uboot-arm64-toolchain

Public container image for building mainline U-Boot (and assembling vendor BL31/DDR blobs) for any ARM64 SoC - published to GitHub Container Registry on every Dockerfile change and rebuilt weekly for distro security updates:

• ghcr.io/zompinc/uboot-arm64-toolchain
• docker.io/zompinc/uboot-arm64-toolchain (mirror, when configured)

Maintained by Zomp, primarily for our Rockchip projects (e.g. the Zomp.Box Android TV box), but the image contains nothing vendor-specific, so it builds U-Boot for any ARM64 target. Published publicly so anyone can pull it without GitHub authentication.

SoC-generic by design

The image carries only the aarch64 cross toolchain + U-Boot host build deps + git/curl. Everything board- or vendor-specific - the defconfig, the device tree, and any prebuilt blobs (e.g. Rockchip rkbin BL31/DDR) - belongs to the consumer's build script at run time, not the image. So the same image builds U-Boot for Rockchip (RK3528 / RK3576 / RK3588(S) / RK3688), Allwinner, NXP i.MX, or any other ARM64 part with mainline support.

Vendors that need extra host packagers (e.g. Allwinner sunxi-tools) can layer them in a thin downstream image; this base stays minimal and generic.

What's inside

Built on mcr.microsoft.com/devcontainers/base:trixie, the image adds (all from Debian trixie apt, so versions track the distro):

Tool	Purpose
gcc-aarch64-linux-gnu	aarch64 cross compiler (prefix aarch64-linux-gnu-)
build-essential, bison, flex, bc	U-Boot build + Kconfig
libssl-dev, libgnutls28-dev	mkimage FIT signing / verified boot
python3 + pyelftools + setuptools + python3-dev	U-Boot binman, image steps
swig	U-Boot host tool bindings
device-tree-compiler (dtc)	board device tree
uuid-dev	U-Boot host tools (GPT / capsules)
git, curl, ca-certificates	fetch u-boot + blobs at run time

A build-time sanity check fails the image if any of these is missing.

Use

Build-only: mount your project, run its U-Boot build script (which fetches U-Boot and any blobs itself). Nothing board-specific is baked into the image.

podman pull ghcr.io/zompinc/uboot-arm64-toolchain
podman run --rm -v "$(pwd):/work" -w /work \
  ghcr.io/zompinc/uboot-arm64-toolchain ./build-uboot.sh

Docker works identically (docker run ...). Flashing the resulting image is done from the host, not in the container.

Tags

• latest - moves on every successful build.
• sha-<short> - pin a specific commit's image.

License

Apache-2.0. The image bundles open-source build tools only; any vendor blobs (e.g. Rockchip rkbin) are fetched by the consumer at run time and are not redistributed here.