chore(bazel): replace hermetic_cc_toolchain (zig cc) with hermetic-llvm

.claude/skills/run-in-dev-container/SKILL.md

@@ -7,7 +7,7 @@ description: Use when you need to run a command (build, test, tool) inside the I
 
 `./ci/container/container-run.sh` runs a command inside the pinned IC dev
 container (the `ghcr.io/dfinity/ic-dev` image), bind-mounting the repo checkout
-at `/ic` and reusing `~/.cache` for the Bazel/cargo/zig caches.
+at `/ic` and reusing `~/.cache` for the Bazel/cargo caches.
 
 Prefer running builds and build tooling through it: it gives you the exact,
 pinned toolchain environment, and standardizing on the container — regardless of

.devcontainer/devcontainer.json

@@ -1,5 +1,5 @@
 {
-  "image": "ghcr.io/dfinity/ic-dev@sha256:82bb8cbc8ba0788687ca2c4654bf381e4d6bda839ad2583c2e25dfae1bacb120",
+  "image": "ghcr.io/dfinity/ic-dev@sha256:484507d3a8cbd75d81f4cc2e990efdde7a780fefacd6d47d0362032f1bfd7968",
   "remoteUser": "ubuntu",
   "privileged": true,
   "runArgs": [
@@ -14,7 +14,7 @@
   ],
   "workspaceMount": "source=${localWorkspaceFolder},target=/ic,type=bind",
   "workspaceFolder": "/ic",
-  "initializeCommand": "mkdir -p ~/.aws ~/.ssh ~/.cache/cargo ~/.cache/zig-cache ~/.claude ~/.local/share/fish /tmp/ict_testnets && touch ~/.zsh_history ~/.bash_history",
+  "initializeCommand": "mkdir -p ~/.aws ~/.ssh ~/.cache/cargo ~/.claude ~/.local/share/fish /tmp/ict_testnets && touch ~/.zsh_history ~/.bash_history",
   "postStartCommand": "/ic/ci/container/init.sh",
   "containerEnv": {
     "CARGO_TARGET_DIR": "/home/ubuntu/.cache/cargo",
@@ -26,11 +26,6 @@
       "target": "/home/ubuntu/.cache",
       "type": "bind"
     },
-    {
-      "source": "${localEnv:HOME}/.cache/zig-cache",
-      "target": "/tmp/zig-cache",
-      "type": "bind"
-    },
     {
       "source": "${localEnv:HOME}/.ssh",
       "target": "/home/ubuntu/.ssh",

.github/actions/bazel/bin/bazel

@@ -46,9 +46,6 @@ shift
 # Extra args we'll be injecting
 bazel_args=( )
 
-# Setup zig-cache
-mkdir -p /tmp/zig-cache
-
 # Add some options for build-like commands
 if [[ $bazel_command == "build" ]] || [[ $bazel_command == "test" ]]; then
     command_timestamp=$(date +%s)

.github/workflows/api-bn-recovery-test.yml

@@ -22,7 +22,7 @@ jobs:
     runs-on:
       labels: dind-large
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:dd11ad77c455bd491169af8c271a8557cdcca6e7f163a39ebf75aedea0214bf2
+      image: ghcr.io/dfinity/ic-build@sha256:2a4aed7210bdf3522219410bc14c0ca8161206c02c3cc9f24409f2cb5233f9b5
       options: >-
         -e NODE_NAME --privileged --cgroupns host
         --mount type=tmpfs,target="/home/buildifier/.local/share/containers"

.github/workflows/ci-main.yml

@@ -33,7 +33,7 @@ jobs:
     runs-on: &dind-large-setup
       labels: dind-large
     container: &container-setup
-      image: ghcr.io/dfinity/ic-build@sha256:dd11ad77c455bd491169af8c271a8557cdcca6e7f163a39ebf75aedea0214bf2
+      image: ghcr.io/dfinity/ic-build@sha256:2a4aed7210bdf3522219410bc14c0ca8161206c02c3cc9f24409f2cb5233f9b5
       options: >-
          -e NODE_NAME --privileged --cgroupns host --mount type=tmpfs,target="/tmp/containers"
     timeout-minutes: 90
@@ -335,8 +335,6 @@ jobs:
       - uses: ./.github/actions/netrc
       - name: Build and Test
         run: |
-          mkdir -p /tmp/zig-cache
-
           bazel \
             --noworkspace_rc \
             --bazelrc=./bazel/conf/.bazelrc.build --bazelrc=/tmp/bazel-cache.bazelrc \

