86_64 menuconfig
+   make ARCH=x86_64 savedefconfig    # writes ./defconfig
+   ```
+
+   For arm64 use `arch/arm64/configs/` and `ARCH=arm64`.
+2. Save the result as `linux_kernel/<name>/defconfig-<arch>`, one file for
+   each architecture you need (one or both), and add the `# KVER=` line if you
+   want a pinned version.
+3. Open a pull request. CI builds every changed directory and comments on the
+   pull request with links to the built kernels. Nothing is published.
+4. When the pull request is merged, the kernels are published.
+
+### What CI checks
+
+- The kernel.org tarball must carry a valid signature from Linus Torvalds or
+  Greg Kroah-Hartman.
+- Every symbol the defconfig sets to `=y` must still be `=y` after the
+  defconfig is expanded. A symbol whose dependencies are missing fails the
+  build, rather than shipping a kernel that cannot mount its root.
+- Builds are designed to be reproducible: they run in a compiler image pinned
+  by digest with fixed build metadata, and image timestamps are clamped, so
+  the same defconfig and kernel version should produce the same image digest.
+
+### Published images
+
+| Tag | Points to |
+| --- | --- |
+| `<name>` | The latest build from `main` |
+| `<name>-<kver>` | The latest build of that kernel version from `main` |
+| `<name>-<kver>-<commit sha>` | That kernel version built from that commit |
+
+The compressed images use the same tags with `-compressed` after the name:
+`<name>-compressed`, `<name>-compressed-<kver>` and
+`<name>-compressed-<kver>-<commit sha>`.
+
+A defconfig without a `# KVER=` line follows the latest LTS, so building the
+same commit again after a new release produces a newer kernel. It gets its own
+`-<kver>-<commit sha>` tag instead of replacing the earlier one.
+
+| Image | `/.boot/kernel` on amd64 | `/.boot/kernel` on arm64 |
+| --- | --- | --- |
+| `<name>` | `vmlinux` (uncompressed ELF) | `Image` |
+| `<name>-compressed` | `bzImage` | `Image.gz` |
+
+Both images also contain:
+
+| Path | Contents |
+| --- | --- |
+| `/.boot/config` | The full expanded `.config` |
+| `/.boot/COPYING`, `/.boot/LICENSES/` | The kernel license |
+
+The image labels record the kernel version, whether the kernel is compressed
+(`com.urunc.kernel.format`), the source tarball URL and its SHA-256, and the
+defconfig it was built from.
+
+### Using a kernel in a bunnyfile
+
+Pick the uncompressed or compressed image depending on what the monitor
+boots, and reference it by the digest of the image for that architecture,
+not by tag or by the multi-arch index:
+
+```sh
+docker buildx imagetools inspect ghcr.io/urunc-dev/unikernel-build/linux-kernel:generic
+```
+
+```yaml
+kernel:
+  from: ghcr.io/urunc-dev/unikernel-build/linux-kernel@sha256:<amd64 digest>
+  path: /.boot/kernel
+```
+
+### Building a kernel locally
+
+Build on a host of the target architecture, so no cross-compiler is needed:
+
+```sh
+KVER=6.18.57
+curl -LO https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-${KVER}.tar.xz
+tar -xf linux-${KVER}.tar.xz
+cp linux_kernel/generic/defconfig-amd64 linux-${KVER}/arch/x86/configs/urunc_defconfig
+cd linux-${KVER}
+make ARCH=x86_64 urunc_defconfig
+make ARCH=x86_64 -j"$(nproc)" bzImage    # also builds vmlinux
+```
+
+This produces `vmlinux` and `arch/x86/boot/bzImage`. On arm64 use
+`arch/arm64/configs/`, `ARCH=arm64` and the `Image.gz` target, which produces
+`arch/arm64/boot/Image` and `arch/arm64/boot/Image.gz`. A local build is not bit-for-bit identical
+to the CI one. For that, use the pinned compiler image and the `KBUILD_BUILD_*`
+settings from the "Build kernel" step in `.github/workflows/build-linux-kernels.yml`.
+
+## License
+
+The files in this repository are licensed under the [Apache License 2.0](LICENSE).
+
+That license does not extend to:
+
+- The submodules (`mirage-skeleton`, `unikernel-httpreply`, `unikernel-redis`), which keep their own licenses.
+- The software inside the published images:
+  - The Linux kernels are licensed under `GPL-2.0-only WITH Linux-syscall-note`. Each is built from an unmodified [kernel.org](https://kernel.org) release, using the defconfig under `linux_kernel/` and `.github/workflows/build-linux-kernels.yml`. Each `linux-kernel` image ships the license and the expanded `.config` under `/.boot/`. Its labels name the exact source tarball and its SHA-256 (`com.urunc.kernel.tarball`, `com.urunc.kernel.tarball.sha256`) and the defconfig it was built from (`com.urunc.kernel.defconfig`).
+  - The unikernel frameworks, applications and root filesystems in the images are under their own licenses.
