feat: add cachefilesd extension

.kres.yaml

@@ -9,6 +9,7 @@ spec:
     - bird2
     - bnx2-bnx2x
     - btrfs
+    - cachefilesd
     - chelsio-drivers
     - chelsio-firmware
     - cloudflared

MAINTAINERS.md

@@ -16,6 +16,7 @@ If the field is marked as `Needs Maintainer`, it means that the package is curre
 | binfmt-misc                               | Serge Logvinov     | [sergelogvinov](https://github.com/sergelogvinov)                                        |
 | bnx2-bnx2x                                | Sidero Labs        | NA                                                                                       |
 | btrfs                                     | Enno Boland        | [Gottox](https://github.com/Gottox)                                                      |
+| cachefilesd                               | Christian Jacobsen | [ChristianJacobsen](https://github.com/ChristianJacobsen)                                |
 | chelsio-drivers                           | Sidero Labs        | NA                                                                                       |
 | chelsio-firmware                          | Sidero Labs        | NA                                                                                       |
 | cloudflared                               | Maxime Nrb         | [maxnrb](https://github.com/maxnrb)                                                      |

Makefile

@@ -1,6 +1,6 @@
 # THIS FILE WAS AUTOMATICALLY GENERATED BY KRES, PLEASE DO NOT EDIT.
 #
-# Generated on 2026-08-13T08:51:05Z by kres 76f6e99.
+# Generated on 2026-08-13T15:16:29Z by kres 76f6e99.
 
 # common variables
 
@@ -73,6 +73,7 @@ TARGETS += binfmt-misc
 TARGETS += bird2
 TARGETS += bnx2-bnx2x
 TARGETS += btrfs
+TARGETS += cachefilesd
 TARGETS += chelsio-drivers
 TARGETS += chelsio-firmware
 TARGETS += cloudflared

README.md

@@ -157,6 +157,7 @@ tiers based on support level:
 | Name | Tier | Image | Version | Description |
 | ---- | ---- | ----- | ------- | ----------- |
 | [btrfs](storage/btrfs) | :yellow_square: extra | [ghcr.io/siderolabs/btrfs](https://github.com/siderolabs/extensions/pkgs/container/btrfs) | `VERSION` |  This system extension provides kernel module driver and userspace tools for BTRFS built against a specific Talos version. |
+| [cachefilesd](storage/cachefilesd) | :white_large_square: contrib | [ghcr.io/siderolabs/cachefilesd](https://github.com/siderolabs/extensions/pkgs/container/cachefilesd) | `0.10.10-VERSION` |  This system extension provides cachefilesd (FS-Cache caching backend daemon) and the cachefiles kernel module built against a specific Talos version. |
 | [drbd](storage/drbd) | :yellow_square: extra | [ghcr.io/siderolabs/drbd](https://github.com/siderolabs/extensions/pkgs/container/drbd) | `9.3.3-VERSION` |  This system extension provides kernel module driver for DRBD built against a specific Talos version. |
 | [fuse3](storage/fuse3) | :green_square: core | [ghcr.io/siderolabs/fuse3](https://github.com/siderolabs/extensions/pkgs/container/fuse3) | `3.18.2` |  This system extension provides fuse3 functionality. |
 | [iscsi-tools](storage/iscsi-tools) | :green_square: core | [ghcr.io/siderolabs/iscsi-tools](https://github.com/siderolabs/extensions/pkgs/container/iscsi-tools) | `v0.2.0` |  This system extension provides iscsi-tools. |

hack/release.toml

@@ -62,6 +62,13 @@ Kata Containers now has support for the `kata-qemu` runtime handler which uses Q
 The new extension `kata-container-snp` provides additional support for AMD SEV-SNP confidential VMs.
 """
 
+[notes.cachefilesd]
+    title = "cachefilesd"
+    description = """\
+The `cachefilesd` extension has been added to provide support for the `cachefilesd` daemon, which is used to cache files from a network filesystem (NFS) on a local disk.
+This can improve performance and reduce network load for frequently accessed files.
+"""
+
 [make_deps]
 
