@lazycatcloud/lzc-cli 2.0.0-pre.0 → 2.0.0-pre.2

package/lib/app/lpk_build_images.js

@@ -10,13 +10,16 @@ import shellApi from '../shellapi.js';
 import { collectContextFromDockerFile } from './lpk_devshell_docker.js';
 import { isFileExist } from '../utils.js';
 import { resolveBuildRemoteFromOptions } from '../build_remote.js';
+import { buildLocalImageForPack, removeLocalDockerImages, saveLocalDockerImagesArchive } from './lpk_build_images_local.js';
+import { packLocalArchiveToStageDir } from './lpk_build_images_pack_local.js';
 
 const EMBED_PREFIX = 'embed:';
 const EMBED_TYPO_PREFIXES = ['emebd:'];
 const SHA256_PREFIX = 'sha256:';
 const DEFAULT_UPSTREAM_MATCH = 'registry.lazycat.cloud';
-const IMAGE_BUILD_CACHE_VERSION = 3;
+const IMAGE_BUILD_CACHE_VERSION = 4;
 const IMAGE_PACKAGE_CACHE_VERSION = 1;
+const DEFAULT_LOCAL_TARGET_PLATFORM = 'linux/amd64';
 
 function isPlainObject(value) {
 	return value && typeof value === 'object' && !Array.isArray(value);
@@ -123,6 +126,15 @@ function normalizeImageBuildEntries(rawConfig, cwd, manifest) {
 			}
 		}
 
+		const builderValue = config.builder;
+		let builder = 'remote';
+		if (builderValue !== undefined && builderValue !== null) {
+			builder = String(builderValue).trim().toLowerCase();
+			if (builder !== 'remote' && builder !== 'local') {
+				throw new Error(`images.${alias}.builder must be "remote" or "local"`);
+			}
+		}
+
 		entries.push({
 			alias,
 			contextDir,
@@ -130,6 +142,7 @@ function normalizeImageBuildEntries(rawConfig, cwd, manifest) {
 			dockerfileInlineContent,
 			imageLabel: `${packageName}-image-${sanitizeTagPart(alias, 'image')}:${version}`,
 			upstreamMatch,
+			builder,
 		});
 	}
 
@@ -276,6 +289,8 @@ function normalizeMetaForPackageCache(metaList) {
 	return [...metaList]
 		.map((meta) => ({
 			alias: String(meta?.alias ?? ''),
+			builder: String(meta?.builder ?? ''),
+			platform: String(meta?.platform ?? ''),
 			imageID: String(meta?.imageID ?? ''),
 			upstream: String(meta?.upstream ?? ''),
 			embeddedDiffIDs: [...(meta?.embeddedDiffIDs ?? [])].map((item) => String(item ?? '')),
@@ -421,30 +436,51 @@ function rewriteImagesLock(tempDir, fallbackLockImages = {}) {
 }
 
 function ensureDockerfileForEntry(entry) {
-	if (!entry?.dockerfileInlineContent) {
+	const targetDockerfilePath = path.join(entry.contextDir, 'Dockerfile');
+	const backupPath = `${targetDockerfilePath}.lzc-inline-backup-${Date.now()}-${Math.random().toString(16).slice(2)}`;
+	const hasOriginalDockerfile = fs.existsSync(targetDockerfilePath);
+	const restoreOriginalDockerfile = () => {
+		if (hasOriginalDockerfile && fs.existsSync(backupPath)) {
+			fs.copyFileSync(backupPath, targetDockerfilePath);
+			fs.rmSync(backupPath, { force: true });
+			return;
+		}
+		fs.rmSync(targetDockerfilePath, { force: true });
+	};
+
+	if (entry?.dockerfileInlineContent) {
+		if (hasOriginalDockerfile) {
+			fs.copyFileSync(targetDockerfilePath, backupPath);
+		}
+		fs.writeFileSync(targetDockerfilePath, entry.dockerfileInlineContent);
 		return {
-			dockerfilePath: entry.dockerfilePath,
+			dockerfilePath: targetDockerfilePath,
+			cleanup: restoreOriginalDockerfile,
+		};
+	}
+
+	if (!entry?.dockerfilePath) {
+		return {
+			dockerfilePath: targetDockerfilePath,
+			cleanup: () => {},
+		};
+	}
+
+	const resolvedDockerfilePath = path.resolve(entry.dockerfilePath);
+	if (path.resolve(targetDockerfilePath) === resolvedDockerfilePath) {
+		return {
+			dockerfilePath: resolvedDockerfilePath,
 			cleanup: () => {},
 		};
 	}
 