diff --git a/linux_kernel/generic/defconfig-amd64 b/linux_kernel/generic/defconfig-amd64
new file mode 100644
index 0000000..f94e003
--- /dev/null
+++ b/linux_kernel/generic/defconfig-amd64
@@ -0,0 +1,375 @@
+# KVER=6.18.57
+CONFIG_LOCALVERSION="-urunc"
+# CONFIG_LOCALVERSION_AUTO is not set
+CONFIG_SYSVIPC=y
+CONFIG_POSIX_MQUEUE=y
+# CONFIG_CROSS_MEMORY_ATTACH is not set
+CONFIG_NO_HZ_FULL=y
+CONFIG_NO_HZ=y
+CONFIG_HIGH_RES_TIMERS=y
+CONFIG_BPF_SYSCALL=y
+# CONFIG_BPF_UNPRIV_DEFAULT_OFF is not set
+# CONFIG_PREEMPT_DYNAMIC is not set
+CONFIG_TASKSTATS=y
+CONFIG_TASK_DELAY_ACCT=y
+CONFIG_TASK_XACCT=y
+CONFIG_TASK_IO_ACCOUNTING=y
+CONFIG_PSI=y
+CONFIG_PSI_DEFAULT_DISABLED=y
+CONFIG_CGROUPS=y
+CONFIG_MEMCG=y
+CONFIG_BLK_CGROUP=y
+CONFIG_CGROUP_SCHED=y
+CONFIG_CFS_BANDWIDTH=y
+CONFIG_CGROUP_PIDS=y
+CONFIG_CGROUP_FREEZER=y
+CONFIG_CGROUP_HUGETLB=y
+CONFIG_CPUSETS=y
+CONFIG_CGROUP_DEVICE=y
+CONFIG_CGROUP_CPUACCT=y
+CONFIG_CGROUP_PERF=y
+CONFIG_CGROUP_BPF=y
+# CONFIG_TIME_NS is not set
+CONFIG_USER_NS=y
+CONFIG_BLK_DEV_INITRD=y
+# CONFIG_RD_GZIP is not set
+# CONFIG_RD_BZIP2 is not set
+# CONFIG_RD_LZMA is not set
+# CONFIG_RD_XZ is not set
+# CONFIG_RD_LZO is not set
+# CONFIG_RD_LZ4 is not set
+# CONFIG_RD_ZSTD is not set
+# CONFIG_INITRAMFS_PRESERVE_MTIME is not set
+CONFIG_SYSFS_SYSCALL=y
+CONFIG_SMP=y
+CONFIG_X86_FRED=y
+# CONFIG_X86_EXTENDED_PLATFORM is not set
+# CONFIG_SCHED_OMIT_FRAME_POINTER is not set
+CONFIG_HYPERVISOR_GUEST=y
+CONFIG_PARAVIRT=y
+CONFIG_PVH=y
+CONFIG_NR_CPUS=240
+# CONFIG_X86_MCE is not set
+# CONFIG_PERF_EVENTS_INTEL_UNCORE is not set
+# CONFIG_PERF_EVENTS_INTEL_RAPL is not set
+# CONFIG_PERF_EVENTS_INTEL_CSTATE is not set
+# CONFIG_PERF_EVENTS_AMD_UNCORE is not set
+# CONFIG_X86_IOPL_IOPERM is not set
+CONFIG_X86_MSR=y
+CONFIG_X86_CPUID=y
+CONFIG_NUMA=y
+# CONFIG_AMD_NUMA is not set
+# CONFIG_X86_64_ACPI_NUMA is not set
+# CONFIG_MTRR_SANITIZER is not set
+# CONFIG_X86_KERNEL_IBT is not set
+# CONFIG_X86_INTEL_MEMORY_PROTECTION_KEYS is not set
+# CONFIG_RANDOMIZE_MEMORY is not set
+CONFIG_LEGACY_VSYSCALL_NONE=y
+# CONFIG_MITIGATION_RETHUNK is not set
+# CONFIG_MITIGATION_IBPB_ENTRY is not set
+# CONFIG_MITIGATION_IBRS_ENTRY is not set
+# CONFIG_MITIGATION_GDS is not set
+# CONFIG_MITIGATION_RFDS is not set
+# CONFIG_MITIGATION_SPECTRE_BHI is not set
+# CONFIG_MITIGATION_MDS is not set
+# CONFIG_MITIGATION_TAA is not set
+# CONFIG_MITIGATION_MMIO_STALE_DATA is not set
+# CONFIG_MITIGATION_L1TF is not set
+# CONFIG_MITIGATION_SPECTRE_V1 is not set
+# CONFIG_MITIGATION_SPECTRE_V2 is not set
+# CONFIG_MITIGATION_SRBDS is not set
+# CONFIG_MITIGATION_SSB is not set
+# CONFIG_SUSPEND is not set
+# CONFIG_ACPI_SPCR_TABLE is not set
+# CONFIG_ACPI_REV_OVERRIDE_POSSIBLE is not set
+# CONFIG_ACPI_AC is not set
+# CONFIG_ACPI_BATTERY is not set
+# CONFIG_ACPI_BUTTON is not set
+# CONFIG_ACPI_FAN is not set
+# CONFIG_ACPI_THERMAL is not set
+# CONFIG_ACPI_DEBUG is not set
+CONFIG_ACPI_PCI_SLOT=y
+CONFIG_CPU_FREQ=y
+CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE=y
+CONFIG_X86_INTEL_PSTATE=y
+# CONFIG_HALTPOLL_CPUIDLE is not set
+# CONFIG_VIRTUALIZATION is not set
+# CONFIG_SCHED_CLUSTER is not set
+# CONFIG_SCHED_MC is not set
+# CONFIG_BLOCK_LEGACY_AUTOLOAD is not set
+CONFIG_BLK_DEV_THROTTLING=y