.github/workflows/ci-pr-only.yml

@@ -37,7 +37,7 @@ jobs:
     runs-on: &dind-small-setup
       labels: dind-small
     container: &container-setup
-      image: ghcr.io/dfinity/ic-build@sha256:dd11ad77c455bd491169af8c271a8557cdcca6e7f163a39ebf75aedea0214bf2
+      image: ghcr.io/dfinity/ic-build@sha256:2a4aed7210bdf3522219410bc14c0ca8161206c02c3cc9f24409f2cb5233f9b5
       options: >-
          -e NODE_NAME --mount type=tmpfs,target="/tmp/containers"
     steps:

.github/workflows/ci-rbe-evaluation.yml

@@ -171,7 +171,7 @@ jobs:
     needs: [config, infer-bazel-targets]
     runs-on: namespace-profile-rbe-driver-amd64-linux-16x32
     container:
-      image: nscr.io/c9ptjuknd7oc6/ic-build@sha256:2ffef7066229c82711025be7a0be86848dc91a2a18d52e3bb3c4864558be261b
+      image: nscr.io/c9ptjuknd7oc6/ic-build@sha256:4f5db2c7a9349a5e656c8b72499ebeacb1c3d177a352f2b1a6d9b2aa48147e9d
       # ic-os image builds run 'podman build' (rootless) and are forced to run locally in
       # this container by --strategy_regexp=ic-os[:/].*=local in bazel/conf/.bazelrc.build.
       # Rootless podman needs to create user namespaces, which fails in an unprivileged
@@ -237,7 +237,7 @@ jobs:
         run: |
           set -euo pipefail
 
-          worker_image="docker://nscr.io/c9ptjuknd7oc6/ic-build@sha256:2ffef7066229c82711025be7a0be86848dc91a2a18d52e3bb3c4864558be261b"
+          worker_image="docker://nscr.io/c9ptjuknd7oc6/ic-build@sha256:4f5db2c7a9349a5e656c8b72499ebeacb1c3d177a352f2b1a6d9b2aa48147e9d"
 
           # Directory for the Build Event Protocol and execution profile files,
           # later uploaded to Namespace Artifact Storage for offline analysis.
@@ -295,7 +295,7 @@ jobs:
         run: |
           set -euo pipefail
 
-          worker_image="docker://nscr.io/c9ptjuknd7oc6/ic-build@sha256:2ffef7066229c82711025be7a0be86848dc91a2a18d52e3bb3c4864558be261b"
+          worker_image="docker://nscr.io/c9ptjuknd7oc6/ic-build@sha256:4f5db2c7a9349a5e656c8b72499ebeacb1c3d177a352f2b1a6d9b2aa48147e9d"
 
           # Directory for the Build Event Protocol and execution profile files,
           # later uploaded to Namespace Artifact Storage for offline analysis.

.github/workflows/container-api-bn-recovery.yml

@@ -28,7 +28,7 @@ jobs:
     runs-on:
       labels: dind-large
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:dd11ad77c455bd491169af8c271a8557cdcca6e7f163a39ebf75aedea0214bf2
+      image: ghcr.io/dfinity/ic-build@sha256:2a4aed7210bdf3522219410bc14c0ca8161206c02c3cc9f24409f2cb5233f9b5
       options: >-
         -e NODE_NAME --privileged --cgroupns host
         --mount type=tmpfs,target="/home/buildifier/.local/share/containers"

.github/workflows/container-scan-nightly.yml

@@ -12,7 +12,7 @@ jobs:
     runs-on:
       labels: dind-large
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:dd11ad77c455bd491169af8c271a8557cdcca6e7f163a39ebf75aedea0214bf2
+      image: ghcr.io/dfinity/ic-build@sha256:2a4aed7210bdf3522219410bc14c0ca8161206c02c3cc9f24409f2cb5233f9b5
       options: >-
         -e NODE_NAME --privileged --cgroupns host --mount type=tmpfs,target="/tmp/containers"
     timeout-minutes: 60