-	const dockerfilePath = path.join(entry.contextDir, 'Dockerfile');
-	const backupPath = `${dockerfilePath}.lzc-inline-backup-${Date.now()}-${Math.random().toString(16).slice(2)}`;
-	const hasOriginalDockerfile = fs.existsSync(dockerfilePath);
 	if (hasOriginalDockerfile) {
-		fs.copyFileSync(dockerfilePath, backupPath);
+		fs.copyFileSync(targetDockerfilePath, backupPath);
 	}
-	fs.writeFileSync(dockerfilePath, entry.dockerfileInlineContent);
+	fs.copyFileSync(resolvedDockerfilePath, targetDockerfilePath);
 	return {
-		dockerfilePath,
-		cleanup: () => {
-			if (hasOriginalDockerfile && fs.existsSync(backupPath)) {
-				fs.copyFileSync(backupPath, dockerfilePath);
-				fs.rmSync(backupPath, { force: true });
-				return;
-			}
-			fs.rmSync(dockerfilePath, { force: true });
-		},
+		dockerfilePath: targetDockerfilePath,
+		cleanup: restoreOriginalDockerfile,
 	};
 }
 
@@ -467,6 +503,109 @@ async function sha256File(filePath) {
 	});
 }
 
+async function extractPackedImagesArchive(archivePath, targetDir) {
+	fs.mkdirSync(targetDir, { recursive: true });
+	await tar.x({
+		file: archivePath,
+		cwd: targetDir,
+	});
+}
+
+function loadPackedResult(stageDir) {
+	const packedResultPath = path.join(stageDir, 'pack-result.json');
+	if (!isFileExist(packedResultPath)) {
+		throw new Error('pack-result.json not found after pack-images');
+	}
+	const packedResult = JSON.parse(fs.readFileSync(packedResultPath, 'utf-8'));
+	fs.rmSync(packedResultPath, { force: true });
+	if (!isPlainObject(packedResult?.lockImages)) {
+		throw new Error('Invalid pack-result.json: lockImages is missing');
+	}
+	return {
+		lockImages: packedResult.lockImages,
+		embeddedLayerBytes: Number(packedResult?.embeddedLayerBytes ?? 0),
+		embeddedLayerCount: Number(packedResult?.embeddedLayerCount ?? 0),
+	};
+}
+
+function mergeOciLayout(sourceDir, targetDir) {
+	const sourceImagesDir = path.join(sourceDir, 'images');
+	if (!fs.existsSync(sourceImagesDir)) {
+		throw new Error(`packed images dir not found: ${sourceImagesDir}`);
+	}
+	const sourceBlobsDir = path.join(sourceImagesDir, 'blobs', 'sha256');
+	const targetImagesDir = path.join(targetDir, 'images');
+	const targetBlobsDir = path.join(targetImagesDir, 'blobs', 'sha256');
+	fs.mkdirSync(targetBlobsDir, { recursive: true });
+	if (fs.existsSync(sourceBlobsDir)) {
+		for (const fileName of fs.readdirSync(sourceBlobsDir)) {
+			const sourcePath = path.join(sourceBlobsDir, fileName);
+			const targetPath = path.join(targetBlobsDir, fileName);
+			if (!isFileExist(targetPath)) {
+				fs.copyFileSync(sourcePath, targetPath);
+			}
+		}
+	}
+
+	const sourceIndexPath = path.join(sourceImagesDir, 'index.json');
+	const targetIndexPath = path.join(targetImagesDir, 'index.json');
+	const sourceIndex = isFileExist(sourceIndexPath) ? JSON.parse(fs.readFileSync(sourceIndexPath, 'utf-8')) : { manifests: [] };
+	const targetIndex = isFileExist(targetIndexPath)
+		? JSON.parse(fs.readFileSync(targetIndexPath, 'utf-8'))
+		: {
+				schemaVersion: 2,
+				manifests: [],
+			};
+	const seenDigest = new Set((targetIndex.manifests ?? []).map((item) => String(item?.digest ?? '').trim()).filter((item) => item));
+	for (const manifest of sourceIndex.manifests ?? []) {
+		const digest = String(manifest?.digest ?? '').trim();
+		if (!digest || seenDigest.has(digest)) {
+			continue;
+		}
+		seenDigest.add(digest);
+		targetIndex.manifests.push(manifest);
+	}
+	fs.mkdirSync(targetImagesDir, { recursive: true });
+	fs.writeFileSync(path.join(targetImagesDir, 'oci-layout'), JSON.stringify({ imageLayoutVersion: '1.0.0' }));
+	fs.writeFileSync(targetIndexPath, JSON.stringify(targetIndex, null, 2));
+}
+
+function computeEmbeddedStats(lockImages, tempDir) {
+	const imagesDir = path.join(tempDir, 'images', 'blobs', 'sha256');
+	const seenDigest = new Set();
+	let embeddedLayerBytes = 0;
+	for (const imageInfo of Object.values(lockImages ?? {})) {
+		for (const layer of imageInfo?.layers ?? []) {
+			const source = String(layer?.source ?? '').trim().toLowerCase();
+			const digest = String(layer?.digest ?? '').trim();
+			if (source !== 'embed' || !digest.startsWith(SHA256_PREFIX) || seenDigest.has(digest)) {
+				continue;
+			}
+			seenDigest.add(digest);
+			const blobPath = path.join(imagesDir, digest.slice(SHA256_PREFIX.length));
+			if (isFileExist(blobPath)) {
+				embeddedLayerBytes += fs.statSync(blobPath).size;
+			}
+		}
+	}
+	return {
+		embeddedLayerBytes,
+		embeddedLayerCount: seenDigest.size,
+	};
+}
+
+async function packToStageDir(bridge, targetDir, options) {
+	const packedArchivePath = path.join(targetDir, 'images.packed.tar');
+	if (options.mode === 'archive') {
+		await bridge.packImagesArchive(options.packSpecs, options.archivePath, packedArchivePath);
+	} else {
+		await bridge.packImages(options.packSpecs, packedArchivePath);
+	}
+	await extractPackedImagesArchive(packedArchivePath, targetDir);
+	fs.rmSync(packedArchivePath, { force: true });
+	return loadPackedResult(targetDir);
+}
+
 export async function buildConfiguredImagesToTempDir(rawConfig, manifest, cwd, tempDir, options = {}) {
 	const imageEntries = normalizeImageBuildEntries(rawConfig, cwd, manifest);
 	if (imageEntries.length === 0) {
@@ -484,245 +623,301 @@ export async function buildConfiguredImagesToTempDir(rawConfig, manifest, cwd, t
 	}
 