+# CONFIG_BLK_DEBUG_FS is not set
+# CONFIG_MQ_IOSCHED_DEADLINE is not set
+# CONFIG_MQ_IOSCHED_KYBER is not set
+# CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS is not set
+CONFIG_BINFMT_MISC=y
+# CONFIG_SLAB_MERGE_DEFAULT is not set
+# CONFIG_SLUB_CPU_PARTIAL is not set
+# CONFIG_COMPAT_BRK is not set
+CONFIG_PAGE_REPORTING=y
+CONFIG_LRU_GEN=y
+CONFIG_NET=y
+CONFIG_PACKET=y
+CONFIG_PACKET_DIAG=y
+CONFIG_UNIX=y
+CONFIG_XFRM_USER=y
+CONFIG_XFRM_SUB_POLICY=y
+CONFIG_INET=y
+CONFIG_IP_MULTICAST=y
+CONFIG_IP_PNP=y
+CONFIG_IP_PNP_DHCP=y
+# CONFIG_INET_DIAG is not set
+CONFIG_TCP_CONG_ADVANCED=y
+# CONFIG_TCP_CONG_BIC is not set
+# CONFIG_TCP_CONG_CUBIC is not set
+# CONFIG_TCP_CONG_WESTWOOD is not set
+# CONFIG_TCP_CONG_HTCP is not set
+CONFIG_TCP_CONG_BBR=y
+CONFIG_TCP_MD5SIG=y
+# CONFIG_IPV6_SIT is not set
+CONFIG_IPV6_MULTIPLE_TABLES=y
+CONFIG_NETWORK_SECMARK=y
+CONFIG_NETFILTER=y
+# CONFIG_NETFILTER_EGRESS is not set
+CONFIG_NF_CONNTRACK=y
+CONFIG_NF_CONNTRACK_ZONES=y
+CONFIG_NF_CONNTRACK_EVENTS=y
+CONFIG_NF_CONNTRACK_TIMEOUT=y
+CONFIG_NF_CONNTRACK_TIMESTAMP=y
+CONFIG_NF_CONNTRACK_AMANDA=y
+CONFIG_NF_CONNTRACK_FTP=y
+CONFIG_NF_CONNTRACK_H323=y
+CONFIG_NF_CONNTRACK_IRC=y
+CONFIG_NF_CONNTRACK_NETBIOS_NS=y
+CONFIG_NF_CONNTRACK_SNMP=y
+CONFIG_NF_CONNTRACK_PPTP=y
+CONFIG_NF_CONNTRACK_SANE=y
+CONFIG_NF_CONNTRACK_SIP=y
+CONFIG_NF_CONNTRACK_TFTP=y
+CONFIG_NF_CT_NETLINK=y
+CONFIG_NF_CT_NETLINK_TIMEOUT=y
+CONFIG_NF_CT_NETLINK_HELPER=y
+CONFIG_NETFILTER_NETLINK_GLUE_CT=y
+CONFIG_NF_NAT=y
+CONFIG_NETFILTER_XT_SET=y
+CONFIG_NETFILTER_XT_TARGET_CLASSIFY=y
+CONFIG_NETFILTER_XT_TARGET_CONNMARK=y
+CONFIG_NETFILTER_XT_TARGET_HMARK=y
+CONFIG_NETFILTER_XT_TARGET_IDLETIMER=y
+CONFIG_NETFILTER_XT_TARGET_LOG=y
+CONFIG_NETFILTER_XT_TARGET_MARK=y
+CONFIG_NETFILTER_XT_NAT=y
+CONFIG_NETFILTER_XT_TARGET_NETMAP=y
+CONFIG_NETFILTER_XT_TARGET_NFLOG=y
+CONFIG_NETFILTER_XT_TARGET_NFQUEUE=y
+CONFIG_NETFILTER_XT_TARGET_REDIRECT=y
+CONFIG_NETFILTER_XT_TARGET_MASQUERADE=y
+CONFIG_NETFILTER_XT_TARGET_TEE=y
+CONFIG_NETFILTER_XT_TARGET_TCPMSS=y
+CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=y
+CONFIG_NETFILTER_XT_MATCH_BPF=y
+CONFIG_NETFILTER_XT_MATCH_CGROUP=y
+CONFIG_NETFILTER_XT_MATCH_CLUSTER=y
+CONFIG_NETFILTER_XT_MATCH_COMMENT=y
+CONFIG_NETFILTER_XT_MATCH_CONNBYTES=y
+CONFIG_NETFILTER_XT_MATCH_CONNLABEL=y
+CONFIG_NETFILTER_XT_MATCH_CONNLIMIT=y
+CONFIG_NETFILTER_XT_MATCH_CONNMARK=y
+CONFIG_NETFILTER_XT_MATCH_CONNTRACK=y
+CONFIG_NETFILTER_XT_MATCH_CPU=y
+CONFIG_NETFILTER_XT_MATCH_DCCP=y
+CONFIG_NETFILTER_XT_MATCH_DEVGROUP=y
+CONFIG_NETFILTER_XT_MATCH_DSCP=y
+CONFIG_NETFILTER_XT_MATCH_ESP=y
+CONFIG_NETFILTER_XT_MATCH_HASHLIMIT=y
+CONFIG_NETFILTER_XT_MATCH_HELPER=y
+CONFIG_NETFILTER_XT_MATCH_IPCOMP=y
+CONFIG_NETFILTER_XT_MATCH_IPRANGE=y
+CONFIG_NETFILTER_XT_MATCH_IPVS=y
+CONFIG_NETFILTER_XT_MATCH_L2TP=y
+CONFIG_NETFILTER_XT_MATCH_LENGTH=y
+CONFIG_NETFILTER_XT_MATCH_LIMIT=y
+CONFIG_NETFILTER_XT_MATCH_MAC=y
+CONFIG_NETFILTER_XT_MATCH_MARK=y
+CONFIG_NETFILTER_XT_MATCH_MULTIPORT=y
+CONFIG_NETFILTER_XT_MATCH_NFACCT=y
+CONFIG_NETFILTER_XT_MATCH_OSF=y
+CONFIG_NETFILTER_XT_MATCH_OWNER=y
+CONFIG_NETFILTER_XT_MATCH_POLICY=y
+CONFIG_NETFILTER_XT_MATCH_PKTTYPE=y
+CONFIG_NETFILTER_XT_MATCH_QUOTA=y
+CONFIG_NETFILTER_XT_MATCH_RATEEST=y
