qm check reports "Dockerfile: yes" for a sandbox/Dockerfile that infra build-image ignores

[Mcstabbin]

qm check reports Dockerfile: yes when a sandbox/Dockerfile is present, which reads as confirmation that the AWS MicroVM image will be built from it. It will not be — qm infra build-image ignores that file and ships the CLI's own packaged template.

Version: @yc-software/qm 0.1.4, target: aws.

Reproduction

1. Hit the gh-2.96.0-1 build failure from AWS infra build-image is accepted, then both Lambda MicroVM builds fail without diagnostics #316 (error: MicroVM image version N.0 failed, no diagnostics).
2. Copy node_modules/@yc-software/qm/templates/aws/microvm-agent/Dockerfile to <layer>/sandbox/Dockerfile and change only the pin to gh.
3. qm check →

· sandbox: sandbox/
     tools : …
     skills: …
     Dockerfile: yes          <-- reads like the layer file is in play
✓ check passed — config, sandbox layer, and plugins are valid.

4. qm infra build-image → fails again, identically.

Proof it is ignored

The uploaded artifact was byte-identical across both builds — same content-addressed object name before and after adding the layer Dockerfile:

· uploaded s3://<bucket>/deployment/microvm-images/59bc8eef…919.zip     (before)
· uploaded s3://<bucket>/deployment/microvm-images/59bc8eef…919.zip     (after)

Downloading and extracting that ZIP settles it:

$ unzip -l img.zip
  Dockerfile
  agent.mjs

$ grep -n 'dnf install -y gh' Dockerfile
17:  && dnf install -y gh-2.96.0-1 \

The packaged template with the dead pin, not the layer's file. Patching the template in node_modules and rebuilding produced a different artifact hash and a successful image.

Worth noting the ZIP contains exactly two files. That is also useful information a reader of sandbox/ would not guess: skills and tools are not in the MicroVM image at all — only Dockerfile and agent.mjs are.

Why this costs real time

It compounds #316. When the build fails with no stateReason, an empty log group and nothing in CloudTrail, sandbox/Dockerfile is the obvious lever to reach for — and qm check actively confirms you pulled it. I applied the correct fix, to the correct file, and it changed nothing, twice, before I thought to extract the artifact from S3 and read what was actually in it.

The workaround also does not persist: patching node_modules/@yc-software/qm/templates/aws/microvm-agent/Dockerfile does not survive npm install.

Suggested fix

Either:

• have infra build-image prefer <layer>/sandbox/Dockerfile when present (what the check output implies), or
• scope the check output to the truth — e.g. Dockerfile: yes (docker/fly sandbox only; not used by infra build-image).

Either would be fine. The current combination — a check that says yes and a build that ignores it — is the trap.

Related: #316 (the gh-2.96.0-1 pin itself), #122.