 	const buildRemote = resolveBuildRemoteFromOptions(options, 'lzc-build.yml');
-	if (!buildRemote) {
-		await shellApi.init();
+	const hasLocalBuilder = imageEntries.some((item) => item.builder === 'local');
+	const hasRemoteBuilder = imageEntries.some((item) => item.builder === 'remote');
+	let bridge = null;
+	let targetPlatform = '';
+	if (hasRemoteBuilder) {
+		if (!buildRemote) {
+			await shellApi.init();
+		}
+		bridge = new DebugBridge(cwd, buildRemote);
+		await bridge.init();
+	}
+	if (hasLocalBuilder) {
+		targetPlatform = bridge ? await bridge.platform() : DEFAULT_LOCAL_TARGET_PLATFORM;
 	}
-	const bridge = new DebugBridge(cwd, buildRemote);
-	await bridge.init();
-
 	const imageMetaByRef = new Map();
 	const imageRefs = [];
 	const buildCache = loadImageBuildCache(cwd);
 	const buildCacheRecords = { ...buildCache.records };
+	const localBuiltRefs = [];
 
-	for (const entry of imageEntries) {
-		const profileStartAt = Date.now();
-		let contextCollectMs = 0;
-		let buildStageMs = 0;
-		let resolveStageMs = 0;
-		let buildMode = 'build-pack';
-
-		const dockerfileDesc = entry.dockerfilePath || '(inline dockerfile-content)';
-		logger.info(`Build image for alias "${entry.alias}" from ${dockerfileDesc}`);
-		const contextStartAt = Date.now();
-		const dockerfileSource = ensureDockerfileForEntry(entry);
-		let contextTar = '';
-		try {
-			contextTar = await collectContextFromDockerFile(entry.contextDir, dockerfileSource.dockerfilePath);
-		} finally {
-			dockerfileSource.cleanup();
-		}
-		contextCollectMs = Date.now() - contextStartAt;
-		const contextHash = await sha256File(contextTar);
-		const contextDigest = `${SHA256_PREFIX}${contextHash.digest}`;
-
-		const cacheRecord = buildCache.records?.[entry.alias];
-		let builtImageRef = '';
-		let reusedFromCache = false;
-		let imageID = '';
-		let builtDiffIDs = [];
-		let upstream = '';
-		let upstreamDiffIDs = [];
-		let archiveKey = '';
-
-		if (
-			cacheRecord &&
-			cacheRecord.image_label === entry.imageLabel &&
-			cacheRecord.context_digest === contextDigest &&
-			cacheRecord.upstream_match === entry.upstreamMatch &&
-			cacheRecord.build_mode === 'pack' &&
-			Array.isArray(cacheRecord.built_diff_ids) &&
-			typeof cacheRecord.image_id === 'string' &&
-			cacheRecord.image_id.trim() !== ''
-		) {
+	try {
+		for (const entry of imageEntries) {
+			const profileStartAt = Date.now();
+			let contextCollectMs = 0;
+			let buildStageMs = 0;
+			let resolveStageMs = 0;
+			let buildMode = entry.builder === 'local' ? `local:${targetPlatform}` : 'build-pack';
+
+			const dockerfileDesc = entry.dockerfilePath || '(inline dockerfile-content)';
+			if (entry.builder === 'local') {
+				logger.info(`Build image for alias "${entry.alias}" from ${dockerfileDesc} (builder=local, target=${targetPlatform})`);
+			} else {
+				logger.info(`Build image for alias "${entry.alias}" from ${dockerfileDesc} (builder=remote, target-box=${bridge?.boxname ?? 'unknown'})`);
+			}
+			const contextStartAt = Date.now();
+			const dockerfileSource = ensureDockerfileForEntry(entry);
+			let contextTar = '';
 			try {
-				imageID = normalizeSha256Digest(cacheRecord.image_id, `cached image id of alias ${entry.alias}`);
-				builtDiffIDs = normalizeDigestList(cacheRecord.built_diff_ids, `cached built diff ids of alias ${entry.alias}`);