+CONFIG_NETFILTER_XT_MATCH_REALM=y
+CONFIG_NETFILTER_XT_MATCH_RECENT=y
+CONFIG_NETFILTER_XT_MATCH_SCTP=y
+CONFIG_NETFILTER_XT_MATCH_STATE=y
+CONFIG_NETFILTER_XT_MATCH_STATISTIC=y
+CONFIG_NETFILTER_XT_MATCH_STRING=y
+CONFIG_NETFILTER_XT_MATCH_TCPMSS=y
+CONFIG_NETFILTER_XT_MATCH_TIME=y
+CONFIG_NETFILTER_XT_MATCH_U32=y
+CONFIG_IP_SET=y
+CONFIG_IP_SET_BITMAP_IP=y
+CONFIG_IP_SET_BITMAP_IPMAC=y
+CONFIG_IP_SET_BITMAP_PORT=y
+CONFIG_IP_SET_HASH_IP=y
+CONFIG_IP_SET_HASH_IPMARK=y
+CONFIG_IP_SET_HASH_IPPORT=y
+CONFIG_IP_SET_HASH_IPPORTIP=y
+CONFIG_IP_SET_HASH_IPPORTNET=y
+CONFIG_IP_SET_HASH_MAC=y
+CONFIG_IP_SET_HASH_NETPORTNET=y
+CONFIG_IP_SET_HASH_NET=y
+CONFIG_IP_SET_HASH_NETNET=y
+CONFIG_IP_SET_HASH_NETPORT=y
+CONFIG_IP_SET_HASH_NETIFACE=y
+CONFIG_IP_SET_LIST_SET=y
+CONFIG_IP_VS=y
+CONFIG_IP_VS_PROTO_TCP=y
+CONFIG_IP_VS_PROTO_UDP=y
+CONFIG_IP_VS_PROTO_ESP=y
+CONFIG_IP_VS_PROTO_AH=y
+CONFIG_IP_VS_PROTO_SCTP=y
+CONFIG_IP_VS_RR=y
+CONFIG_IP_VS_WRR=y
+CONFIG_IP_VS_LC=y
+CONFIG_IP_VS_WLC=y
+CONFIG_IP_VS_FO=y
+CONFIG_IP_VS_OVF=y
+CONFIG_IP_VS_LBLC=y
+CONFIG_IP_VS_LBLCR=y
+CONFIG_IP_VS_DH=y
+CONFIG_IP_VS_SH=y
+CONFIG_IP_VS_SED=y
+CONFIG_IP_VS_NQ=y
+CONFIG_IP_VS_FTP=y
+CONFIG_IP_VS_PE_SIP=y
+CONFIG_NF_TPROXY_IPV4=y
+CONFIG_NF_LOG_IPV4=y
+CONFIG_NF_REJECT_IPV4=y
+CONFIG_IP_NF_IPTABLES=y
+CONFIG_IP_NF_MATCH_AH=y
+CONFIG_IP_NF_MATCH_ECN=y
+CONFIG_IP_NF_MATCH_TTL=y
+CONFIG_IP_NF_TARGET_SYNPROXY=y
+CONFIG_NF_DUP_IPV6=y
+CONFIG_NF_LOG_IPV6=y
+CONFIG_BRIDGE=y
+CONFIG_NET_SCHED=y
+CONFIG_NET_SCH_MULTIQ=y
+CONFIG_NET_SCH_FQ_CODEL=y
+CONFIG_NET_SCH_FQ=y
+CONFIG_NET_CLS_CGROUP=y
+CONFIG_NET_EMATCH=y
+CONFIG_VSOCKETS=y
+# CONFIG_VSOCKETS_DIAG is not set
+# CONFIG_VSOCKETS_LOOPBACK is not set
+CONFIG_VIRTIO_VSOCKETS=y
+# CONFIG_PCPU_DEV_REFCNT is not set
+CONFIG_CGROUP_NET_PRIO=y
+# CONFIG_WIRELESS is not set
+CONFIG_NET_9P=y
+# CONFIG_NET_9P_FD is not set
+CONFIG_NET_9P_VIRTIO=y
+# CONFIG_ETHTOOL_NETLINK is not set
+CONFIG_PCI=y
+CONFIG_PCIEPORTBUS=y
+CONFIG_PCI_MSI=y
+CONFIG_DEVTMPFS=y
+CONFIG_DEVTMPFS_MOUNT=y
+CONFIG_DEVTMPFS_SAFE=y
+# CONFIG_STANDALONE is not set
+# CONFIG_PREVENT_FIRMWARE_BUILD is not set
+# CONFIG_DMIID is not set
+# CONFIG_PNP_DEBUG_MESSAGES is not set
+CONFIG_BLK_DEV_LOOP=y
+CONFIG_BLK_DEV_RAM=y
+CONFIG_VIRTIO_BLK=y
+# CONFIG_INTEL_MEI is not set
+CONFIG_NETDEVICES=y
+CONFIG_TUN=y
+CONFIG_VETH=y
+CONFIG_VIRTIO_NET=y
+# CONFIG_ETHERNET is not set
+# CONFIG_WLAN is not set
+# CONFIG_INPUT_KEYBOARD is not set
+# CONFIG_INPUT_MOUSE is not set
+# CONFIG_SERIO is not set
+# CONFIG_LEGACY_PTYS is not set
+# CONFIG_LEGACY_TIOCSTI is not set
+# CONFIG_LDISC_AUTOLOAD is not set
+CONFIG_SERIAL_8250=y
+# CONFIG_SERIAL_8250_DEPRECATED_OPTIONS is not set
+CONFIG_SERIAL_8250_CONSOLE=y
+# CONFIG_SERIAL_8250_EXAR is not set
+# CONFIG_SERIAL_8250_LPSS is not set
+# CONFIG_SERIAL_8250_MID is not set
+# CONFIG_SERIAL_8250_PERICOM is not set
+CONFIG_VIRTIO_CONSOLE=y
+# CONFIG_HW_RANDOM_INTEL is not set
+# CONFIG_HW_RANDOM_AMD is not set
+# CONFIG_HW_RANDOM_VIA is not set
+CONFIG_HW_RANDOM_VIRTIO=y
+# CONFIG_DEVMEM is not set
+# CONFIG_DEVPORT is not set
+CONFIG_PTP_1588_CLOCK=y
+# CONFIG_HWMON is not set
+# CONFIG_X86_PKG_TEMP_THERMAL is not set
+# CONFIG_HID_SUPPORT is not set
+# CONFIG_USB_SUPPORT is not set
+CONFIG_VIRTIO_PCI=y
+CONFIG_VIRTIO_MMIO=y