.github/workflows/local-system-tests.yml

@@ -19,7 +19,7 @@ jobs:
     runs-on:
       labels: dind-large
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:dd11ad77c455bd491169af8c271a8557cdcca6e7f163a39ebf75aedea0214bf2
+      image: ghcr.io/dfinity/ic-build@sha256:2a4aed7210bdf3522219410bc14c0ca8161206c02c3cc9f24409f2cb5233f9b5
       options: >-
          -e NODE_NAME --privileged --cgroupns host --mount type=tmpfs,target="/tmp/containers"
     timeout-minutes: 600

.github/workflows/pocket-ic-tests-windows.yml

@@ -45,7 +45,7 @@ jobs:
   bazel-build-pocket-ic:
     name: Bazel Build PocketIC
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:dd11ad77c455bd491169af8c271a8557cdcca6e7f163a39ebf75aedea0214bf2
+      image: ghcr.io/dfinity/ic-build@sha256:2a4aed7210bdf3522219410bc14c0ca8161206c02c3cc9f24409f2cb5233f9b5
       options: >-
         -e NODE_NAME --privileged --cgroupns host --mount type=tmpfs,target="/tmp/containers"
     timeout-minutes: 90

.github/workflows/rate-limits-backend-release.yml

@@ -32,7 +32,7 @@ jobs:
       labels: dind-large
 
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:dd11ad77c455bd491169af8c271a8557cdcca6e7f163a39ebf75aedea0214bf2
+      image: ghcr.io/dfinity/ic-build@sha256:2a4aed7210bdf3522219410bc14c0ca8161206c02c3cc9f24409f2cb5233f9b5
       options: >-
         -e NODE_NAME --privileged --cgroupns host -v /var/tmp:/var/tmp -v /ceph-s3-info:/ceph-s3-info --mount type=tmpfs,target="/tmp/containers"
 

.github/workflows/release-testing.yml

@@ -35,7 +35,7 @@ jobs:
       group: dm1
       labels: dind-large
     container: &container-setup
-      image: ghcr.io/dfinity/ic-build@sha256:dd11ad77c455bd491169af8c271a8557cdcca6e7f163a39ebf75aedea0214bf2
+      image: ghcr.io/dfinity/ic-build@sha256:2a4aed7210bdf3522219410bc14c0ca8161206c02c3cc9f24409f2cb5233f9b5
       options: >-
          -e NODE_NAME --privileged --cgroupns host --mount type=tmpfs,target="/tmp/containers"
     timeout-minutes: 180

.github/workflows/rosetta-release.yml

@@ -22,7 +22,7 @@ jobs:
     runs-on:
       labels: dind-large
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:dd11ad77c455bd491169af8c271a8557cdcca6e7f163a39ebf75aedea0214bf2
+      image: ghcr.io/dfinity/ic-build@sha256:2a4aed7210bdf3522219410bc14c0ca8161206c02c3cc9f24409f2cb5233f9b5
       options: >-
         -e NODE_NAME --privileged --cgroupns host --mount type=tmpfs,target="/tmp/containers"
     environment: DockerHub

.github/workflows/salt-sharing-canister-release.yml

@@ -32,7 +32,7 @@ jobs:
       labels: dind-large
 
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:dd11ad77c455bd491169af8c271a8557cdcca6e7f163a39ebf75aedea0214bf2
+      image: ghcr.io/dfinity/ic-build@sha256:2a4aed7210bdf3522219410bc14c0ca8161206c02c3cc9f24409f2cb5233f9b5
       options: >-
         -e NODE_NAME --privileged --cgroupns host -v /var/tmp:/var/tmp -v /ceph-s3-info:/ceph-s3-info --mount type=tmpfs,target="/tmp/containers"
 