-				if (builtDiffIDs.length === 0) {
-					throw new Error('built diff ids is empty');
-				}
-				upstream = cacheRecord.upstream ? String(cacheRecord.upstream).trim() : '';
-				if (upstream && !upstream.includes('@sha256:')) {
-					throw new Error(`invalid cached upstream: ${upstream}`);
+				contextTar = await collectContextFromDockerFile(entry.contextDir, dockerfileSource.dockerfilePath);
+			} finally {
+				dockerfileSource.cleanup();
+			}
+			contextCollectMs = Date.now() - contextStartAt;
+			const contextHash = await sha256File(contextTar);
+			const contextDigest = `${SHA256_PREFIX}${contextHash.digest}`;
+
+			const cacheRecord = buildCache.records?.[entry.alias];
+			let builtImageRef = '';
+			let reusedFromCache = false;
+			let imageID = '';
+			let builtDiffIDs = [];
+			let upstream = '';
+			let upstreamDiffIDs = [];
+			let archiveKey = '';
+
+			if (
+				entry.builder === 'remote' &&
+				cacheRecord &&
+				String(cacheRecord.builder ?? 'remote') === 'remote' &&
+				cacheRecord.image_label === entry.imageLabel &&
+				cacheRecord.context_digest === contextDigest &&
+				cacheRecord.upstream_match === entry.upstreamMatch &&
+				cacheRecord.build_mode === 'pack' &&
+				Array.isArray(cacheRecord.built_diff_ids) &&
+				typeof cacheRecord.image_id === 'string' &&
+				cacheRecord.image_id.trim() !== ''
+			) {
+				try {
+					imageID = normalizeSha256Digest(cacheRecord.image_id, `cached image id of alias ${entry.alias}`);
+					builtDiffIDs = normalizeDigestList(cacheRecord.built_diff_ids, `cached built diff ids of alias ${entry.alias}`);
+					if (builtDiffIDs.length === 0) {
+						throw new Error('built diff ids is empty');
+					}
+					upstream = cacheRecord.upstream ? String(cacheRecord.upstream).trim() : '';
+					if (upstream && !upstream.includes('@sha256:')) {
+						throw new Error(`invalid cached upstream: ${upstream}`);
+					}
+					upstreamDiffIDs = Array.isArray(cacheRecord.upstream_diff_ids)
+						? normalizeDigestList(cacheRecord.upstream_diff_ids, `cached upstream diff ids of alias ${entry.alias}`)
+						: [];
+					archiveKey = String(cacheRecord.archive_key ?? '').trim();
+					builtImageRef = typeof cacheRecord.image_ref === 'string' && cacheRecord.image_ref.trim() !== '' ? cacheRecord.image_ref : `debug.bridge/${entry.imageLabel}`;
+					reusedFromCache = true;
+					buildMode = 'build-pack-cache';
+					logger.info(`Reuse cached build-pack metadata for alias "${entry.alias}"`);
+				} catch (error) {
+					logger.info(`Cached build-pack metadata is invalid for alias "${entry.alias}", rebuild image`);
 				}
-				upstreamDiffIDs = Array.isArray(cacheRecord.upstream_diff_ids)
-					? normalizeDigestList(cacheRecord.upstream_diff_ids, `cached upstream diff ids of alias ${entry.alias}`)
-					: [];
-				archiveKey = String(cacheRecord.archive_key ?? '').trim();
-				builtImageRef = typeof cacheRecord.image_ref === 'string' && cacheRecord.image_ref.trim() !== '' ? cacheRecord.image_ref : `debug.bridge/${entry.imageLabel}`;
-				reusedFromCache = true;
-				buildMode = 'build-pack-cache';
-				logger.info(`Reuse cached build-pack metadata for alias "${entry.alias}"`);
-			} catch (error) {
-				logger.info(`Cached build-pack metadata is invalid for alias "${entry.alias}", rebuild image`);
 			}
-		}
 