+CONFIG_VIRTIO_MMIO_CMDLINE_DEVICES=y
+# CONFIG_VHOST_MENU is not set
+# CONFIG_SURFACE_PLATFORMS is not set
+# CONFIG_X86_PLATFORM_DEVICES is not set
+CONFIG_INTEL_IOMMU=y
+# CONFIG_INTEL_IOMMU_DEFAULT_ON is not set
+# CONFIG_INTEL_IOMMU_SCALABLE_MODE_DEFAULT_ON is not set
+# CONFIG_INTEL_IOMMU_PERF_EVENTS is not set
+CONFIG_IRQ_REMAP=y
+CONFIG_VIRTIO_IOMMU=y
+CONFIG_EXT4_FS=y
+CONFIG_EXT4_FS_POSIX_ACL=y
+CONFIG_EXT4_FS_SECURITY=y
+CONFIG_EXPORTFS_BLOCK_OPS=y
+CONFIG_FANOTIFY=y
+CONFIG_AUTOFS_FS=y
+CONFIG_FUSE_FS=y
+CONFIG_VIRTIO_FS=y
+# CONFIG_FUSE_PASSTHROUGH is not set
+CONFIG_OVERLAY_FS=y
+# CONFIG_OVERLAY_FS_REDIRECT_ALWAYS_FOLLOW is not set
+CONFIG_OVERLAY_FS_INDEX=y
+CONFIG_OVERLAY_FS_XINO_AUTO=y
+CONFIG_OVERLAY_FS_METACOPY=y
+CONFIG_TMPFS=y
+CONFIG_TMPFS_XATTR=y
+CONFIG_HUGETLBFS=y
+CONFIG_EROFS_FS=y
+# CONFIG_EROFS_FS_POSIX_ACL is not set
+# CONFIG_EROFS_FS_BACKED_BY_FILE is not set
+CONFIG_9P_FS=y
+CONFIG_9P_FS_POSIX_ACL=y
+CONFIG_9P_FS_SECURITY=y
+CONFIG_KEYS=y
+CONFIG_SECURITY=y
+CONFIG_SECURITY_NETWORK=y
+# CONFIG_INTEGRITY is not set
+CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,selinux,smack,tomoyo,apparmor,ipe,bpf"
+CONFIG_INIT_STACK_NONE=y
+CONFIG_CRYPTO_CRYPTD=y
+CONFIG_CRYPTO_SHA256=y
+CONFIG_CRYPTO_CRC32C=y
+CONFIG_CRYPTO_DEFLATE=y
+CONFIG_CRYPTO_ANSI_CPRNG=y
+CONFIG_CRYPTO_USER_API_HASH=y
+# CONFIG_CRYPTO_USER_API_ENABLE_OBSOLETE is not set
+CONFIG_CRYPTO_AES_NI_INTEL=y
+# CONFIG_CRYPTO_HW is not set
+CONFIG_XZ_DEC=y
+CONFIG_PRINTK_TIME=y
+CONFIG_CONSOLE_LOGLEVEL_DEFAULT=4
+# CONFIG_SYMBOLIC_ERRNAME is not set
+CONFIG_DEBUG_FS=y
+# CONFIG_RUNTIME_TESTING_MENU is not set
diff --git a/linux_kernel/generic/defconfig-arm64 b/linux_kernel/generic/defconfig-arm64
new file mode 100644
index 0000000..33bde95
--- /dev/null
+++ b/linux_kernel/generic/defconfig-arm64
@@ -0,0 +1,367 @@
+# KVER=6.18.57
+CONFIG_LOCALVERSION="-urunc"
+# CONFIG_LOCALVERSION_AUTO is not set
+CONFIG_SYSVIPC=y
+CONFIG_POSIX_MQUEUE=y
+# CONFIG_CROSS_MEMORY_ATTACH is not set
+CONFIG_NO_HZ_FULL=y
+CONFIG_NO_HZ=y
+CONFIG_HIGH_RES_TIMERS=y
+CONFIG_BPF_SYSCALL=y
+# CONFIG_BPF_UNPRIV_DEFAULT_OFF is not set
+CONFIG_TASKSTATS=y
+CONFIG_TASK_DELAY_ACCT=y
+CONFIG_TASK_XACCT=y
+CONFIG_TASK_IO_ACCOUNTING=y
+CONFIG_PSI=y
+CONFIG_PSI_DEFAULT_DISABLED=y
+CONFIG_CGROUPS=y
+CONFIG_MEMCG=y
+CONFIG_BLK_CGROUP=y
+CONFIG_CGROUP_SCHED=y
+CONFIG_CFS_BANDWIDTH=y
+CONFIG_CGROUP_PIDS=y
+CONFIG_CGROUP_FREEZER=y
+CONFIG_CGROUP_HUGETLB=y
+CONFIG_CPUSETS=y
+CONFIG_CGROUP_DEVICE=y
+CONFIG_CGROUP_CPUACCT=y
+CONFIG_CGROUP_BPF=y
+CONFIG_NAMESPACES=y
+CONFIG_USER_NS=y
+CONFIG_BLK_DEV_INITRD=y
+# CONFIG_RD_GZIP is not set
+# CONFIG_RD_BZIP2 is not set
+# CONFIG_RD_LZMA is not set
+# CONFIG_RD_XZ is not set
+# CONFIG_RD_LZO is not set
+# CONFIG_RD_LZ4 is not set
+# CONFIG_RD_ZSTD is not set
+# CONFIG_INITRAMFS_PRESERVE_MTIME is not set
+CONFIG_SYSFS_SYSCALL=y
+CONFIG_EXPERT=y
+# CONFIG_AMPERE_ERRATUM_AC03_CPU_38 is not set
+# CONFIG_ARM64_ERRATUM_1319367 is not set
+# CONFIG_ARM64_ERRATUM_1530923 is not set
+CONFIG_ARM64_ERRATUM_1286807=y
+# CONFIG_ARM64_ERRATUM_1508412 is not set
+# CONFIG_ARM64_ERRATUM_2051678 is not set
+# CONFIG_ARM64_ERRATUM_2077057 is not set
+# CONFIG_ARM64_ERRATUM_2658417 is not set
+# CONFIG_ARM64_ERRATUM_2054223 is not set