     [make_deps.tools]

storage/cachefilesd/README.md

@@ -0,0 +1,61 @@
+# cachefilesd
+
+This extension provides [cachefilesd](https://www.kernel.org/doc/html/latest/filesystems/caching/cachefiles.html) - the userspace daemon for FS-Cache, the Linux kernel filesystem caching facility. It ships both the `cachefiles` kernel module and the `cachefilesd` daemon.
+
+FS-Cache allows network filesystems (NFS, Ceph, etc.) to cache data on local disk, dramatically reducing cold-start latency for read-heavy workloads. The cache is transparent: applications see no change in behavior, but repeated reads from the network filesystem are served from local disk instead.
+
+## Usage
+
+The kernel module is not loaded automatically. Add `cachefiles` with `KernelModuleConfig` in your machine config:
+
+```yaml
+apiVersion: v1alpha1
+kind: KernelModuleConfig
+name: cachefiles
+```
+
+The `cachefilesd` extension service starts automatically once `/dev/cachefiles` appears (i.e., the module is loaded) and the user has provided a configuration file (see below).
+
+### Configuration
+
+Create a user volume which will serve as the cache location.
+Any user volume should work, e.g. using a partition or whole disk. If you want to share cache with `EPHEMERAL`, use directory type volume.
+
+```yaml
+apiVersion: v1alpha1
+kind: UserVolumeConfig
+name: fscache
+volumeType: partition
+provisioning:
+    diskSelector:
+        match: disk.transport == "nvme" 
+    maxSize: 50GiB
+```
+
+The extension ships no default config. The service waits until you provide `/etc/cachefilesd.conf` via [`EtcFileConfig`](https://www.talos.dev/v1.14/reference/configuration/runtime/etcfileconfig/), which is bind-mounted into the service container:
+
+```yaml
+apiVersion: v1alpha1
+kind: EtcFileConfig
+name: cachefilesd.conf
+mode: 0o644
+contents: |
+  dir /var/mnt/fscache
+  tag mycache
+  brun 10%
+  bcull 7%
+  bstop 3%
+  frun 10%
+  fcull 7%
+  fstop 3%
+```
+
+> Note: The `dir` line must point to a directory on a user volume `fscache`, so the value should be `/var/mnt/fscache` always, but the user volume backing it can be any user volume.
+
+### Enabling fscache on NFS mounts
+
+To cache an NFS export, add `fsc` to the mount options. For a Kubernetes PVC backed by NFS, this is typically done in the CSI driver or storage class configuration. Adjust the `dir` line in the config above if a different cache location is needed.
+
+## Compatibility
+
+Requires a Talos kernel built with `CONFIG_FSCACHE=y` and `CONFIG_NFS_FSCACHE=y` (if using NFS fscache). The `cachefiles` module (`CONFIG_CACHEFILES=m`) is provided by this extension.

storage/cachefilesd/cachefilesd.yaml

@@ -0,0 +1,37 @@
+name: cachefilesd
+depends:
+  - path: /dev/cachefiles
+  - path: /etc/cachefilesd.conf
+  - path: /var/mnt/fscache
+container:
+  entrypoint: /usr/local/sbin/cachefilesd
+  args:
+    - -s
+    - -n
+    - -f
+    - /usr/local/etc/cachefilesd.conf
+  mounts:
+    # cache root, rw: the cachefiles kernel module sets xattrs on it
+    - source: /var/mnt/fscache
+      destination: /var/mnt/fscache
+      type: bind
+      options:
+        - rshared
+        - rbind
+        - rw
+    # config file, populated by EtcFileConfig
+    - source: /etc/cachefilesd.conf
+      destination: /usr/local/etc/cachefilesd.conf
+      type: bind
+      options:
+        - rbind
+        - ro
+    # /dev for /dev/cachefiles and /dev/null
+    - source: /dev
+      destination: /dev
+      type: bind
+      options:
+        - rshared
+        - rbind
+        - rw
+restart: always

storage/cachefilesd/files/modules.txt

@@ -0,0 +1,4 @@
+modules.order
+modules.builtin
+modules.builtin.modinfo
+kernel/fs/cachefiles/cachefiles.ko