-		const buildStartAt = Date.now();
-		if (!reusedFromCache) {
-			const buildPackResult = await bridge.buildImageForPack(entry.imageLabel, contextTar);
-			builtImageRef = String(buildPackResult?.tag ?? '').trim() || `debug.bridge/${entry.imageLabel}`;
-			buildMode = 'build-pack';
-			archiveKey = String(buildPackResult?.archiveKey ?? '').trim();
-			imageID = normalizeSha256Digest(buildPackResult?.imageID, `build-pack image id of alias ${entry.alias}`);
-			builtDiffIDs = normalizeDigestList(buildPackResult?.diffIDs ?? [], `build-pack diff ids of alias ${entry.alias}`);
-			if (builtDiffIDs.length === 0) {
-				throw new Error(`No rootfs layer found in build-pack output for alias "${entry.alias}"`);
-			}
-			const baseRepoDigest = String(buildPackResult?.baseRepoDigest ?? '').trim();
-			if (baseRepoDigest) {
-				if (!baseRepoDigest.includes('@sha256:')) {
-					throw new Error(`Invalid baseRepoDigest from build-pack of alias "${entry.alias}": ${baseRepoDigest}`);
+			const buildStartAt = Date.now();
+			if (entry.builder === 'local') {
+				const dockerfileSourceForLocalBuild = ensureDockerfileForEntry(entry);
+				try {
+					const localBuildResult = await buildLocalImageForPack(entry, targetPlatform, dockerfileSourceForLocalBuild.dockerfilePath);
+					builtImageRef = localBuildResult.ref;
+					imageID = normalizeSha256Digest(localBuildResult.imageID, `local build image id of alias ${entry.alias}`);
+					builtDiffIDs = normalizeDigestList(localBuildResult.builtDiffIDs ?? [], `local build diff ids of alias ${entry.alias}`);
+					archiveKey = '';
+					upstream = localBuildResult.upstream ? String(localBuildResult.upstream).trim() : '';
+					upstreamDiffIDs = Array.isArray(localBuildResult.upstreamDiffIDs)
+						? normalizeDigestList(localBuildResult.upstreamDiffIDs, `local build upstream diff ids of alias ${entry.alias}`)
+						: [];
+					localBuiltRefs.push(builtImageRef);
+				} finally {
+					dockerfileSourceForLocalBuild.cleanup();
+					fs.rmSync(contextTar, { force: true });
 				}
-				const baseRepo = extractRepoFromRepoDigest(baseRepoDigest);
-				if (!entry.upstreamMatch || baseRepo.startsWith(entry.upstreamMatch)) {
-					upstream = baseRepoDigest;
-					if (Array.isArray(buildPackResult?.baseDiffIDs) && buildPackResult.baseDiffIDs.length > 0) {
-						upstreamDiffIDs = normalizeDigestList(buildPackResult.baseDiffIDs, `build-pack base diff ids of alias ${entry.alias}`);
+				delete buildCacheRecords[entry.alias];
+			} else if (!reusedFromCache) {
+				const buildPackResult = await bridge.buildImageForPack(entry.imageLabel, contextTar);
+				builtImageRef = String(buildPackResult?.tag ?? '').trim() || `debug.bridge/${entry.imageLabel}`;
+				buildMode = 'build-pack';
+				archiveKey = String(buildPackResult?.archiveKey ?? '').trim();
+				imageID = normalizeSha256Digest(buildPackResult?.imageID, `build-pack image id of alias ${entry.alias}`);
+				builtDiffIDs = normalizeDigestList(buildPackResult?.diffIDs ?? [], `build-pack diff ids of alias ${entry.alias}`);
+				if (builtDiffIDs.length === 0) {
+					throw new Error(`No rootfs layer found in build-pack output for alias "${entry.alias}"`);
+				}
+				const baseRepoDigest = String(buildPackResult?.baseRepoDigest ?? '').trim();
+				if (baseRepoDigest) {
+					if (!baseRepoDigest.includes('@sha256:')) {
+						throw new Error(`Invalid baseRepoDigest from build-pack of alias "${entry.alias}": ${baseRepoDigest}`);
 					}
-					if (upstreamDiffIDs.length > 0 && !startsWithDigestList(builtDiffIDs, upstreamDiffIDs)) {
-						logger.warn(`Ignore invalid upstream layer prefix for alias "${entry.alias}" from build-pack metadata`);
-						upstream = '';
-						upstreamDiffIDs = [];
+					const baseRepo = extractRepoFromRepoDigest(baseRepoDigest);
+					if (!entry.upstreamMatch || baseRepo.startsWith(entry.upstreamMatch)) {
+						upstream = baseRepoDigest;
+						if (Array.isArray(buildPackResult?.baseDiffIDs) && buildPackResult.baseDiffIDs.length > 0) {
+							upstreamDiffIDs = normalizeDigestList(buildPackResult.baseDiffIDs, `build-pack base diff ids of alias ${entry.alias}`);
+						}
+						if (upstreamDiffIDs.length > 0 && !startsWithDigestList(builtDiffIDs, upstreamDiffIDs)) {
+							logger.warn(`Ignore invalid upstream layer prefix for alias "${entry.alias}" from build-pack metadata`);
+							upstream = '';
+							upstreamDiffIDs = [];
+						}
 					}
 				}
+			} else {
+				fs.rmSync(contextTar, { force: true });
 			}
-		} else {
-			fs.rmSync(contextTar, { force: true });
-		}
-		buildStageMs = Date.now() - buildStartAt;
-		imageRefs.push(builtImageRef);
+			buildStageMs = Date.now() - buildStartAt;
+			imageRefs.push(builtImageRef);
 