+# CONFIG_ARM64_ERRATUM_2067961 is not set
+# CONFIG_ARM64_ERRATUM_2645198 is not set
+# CONFIG_ARM64_ERRATUM_2966298 is not set
+# CONFIG_ARM64_ERRATUM_3117295 is not set
+# CONFIG_ARM64_ERRATUM_3194386 is not set
+# CONFIG_CAVIUM_ERRATUM_22375 is not set
+# CONFIG_CAVIUM_ERRATUM_23154 is not set
+# CONFIG_CAVIUM_ERRATUM_27456 is not set
+# CONFIG_CAVIUM_ERRATUM_30115 is not set
+# CONFIG_CAVIUM_TX2_ERRATUM_219 is not set
+# CONFIG_FUJITSU_ERRATUM_010001 is not set
+# CONFIG_HISILICON_ERRATUM_161600802 is not set
+# CONFIG_HISILICON_ERRATUM_162100801 is not set
+# CONFIG_QCOM_FALKOR_ERRATUM_1003 is not set
+# CONFIG_QCOM_FALKOR_ERRATUM_1009 is not set
+# CONFIG_QCOM_QDF2400_ERRATUM_0065 is not set
+# CONFIG_QCOM_FALKOR_ERRATUM_E1041 is not set
+# CONFIG_NVIDIA_CARMEL_CNP_ERRATUM is not set
+# CONFIG_ROCKCHIP_ERRATUM_3588001 is not set
+# CONFIG_SOCIONEXT_SYNQUACER_PREITS is not set
+CONFIG_ARM64_VA_BITS_48=y
+CONFIG_NR_CPUS=255
+CONFIG_PARAVIRT=y
+# CONFIG_ARM64_TAGGED_ADDR_ABI is not set
+# CONFIG_ARM64_USE_LSE_ATOMICS is not set
+# CONFIG_ARM64_PTR_AUTH is not set
+# CONFIG_ARM64_AMU_EXTN is not set
+# CONFIG_ARM64_TLB_RANGE is not set
+# CONFIG_ARM64_BTI is not set
+# CONFIG_ARM64_E0PD is not set
+# CONFIG_ARM64_EPAN is not set
+# CONFIG_ARM64_POE is not set
+CONFIG_ARM64_PSEUDO_NMI=y
+CONFIG_RANDOMIZE_BASE=y
+# CONFIG_RANDOMIZE_MODULE_REGION_FULL is not set
+# CONFIG_EFI is not set
+# CONFIG_SUSPEND is not set
+CONFIG_CPU_IDLE=y
+CONFIG_CPU_FREQ=y
+CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE=y
+# CONFIG_SCHED_CLUSTER is not set
+# CONFIG_BLOCK_LEGACY_AUTOLOAD is not set
+CONFIG_BLK_DEV_THROTTLING=y
+# CONFIG_BLK_DEBUG_FS is not set
+# CONFIG_MQ_IOSCHED_DEADLINE is not set
+# CONFIG_MQ_IOSCHED_KYBER is not set
+# CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS is not set
+# CONFIG_SLAB_MERGE_DEFAULT is not set
+# CONFIG_SLUB_CPU_PARTIAL is not set
+# CONFIG_COMPAT_BRK is not set
+CONFIG_PAGE_REPORTING=y
+CONFIG_LRU_GEN=y
+CONFIG_NET=y
+CONFIG_PACKET=y
+CONFIG_PACKET_DIAG=y
+CONFIG_UNIX=y
+CONFIG_XFRM_USER=y
+CONFIG_XFRM_SUB_POLICY=y
+CONFIG_INET=y
+CONFIG_IP_MULTICAST=y
+CONFIG_IP_PNP=y
+CONFIG_IP_PNP_DHCP=y
+# CONFIG_INET_DIAG is not set
+CONFIG_TCP_CONG_ADVANCED=y
+# CONFIG_TCP_CONG_BIC is not set
+# CONFIG_TCP_CONG_CUBIC is not set
+# CONFIG_TCP_CONG_WESTWOOD is not set
+# CONFIG_TCP_CONG_HTCP is not set
+CONFIG_TCP_CONG_BBR=y
+CONFIG_TCP_MD5SIG=y
+# CONFIG_IPV6_SIT is not set
+CONFIG_IPV6_MULTIPLE_TABLES=y
+CONFIG_NETWORK_SECMARK=y
+CONFIG_NETFILTER=y
+# CONFIG_NETFILTER_EGRESS is not set
+CONFIG_NF_CONNTRACK=y
+CONFIG_NF_CONNTRACK_ZONES=y
+CONFIG_NF_CONNTRACK_EVENTS=y
+CONFIG_NF_CONNTRACK_TIMEOUT=y
+CONFIG_NF_CONNTRACK_TIMESTAMP=y
+CONFIG_NF_CONNTRACK_AMANDA=y
+CONFIG_NF_CONNTRACK_FTP=y
+CONFIG_NF_CONNTRACK_H323=y
+CONFIG_NF_CONNTRACK_IRC=y
+CONFIG_NF_CONNTRACK_NETBIOS_NS=y
+CONFIG_NF_CONNTRACK_SNMP=y
+CONFIG_NF_CONNTRACK_PPTP=y
+CONFIG_NF_CONNTRACK_SANE=y
+CONFIG_NF_CONNTRACK_SIP=y
+CONFIG_NF_CONNTRACK_TFTP=y
+CONFIG_NF_CT_NETLINK=y
+CONFIG_NF_CT_NETLINK_TIMEOUT=y
+CONFIG_NF_CT_NETLINK_HELPER=y
+CONFIG_NETFILTER_NETLINK_GLUE_CT=y
+CONFIG_NF_NAT=y
+CONFIG_NETFILTER_XT_SET=y
+CONFIG_NETFILTER_XT_TARGET_CLASSIFY=y
+CONFIG_NETFILTER_XT_TARGET_CONNMARK=y
+CONFIG_NETFILTER_XT_TARGET_HMARK=y