storage/cachefilesd/manifest.yaml.tmpl

@@ -0,0 +1,10 @@
+version: v1alpha1
+metadata:
+  name: cachefilesd
+  version: "{{ .VERSION }}"
+  author: Sidero Labs
+  description: |
+    [{{ .TIER }}] This system extension provides cachefilesd (FS-Cache caching backend daemon) and the cachefiles kernel module built against a specific Talos version.
+  compatibility:
+    talos:
+      version: ">= v1.13.0"

storage/cachefilesd/patches/create-cache-dirs.patch

@@ -0,0 +1,53 @@
+Create the 'cache' and 'graveyard' subdirectories of the cache root if they
+don't exist yet, instead of failing to start.
+
+cachefilesd requires both to be present under the directory given by the 'dir'
+config option, but never creates them: distro packaging normally ships them, and
+in a Talos extension service container there is nothing to do that. Create them
+right after the config file is parsed, before the cache is bound.
+
+--- a/cachefilesd.c
++++ b/cachefilesd.c
+@@ -214,6 +214,7 @@
+ #define debug(DL, FMT,...)	__message(DL, LOG_DEBUG,  FMT"\n" ,##__VA_ARGS__)
+ #define notice(FMT,...)		__message(0,  LOG_NOTICE, FMT"\n" ,##__VA_ARGS__)
+
++static void create_cache_subdir(const char *name);
+ static void open_cache(void);
+ static void cachefilesd(void) __attribute__((noreturn));
+ static void reap_graveyard(void);
+@@ -528,6 +529,13 @@
+ 	if (fclose(config) == EOF)
+ 		oserror("Unable to close %s", configfile);
+
++	/* make sure the subdirectories the kernel module and the scanner
++	 * require exist before the cache is bound */
++	if (cacheroot) {
++		create_cache_subdir("cache");
++		create_cache_subdir("graveyard");
++	}
++
+ 	/* allocate the cull tables */
+ 	if (!culling_disabled) {
+ 		cullbuild = calloc(culltable_size, sizeof(cullbuild[0]));
+@@ -592,6 +600,20 @@
+ }
+
+ /*****************************************************************************/
++/*
++ * create a subdirectory of the cache root if it doesn't exist yet
++ */
++static void create_cache_subdir(const char *name)
++{
++	char buffer[PATH_MAX + 1];
++
++	snprintf(buffer, sizeof(buffer), "%s/%s", cacheroot, name);
++
++	if (mkdir(buffer, 0700) < 0 && errno != EEXIST)
++		oserror("Unable to create %s", buffer);
++}
++
++/*****************************************************************************/
+ /*
+  * open the cache directories
+  */