.github/workflows/schedule-daily-bare-metal.yml

@@ -14,7 +14,7 @@ jobs:
     runs-on: &dind-large-setup
       labels: dind-large
     container: &container-setup
-      image: ghcr.io/dfinity/ic-build@sha256:dd11ad77c455bd491169af8c271a8557cdcca6e7f163a39ebf75aedea0214bf2
+      image: ghcr.io/dfinity/ic-build@sha256:2a4aed7210bdf3522219410bc14c0ca8161206c02c3cc9f24409f2cb5233f9b5
       options: >-
         -e NODE_NAME --privileged --cgroupns host --mount type=tmpfs,target="/tmp/containers"
     environment: Bare Metal Tests

.github/workflows/schedule-daily.yml

@@ -14,7 +14,7 @@ jobs:
     runs-on: &dind-large-setup
       labels: dind-large
     container: &container-setup
-      image: ghcr.io/dfinity/ic-build@sha256:dd11ad77c455bd491169af8c271a8557cdcca6e7f163a39ebf75aedea0214bf2
+      image: ghcr.io/dfinity/ic-build@sha256:2a4aed7210bdf3522219410bc14c0ca8161206c02c3cc9f24409f2cb5233f9b5
       options: >-
         -e NODE_NAME --privileged --cgroupns host --mount type=tmpfs,target="/tmp/containers"
     timeout-minutes: 720 # 12 hours

.github/workflows/schedule-rust-bench.yml

@@ -24,7 +24,7 @@ jobs:
       # see linux-x86-64 runner group
       labels: rust-benchmarks
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:dd11ad77c455bd491169af8c271a8557cdcca6e7f163a39ebf75aedea0214bf2
+      image: ghcr.io/dfinity/ic-build@sha256:2a4aed7210bdf3522219410bc14c0ca8161206c02c3cc9f24409f2cb5233f9b5
       # running on bare metal machine using ubuntu user
       options: --user ubuntu --mount type=tmpfs,target="/tmp/containers"
     timeout-minutes: 720 # 12 hours

.github/workflows/system-tests-benchmarks-nightly.yml

@@ -17,7 +17,7 @@ jobs:
       group: dm1
       labels: dind-large
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:dd11ad77c455bd491169af8c271a8557cdcca6e7f163a39ebf75aedea0214bf2
+      image: ghcr.io/dfinity/ic-build@sha256:2a4aed7210bdf3522219410bc14c0ca8161206c02c3cc9f24409f2cb5233f9b5
       options: >-
         -e NODE_NAME --privileged --cgroupns host --mount type=tmpfs,target="/tmp/containers"
     timeout-minutes: 480

.github/workflows/update-mainnet-canister-revisions.yaml

@@ -25,7 +25,7 @@ jobs:
       labels: dind-small
     environment: CREATE_PR
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:dd11ad77c455bd491169af8c271a8557cdcca6e7f163a39ebf75aedea0214bf2
+      image: ghcr.io/dfinity/ic-build@sha256:2a4aed7210bdf3522219410bc14c0ca8161206c02c3cc9f24409f2cb5233f9b5
       options: >-
         -e NODE_NAME --privileged --cgroupns host -v /var/tmp:/var/tmp -v /ceph-s3-info:/ceph-s3-info --mount type=tmpfs,target="/tmp/containers"
     env:

BUILD.bazel

@@ -361,6 +361,17 @@ platform(
     ],
 )
 
+# Host platform + a pinned glibc for the hermetic-llvm toolchain.
+# Without this constraint hermetic-llvm defaults to glibc 2.28, which lacks symbols we use
+# (e.g. gettid, glibc 2.30). Set on Linux via bazelrc (build:linux --platforms/--host_platform);
+# one definition covers both x86_64 and aarch64 hosts because it inherits the autodetected host constraints.
+# Note that an explicit --platforms=... on the command line overrides this default and silently reverts to glibc 2.28.
+platform(
+    name = "linux-glibc-2.31",
+    constraint_values = ["@llvm//constraints/libc:gnu.2.31"],
+    parents = ["@platforms//host"],
+)
+
 ## Extract ovmf firmware from the `ovmf-generic-hwe` `.deb`.
 ## This pulls the two firmware files the backend needs
 ##   * `OVMF_CODE_4M.fd` -- read-only UEFI code image (shared, mounted read-only)