+CONFIG_NETFILTER_XT_TARGET_IDLETIMER=y
+CONFIG_NETFILTER_XT_TARGET_LOG=y
+CONFIG_NETFILTER_XT_TARGET_MARK=y
+CONFIG_NETFILTER_XT_NAT=y
+CONFIG_NETFILTER_XT_TARGET_NETMAP=y
+CONFIG_NETFILTER_XT_TARGET_NFLOG=y
+CONFIG_NETFILTER_XT_TARGET_NFQUEUE=y
+CONFIG_NETFILTER_XT_TARGET_REDIRECT=y
+CONFIG_NETFILTER_XT_TARGET_MASQUERADE=y
+CONFIG_NETFILTER_XT_TARGET_TEE=y
+CONFIG_NETFILTER_XT_TARGET_TCPMSS=y
+CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=y
+CONFIG_NETFILTER_XT_MATCH_BPF=y
+CONFIG_NETFILTER_XT_MATCH_CGROUP=y
+CONFIG_NETFILTER_XT_MATCH_CLUSTER=y
+CONFIG_NETFILTER_XT_MATCH_COMMENT=y
+CONFIG_NETFILTER_XT_MATCH_CONNBYTES=y
+CONFIG_NETFILTER_XT_MATCH_CONNLABEL=y
+CONFIG_NETFILTER_XT_MATCH_CONNLIMIT=y
+CONFIG_NETFILTER_XT_MATCH_CONNMARK=y
+CONFIG_NETFILTER_XT_MATCH_CONNTRACK=y
+CONFIG_NETFILTER_XT_MATCH_CPU=y
+CONFIG_NETFILTER_XT_MATCH_DCCP=y
+CONFIG_NETFILTER_XT_MATCH_DEVGROUP=y
+CONFIG_NETFILTER_XT_MATCH_DSCP=y
+CONFIG_NETFILTER_XT_MATCH_ESP=y
+CONFIG_NETFILTER_XT_MATCH_HASHLIMIT=y
+CONFIG_NETFILTER_XT_MATCH_HELPER=y
+CONFIG_NETFILTER_XT_MATCH_IPCOMP=y
+CONFIG_NETFILTER_XT_MATCH_IPRANGE=y
+CONFIG_NETFILTER_XT_MATCH_IPVS=y
+CONFIG_NETFILTER_XT_MATCH_L2TP=y
+CONFIG_NETFILTER_XT_MATCH_LENGTH=y
+CONFIG_NETFILTER_XT_MATCH_LIMIT=y
+CONFIG_NETFILTER_XT_MATCH_MAC=y
+CONFIG_NETFILTER_XT_MATCH_MARK=y
+CONFIG_NETFILTER_XT_MATCH_MULTIPORT=y
+CONFIG_NETFILTER_XT_MATCH_NFACCT=y
+CONFIG_NETFILTER_XT_MATCH_OSF=y
+CONFIG_NETFILTER_XT_MATCH_OWNER=y
+CONFIG_NETFILTER_XT_MATCH_POLICY=y
+CONFIG_NETFILTER_XT_MATCH_PKTTYPE=y
+CONFIG_NETFILTER_XT_MATCH_QUOTA=y
+CONFIG_NETFILTER_XT_MATCH_RATEEST=y
+CONFIG_NETFILTER_XT_MATCH_REALM=y
+CONFIG_NETFILTER_XT_MATCH_RECENT=y
+CONFIG_NETFILTER_XT_MATCH_SCTP=y
+CONFIG_NETFILTER_XT_MATCH_STATE=y
+CONFIG_NETFILTER_XT_MATCH_STATISTIC=y
+CONFIG_NETFILTER_XT_MATCH_STRING=y
+CONFIG_NETFILTER_XT_MATCH_TCPMSS=y
+CONFIG_NETFILTER_XT_MATCH_TIME=y
+CONFIG_NETFILTER_XT_MATCH_U32=y
+CONFIG_IP_SET=y
+CONFIG_IP_SET_BITMAP_IP=y
+CONFIG_IP_SET_BITMAP_IPMAC=y
+CONFIG_IP_SET_BITMAP_PORT=y
+CONFIG_IP_SET_HASH_IP=y
+CONFIG_IP_SET_HASH_IPMARK=y
+CONFIG_IP_SET_HASH_IPPORT=y
+CONFIG_IP_SET_HASH_IPPORTIP=y
+CONFIG_IP_SET_HASH_IPPORTNET=y
+CONFIG_IP_SET_HASH_MAC=y
+CONFIG_IP_SET_HASH_NETPORTNET=y
+CONFIG_IP_SET_HASH_NET=y
+CONFIG_IP_SET_HASH_NETNET=y
+CONFIG_IP_SET_HASH_NETPORT=y
+CONFIG_IP_SET_HASH_NETIFACE=y
+CONFIG_IP_SET_LIST_SET=y
+CONFIG_IP_VS=y
+CONFIG_IP_VS_PROTO_TCP=y
+CONFIG_IP_VS_PROTO_UDP=y
+CONFIG_IP_VS_PROTO_ESP=y
+CONFIG_IP_VS_PROTO_AH=y
+CONFIG_IP_VS_PROTO_SCTP=y
+CONFIG_IP_VS_RR=y
+CONFIG_IP_VS_WRR=y
+CONFIG_IP_VS_LC=y
+CONFIG_IP_VS_WLC=y
+CONFIG_IP_VS_FO=y
+CONFIG_IP_VS_OVF=y
+CONFIG_IP_VS_LBLC=y
+CONFIG_IP_VS_LBLCR=y
+CONFIG_IP_VS_DH=y
+CONFIG_IP_VS_SH=y
+CONFIG_IP_VS_SED=y
+CONFIG_IP_VS_NQ=y
+CONFIG_IP_VS_FTP=y
+CONFIG_IP_VS_PE_SIP=y
+CONFIG_NF_TPROXY_IPV4=y
+CONFIG_NF_LOG_IPV4=y
+CONFIG_NF_REJECT_IPV4=y
+CONFIG_IP_NF_IPTABLES=y
+CONFIG_IP_NF_MATCH_AH=y
+CONFIG_IP_NF_MATCH_ECN=y
+CONFIG_IP_NF_MATCH_TTL=y
+CONFIG_IP_NF_TARGET_SYNPROXY=y
+CONFIG_NF_DUP_IPV6=y
+CONFIG_NF_LOG_IPV6=y
+CONFIG_NET_SCHED=y
+CONFIG_NET_SCH_MULTIQ=y
+CONFIG_NET_SCH_FQ_CODEL=y
+CONFIG_NET_SCH_FQ=y
+CONFIG_NET_CLS_CGROUP=y
+CONFIG_NET_EMATCH=y
+CONFIG_VSOCKETS=y
+# CONFIG_VSOCKETS_DIAG is not set
+# CONFIG_VSOCKETS_LOOPBACK is not set