storage/cachefilesd/pkg.yaml

@@ -0,0 +1,70 @@
+name: cachefilesd
+variant: scratch
+shell: /bin/bash
+dependencies:
+  - stage: base
+  # The pkgs version for a particular release of Talos as defined in
+  # https://github.com/siderolabs/talos/blob/<talos version>/pkg/machinery/gendata/data/pkgs
+  - image: "{{ .BUILD_ARG_PKGS_PREFIX }}/kernel:{{ .BUILD_ARG_PKGS }}"
+  # self-contained service container rootfs (same recipe as lldpd)
+  - image: "{{ .BUILD_ARG_PKGS_PREFIX }}/fhs:{{ .BUILD_ARG_PKGS }}"
+    from: /
+    to: /rootfs/usr/local/lib/containers/cachefilesd
+  - image: "{{ .BUILD_ARG_PKGS_PREFIX }}/musl:{{ .BUILD_ARG_PKGS }}"
+    from: /usr/lib
+    to: /rootfs/usr/local/lib/containers/cachefilesd/usr/lib
+steps:
+  - sources:
+      - url: https://deb.debian.org/debian/pool/main/c/cachefilesd/cachefilesd_{{ .CACHEFILESD_VERSION }}.orig.tar.bz2
+        destination: cachefilesd.tar.bz2
+        sha256: {{ .CACHEFILESD_SHA256 }}
+        sha512: {{ .CACHEFILESD_SHA512 }}
+    env:
+      SOURCE_DATE_EPOCH: {{ .BUILD_ARG_SOURCE_DATE_EPOCH }}
+    prepare:
+      - |
+        tar -xjf cachefilesd.tar.bz2 --strip-components=1
+
+        patch -p1 < /pkg/patches/create-cache-dirs.patch
+    build:
+      - |
+        # musl has no stat64/fstatat64; _LARGEFILE64_SOURCE aliases them to the base functions
+        make CFLAGS="-O2 -Wall -D_LARGEFILE64_SOURCE" cachefilesd
+    install:
+      - |
+        export KERNELRELEASE=$(find /usr/lib/modules -type d -name "*-talos" -exec basename {} \+)
+
+        mkdir -p /rootfs
+
+        # install cachefiles kernel module
+        xargs -a /pkg/files/modules.txt -I {} install -D /usr/lib/modules/${KERNELRELEASE}/{} /rootfs/usr/lib/modules/${KERNELRELEASE}/{}
+        depmod -b /rootfs/usr ${KERNELRELEASE}
+
+        # install cachefilesd daemon into the service container rootfs
+        # (no default config: the user provides /etc/cachefilesd.conf via EtcFileConfig)
+        install -D -m 0755 cachefilesd /rootfs/usr/local/lib/containers/cachefilesd/usr/local/sbin/cachefilesd
+
+        # install service container definition
+        mkdir -p /rootfs/usr/local/etc/containers
+        cp /pkg/cachefilesd.yaml /rootfs/usr/local/etc/containers/
+    test:
+      - |
+        # https://www.kernel.org/doc/html/v4.15/admin-guide/module-signing.html#signed-modules-and-stripping
+        find /rootfs/usr/lib/modules -name '*.ko' -exec grep -FL '~Module signature appended~' {} \+
+      - |
+        mkdir -p /extensions-validator-rootfs
+        cp -r /rootfs/ /extensions-validator-rootfs/rootfs
+        cp /pkg/manifest.yaml /extensions-validator-rootfs/manifest.yaml
+        /extensions-validator validate --rootfs=/extensions-validator-rootfs --pkg-name="${PKG_NAME}"
+    sbom:
+      outputPath: /rootfs/usr/local/share/spdx/cachefilesd.spdx.json
+      version: {{ .CACHEFILESD_VERSION }}
+      cpes:
+        - cpe:2.3:a:cachefilesd_project:cachefilesd:{{ .CACHEFILESD_VERSION }}:*:*:*:*:*:*:*
+      licenses:
+        - GPL-2.0-or-later
+finalize:
+  - from: /rootfs
+    to: /rootfs
+  - from: /pkg/manifest.yaml
+    to: /

storage/cachefilesd/vars.yaml

@@ -0,0 +1,3 @@
+VERSION: "{{ .CACHEFILESD_VERSION}}-{{ .BUILD_ARG_TAG }}"
+
+TIER: "contrib"

storage/vars.yaml

@@ -14,3 +14,7 @@ LIBEVENT_SHA512: 5c7a1b9f48087258f49653ecb4ce24d7015a9ef4015ad6ffa910a101d5bd37c
 SQLITE_VERSION: 3.53.4
 SQLITE_SHA256: 16bc1b2027ba2653e3d262e740376be23f67cad77865db814493267494326c3c
 SQLITE_SHA512: 5975efe014f43b974b1dd88be36b3a37ae97ec11eec1b9159a853cd6eb2898035dc2bf43ad8f1e856616e6ca5a846cf7c976855fa901a1a631b69917e63b3af4
+# renovate: datasource=debian depName=cachefilesd
+CACHEFILESD_VERSION: "0.10.10"
+CACHEFILESD_SHA256: 0d0309851efabd02b7c849f73535b8ad3f831570e83e4f65e42354da18e11a02
+CACHEFILESD_SHA512: d7d816b5ef1fffe1272cb8c2e9cbd18c1393438afca250436a36a446c6a37303e7784057725a56be839e0489101190b563c4fc015fc4ff11baa8003121e5183a