-		const resolveStartAt = Date.now();
-		if (!imageID || builtDiffIDs.length === 0) {
-			throw new Error(`No rootfs layer metadata found in build-pack output for alias "${entry.alias}"`);
-		}
-		resolveStageMs = Date.now() - resolveStartAt;
-
-		if (upstreamDiffIDs.length > 0 && !startsWithDigestList(builtDiffIDs, upstreamDiffIDs)) {
-			throw new Error(`Failed to derive mixed layers for alias "${entry.alias}", built layers do not start with upstream layers`);
-		}
-
-		const embeddedDiffIDs = upstreamDiffIDs.length === 0 ? builtDiffIDs : builtDiffIDs.slice(upstreamDiffIDs.length);
-		if (embeddedDiffIDs.length === 0 && !upstream) {
-			throw new Error(`Alias "${entry.alias}" has no embed layers and no upstream image`);
-		}
+			const resolveStartAt = Date.now();
+			if (!imageID || builtDiffIDs.length === 0) {
+				throw new Error(`No rootfs layer metadata found in build output for alias "${entry.alias}"`);
+			}
+			resolveStageMs = Date.now() - resolveStartAt;
 
-		imageMetaByRef.set(builtImageRef, {
-			alias: entry.alias,
-			imageID,
-			upstream: upstream || '',
-			embeddedDiffIDs,
-			archiveKey: archiveKey || '',
-		});
-		buildCacheRecords[entry.alias] = {
-			image_label: entry.imageLabel,
-			context_digest: contextDigest,
-			upstream_match: entry.upstreamMatch,
-			image_ref: builtImageRef,
-			image_id: imageID,
-			build_mode: 'pack',
-			built_diff_ids: builtDiffIDs,
-			upstream: upstream || '',
-			upstream_diff_ids: upstreamDiffIDs,
-			archive_key: archiveKey || '',
-		};
+			if (upstreamDiffIDs.length > 0 && !startsWithDigestList(builtDiffIDs, upstreamDiffIDs)) {
+				throw new Error(`Failed to derive mixed layers for alias "${entry.alias}", built layers do not start with upstream layers`);
+			}
 
-		logger.info(`Image alias "${entry.alias}" is ready: ${builtImageRef}`);
-		logger.info(
-			`[profile] alias=${entry.alias} mode=${buildMode} context=${formatDurationMs(contextCollectMs)} build=${formatDurationMs(
-				buildStageMs,
-			)} resolve=${formatDurationMs(resolveStageMs)} total=${formatDurationMs(Date.now() - profileStartAt)}`,
-		);
-	}
-	saveImageBuildCache(buildCache.cachePath, buildCacheRecords);
-
-	const packageCacheKey = computePackageCacheKey([...imageMetaByRef.values()]);
-	const cachedPackage = tryLoadPackageCache(cwd, packageCacheKey, tempDir);
-	let convertResult = null;
-	if (cachedPackage) {
-		logger.info('Reuse cached OCI image package');
-		convertResult = {
-			lockImages: Object.fromEntries(
-				[...imageMetaByRef.values()].map((meta) => [
-					meta.alias,
-					{
-						image_id: meta.imageID,
-						upstream: meta.upstream ?? '',
-					},
-				]),
-			),
-			embeddedLayerBytes: cachedPackage.embeddedLayerBytes,
-			embeddedLayerCount: cachedPackage.embeddedLayerCount,
-		};
-	}
+			const embeddedDiffIDs = upstreamDiffIDs.length === 0 ? builtDiffIDs : builtDiffIDs.slice(upstreamDiffIDs.length);
+			if (embeddedDiffIDs.length === 0 && !upstream) {
+				throw new Error(`Alias "${entry.alias}" has no embed layers and no upstream image`);
+			}
 