+CONFIG_VIRTIO_VSOCKETS=y
+# CONFIG_PCPU_DEV_REFCNT is not set
+CONFIG_CGROUP_NET_PRIO=y
+# CONFIG_WIRELESS is not set
+CONFIG_NET_9P=y
+# CONFIG_NET_9P_FD is not set
+CONFIG_NET_9P_VIRTIO=y
+# CONFIG_ETHTOOL_NETLINK is not set
+CONFIG_PCI=y
+CONFIG_PCIEPORTBUS=y
+CONFIG_HOTPLUG_PCI=y
+CONFIG_PCI_HOST_GENERIC=y
+CONFIG_DEVTMPFS=y
+CONFIG_DEVTMPFS_MOUNT=y
+# CONFIG_STANDALONE is not set
+# CONFIG_PREVENT_FIRMWARE_BUILD is not set
+# CONFIG_ARM_SMCCC_SOC_ID is not set
+CONFIG_BLK_DEV_LOOP=y
+CONFIG_BLK_DEV_RAM=y
+CONFIG_VIRTIO_BLK=y
+CONFIG_NETDEVICES=y
+CONFIG_TUN=y
+CONFIG_VETH=y
+CONFIG_VIRTIO_NET=y
+# CONFIG_ETHERNET is not set
+# CONFIG_WLAN is not set
+# CONFIG_INPUT_KEYBOARD is not set
+# CONFIG_INPUT_MOUSE is not set
+# CONFIG_SERIO is not set
+# CONFIG_LEGACY_PTYS is not set
+# CONFIG_LEGACY_TIOCSTI is not set
+# CONFIG_LDISC_AUTOLOAD is not set
+CONFIG_SERIAL_8250=y
+# CONFIG_SERIAL_8250_DEPRECATED_OPTIONS is not set
+# CONFIG_SERIAL_8250_16550A_VARIANTS is not set
+CONFIG_SERIAL_8250_CONSOLE=y
+# CONFIG_SERIAL_8250_EXAR is not set
+# CONFIG_SERIAL_8250_PERICOM is not set
+CONFIG_SERIAL_OF_PLATFORM=y
+CONFIG_SERIAL_AMBA_PL011=y
+CONFIG_SERIAL_AMBA_PL011_CONSOLE=y
+CONFIG_VIRTIO_CONSOLE=y
+CONFIG_HW_RANDOM_VIRTIO=y
+# CONFIG_HW_RANDOM_ARM_SMCCC_TRNG is not set
+# CONFIG_DEVMEM is not set
+# CONFIG_DEVPORT is not set
+# CONFIG_HWMON is not set
+# CONFIG_HID_SUPPORT is not set
+# CONFIG_USB_SUPPORT is not set
+CONFIG_RTC_CLASS=y
+# CONFIG_RTC_NVMEM is not set
+CONFIG_RTC_DRV_PL031=y
+CONFIG_VIRTIO_PCI=y
+CONFIG_VIRTIO_MMIO=y
+CONFIG_VIRTIO_MMIO_CMDLINE_DEVICES=y
+# CONFIG_VHOST_MENU is not set
+# CONFIG_SURFACE_PLATFORMS is not set
+# CONFIG_ARM64_PLATFORM_DEVICES is not set
+# CONFIG_ARM_ARCH_TIMER_EVTSTREAM is not set
+# CONFIG_FSL_ERRATUM_A008585 is not set
+# CONFIG_HISILICON_ERRATUM_161010101 is not set
+# CONFIG_ARM64_ERRATUM_858921 is not set
+# CONFIG_IOMMU_SUPPORT is not set
+CONFIG_EXT4_FS=y
+CONFIG_EXT4_FS_POSIX_ACL=y
+CONFIG_EXT4_FS_SECURITY=y
+CONFIG_EXPORTFS_BLOCK_OPS=y
+CONFIG_AUTOFS_FS=y
+CONFIG_FUSE_FS=y
+CONFIG_VIRTIO_FS=y
+# CONFIG_FUSE_PASSTHROUGH is not set
+CONFIG_OVERLAY_FS=y
+# CONFIG_OVERLAY_FS_REDIRECT_ALWAYS_FOLLOW is not set
+CONFIG_OVERLAY_FS_INDEX=y
+CONFIG_OVERLAY_FS_XINO_AUTO=y
+CONFIG_OVERLAY_FS_METACOPY=y
+CONFIG_TMPFS=y
+CONFIG_TMPFS_XATTR=y
+CONFIG_HUGETLBFS=y
+CONFIG_EROFS_FS=y
+# CONFIG_EROFS_FS_POSIX_ACL is not set
+# CONFIG_EROFS_FS_BACKED_BY_FILE is not set
+CONFIG_9P_FS=y
+CONFIG_9P_FS_POSIX_ACL=y
+CONFIG_9P_FS_SECURITY=y
+CONFIG_KEYS=y
+CONFIG_SECURITY=y
+CONFIG_SECURITY_NETWORK=y
+# CONFIG_INTEGRITY is not set
+CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,selinux,smack,tomoyo,apparmor,ipe,bpf"
+CONFIG_INIT_STACK_NONE=y
+CONFIG_CRYPTO_SHA256=y
+CONFIG_CRYPTO_CRC32C=y
+CONFIG_CRYPTO_DEFLATE=y
+CONFIG_CRYPTO_ANSI_CPRNG=y
+CONFIG_CRYPTO_USER_API_HASH=y
+# CONFIG_CRYPTO_USER_API_ENABLE_OBSOLETE is not set
+CONFIG_CRYPTO_AES_ARM64=y
+CONFIG_CRYPTO_AES_ARM64_CE=y
+# CONFIG_CRYPTO_HW is not set
+CONFIG_PRINTK_TIME=y
+CONFIG_CONSOLE_LOGLEVEL_DEFAULT=4
+# CONFIG_SYMBOLIC_ERRNAME is not set
+# CONFIG_DEBUG_BUGVERBOSE is not set
+# CONFIG_DEBUG_MISC is not set
+CONFIG_DEBUG_FS=y
+# CONFIG_RCU_TRACE is not set
+# CONFIG_FTRACE is not set
+# CONFIG_RUNTIME_TESTING_MENU is not set