-	if (!convertResult) {
-		const packBridgeStartAt = Date.now();
-		const packedArchivePath = path.join(tempDir, 'images.packed.tar');
-		const packSpecs = imageRefs.map((ref) => {
-			const meta = imageMetaByRef.get(ref);
-			if (!meta) {
-				throw new Error(`Missing image meta for ref: ${ref}`);
+			imageMetaByRef.set(builtImageRef, {
+				alias: entry.alias,
+				builder: entry.builder,
+				platform: entry.builder === 'local' ? targetPlatform : '',
+				imageID,
+				upstream: upstream || '',
+				embeddedDiffIDs,
+				archiveKey: archiveKey || '',
+			});
+			if (entry.builder === 'remote') {
+				buildCacheRecords[entry.alias] = {
+					builder: 'remote',
+					image_label: entry.imageLabel,
+					context_digest: contextDigest,
+					upstream_match: entry.upstreamMatch,
+					image_ref: builtImageRef,
+					image_id: imageID,
+					build_mode: 'pack',
+					built_diff_ids: builtDiffIDs,
+					upstream: upstream || '',
+					upstream_diff_ids: upstreamDiffIDs,
+					archive_key: archiveKey || '',
+				};
 			}
-			return {
-				ref,
-				alias: meta.alias,
-				imageID: meta.imageID,
-				upstream: meta.upstream ?? '',
-				embeddedDiffIDs: meta.embeddedDiffIDs,
-				archiveKey: meta.archiveKey || undefined,
-			};
-		});
-		logger.info('Pack built images to OCI layout in debug bridge');
-		await bridge.packImages(packSpecs, packedArchivePath);
-		const packBridgeMs = Date.now() - packBridgeStartAt;
-		const extractStartAt = Date.now();
-		await tar.x({
-			file: packedArchivePath,
-			cwd: tempDir,
-		});
-		const extractMs = Date.now() - extractStartAt;
-		fs.rmSync(packedArchivePath, { force: true });
-		const parseStartAt = Date.now();
-		const packedResultPath = path.join(tempDir, 'pack-result.json');
-		if (!isFileExist(packedResultPath)) {
-			throw new Error('pack-result.json not found after pack-images');
-		}
-		const packedResult = JSON.parse(fs.readFileSync(packedResultPath, 'utf-8'));
-		fs.rmSync(packedResultPath, { force: true });
-		if (!isPlainObject(packedResult?.lockImages)) {
-			throw new Error('Invalid pack-result.json: lockImages is missing');
-		}
-		convertResult = {
-			lockImages: packedResult.lockImages,
-			embeddedLayerBytes: Number(packedResult?.embeddedLayerBytes ?? 0),
-			embeddedLayerCount: Number(packedResult?.embeddedLayerCount ?? 0),
-		};
-		const parseMs = Date.now() - parseStartAt;
+
+			logger.info(`Image alias "${entry.alias}" is ready: ${builtImageRef}`);
 			logger.info(
-				`[profile] pack-images bridge=${formatDurationMs(packBridgeMs)} extract=${formatDurationMs(extractMs)} parse=${formatDurationMs(parseMs)} total=${formatDurationMs(
-					packBridgeMs + extractMs + parseMs,
-				)}`,
+				`[profile] alias=${entry.alias} mode=${buildMode} context=${formatDurationMs(contextCollectMs)} build=${formatDurationMs(buildStageMs)} resolve=${formatDurationMs(resolveStageMs)} total=${formatDurationMs(Date.now() - profileStartAt)}`,
 			);
 		}
-		convertResult.lockImages = rewriteImagesLock(tempDir, convertResult.lockImages);
-		if (!cachedPackage) {
+		saveImageBuildCache(buildCache.cachePath, buildCacheRecords);
+
+		const packageCacheKey = computePackageCacheKey([...imageMetaByRef.values()]);
+		const cachedPackage = tryLoadPackageCache(cwd, packageCacheKey, tempDir);
+		let convertResult = null;
+		if (cachedPackage) {
+			logger.info('Reuse cached OCI image package');
+			convertResult = {
+				lockImages: Object.fromEntries(
+					[...imageMetaByRef.values()].map((meta) => [
+						meta.alias,
+						{
+							image_id: meta.imageID,
+							upstream: meta.upstream ?? '',
+						},
+					]),
+				),
+				embeddedLayerBytes: cachedPackage.embeddedLayerBytes,
+				embeddedLayerCount: cachedPackage.embeddedLayerCount,
+			};
+		}
+
+		if (!convertResult) {
+			const mergedLockImages = {};
+			const remotePackSpecs = [];
+			const localPackSpecs = [];
+			for (const ref of imageRefs) {
+				const meta = imageMetaByRef.get(ref);
+				if (!meta) {
+					throw new Error(`Missing image meta for ref: ${ref}`);
+				}
+				const spec = {
+					ref,
+					alias: meta.alias,
+					imageID: meta.imageID,
+					upstream: meta.upstream ?? '',
+					embeddedDiffIDs: meta.embeddedDiffIDs,
+					archiveKey: meta.archiveKey || undefined,
+				};
+				if (meta.builder === 'local') {
+					localPackSpecs.push(spec);
+				} else {
+					remotePackSpecs.push(spec);
+				}
+			}
+
+			const packStartAt = Date.now();
+			if (remotePackSpecs.length > 0) {
+				const stageDir = fs.mkdtempSync(path.join(os.tmpdir(), 'lzc-cli-pack-remote-'));
+				try {
+					const remoteResult = await packToStageDir(bridge, stageDir, {
+						mode: 'remote',
+						packSpecs: remotePackSpecs,
+					});
+					mergeOciLayout(stageDir, tempDir);
+					Object.assign(mergedLockImages, remoteResult.lockImages);
+				} finally {
+					fs.rmSync(stageDir, { recursive: true, force: true });
+				}
+			}
+			if (localPackSpecs.length > 0) {
+				const stageDir = fs.mkdtempSync(path.join(os.tmpdir(), 'lzc-cli-pack-local-'));
+				const archivePath = path.join(stageDir, 'local-images.docker.tar');
+				try {
+					const localRefs = localPackSpecs.map((item) => item.ref);
+					logger.info(`Prepare local-built images for packaging (builder=local, target=${targetPlatform})`);
+					logger.info(`Export local docker images to archive: ${localRefs.join(', ')}`);
+					await saveLocalDockerImagesArchive(localRefs, archivePath);
+					logger.info(`Pack local image archive to OCI layout locally (target=${targetPlatform})`);
+					const localResult = await packLocalArchiveToStageDir(archivePath, localPackSpecs, stageDir);
+					mergeOciLayout(stageDir, tempDir);
+					Object.assign(mergedLockImages, localResult.lockImages);
+				} finally {
+					fs.rmSync(stageDir, { recursive: true, force: true });
+				}
+			}
+			logger.info(`[profile] pack-images total=${formatDurationMs(Date.now() - packStartAt)}`);
+			const compactedLockImages = rewriteImagesLock(tempDir, mergedLockImages);
+			const embeddedStats = computeEmbeddedStats(compactedLockImages, tempDir);
+			convertResult = {
+				lockImages: compactedLockImages,
+				embeddedLayerBytes: embeddedStats.embeddedLayerBytes,
+				embeddedLayerCount: embeddedStats.embeddedLayerCount,
+			};
 			savePackageCache(cwd, packageCacheKey, tempDir, convertResult);
 		}
 
 		const upstreamByAlias = {};
 		const resolvedImageByAlias = {};
-	for (const meta of imageMetaByRef.values()) {
-		upstreamByAlias[meta.alias] = meta.upstream || '';
-		resolvedImageByAlias[meta.alias] = meta.imageID;
-	}
+		for (const meta of imageMetaByRef.values()) {
+			upstreamByAlias[meta.alias] = meta.upstream || '';
+			resolvedImageByAlias[meta.alias] = meta.imageID;
+		}
 
-	return {
-		imageCount: Object.keys(convertResult.lockImages).length,
-		upstreamByAlias,
-		resolvedImageByAlias,
-		embeddedLayerBytes: convertResult.embeddedLayerBytes,
-		embeddedLayerCount: convertResult.embeddedLayerCount,
-	};
+		return {
+			imageCount: Object.keys(convertResult.lockImages).length,
+			upstreamByAlias,
+			resolvedImageByAlias,
+			embeddedLayerBytes: convertResult.embeddedLayerBytes,
+			embeddedLayerCount: convertResult.embeddedLayerCount,
+		};
+	} finally {
+		await removeLocalDockerImages(localBuiltRefs);
+	}
 }
+
+export const __test__ = {
+	normalizeImageBuildEntries,
+	computePackageCacheKey,
+};