feat: download busybox from fc-busybox release instead of embedding

Download busybox binary from e2b-dev/fc-busybox GitHub release at
Docker build time (via ADD) and at local build time (via curl in
Makefile). Removes ~3.2MB of committed binaries from git.

- Dockerfile: ADD from GitHub release, uses TARGETARCH
- Makefile: fetch-busybox target for local dev builds
- Both amd64 and arm64 binaries from same reproducible CI build

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: 2 people

packages/orchestrator/.gitignore

@@ -8,3 +8,6 @@ bin
 .shared
 /tmp
 .local-build
+
+# Downloaded at build time from fc-busybox release
+pkg/template/build/core/systeminit/busybox

packages/orchestrator/Dockerfile

@@ -3,7 +3,13 @@ ARG GOLANG_VERSION=1.25.4
 # It has to match with the host OS version (Ubuntu 22.04 = bookworm)
 ARG DEBIAN_VERSION=bookworm
 
+# Busybox version from fc-busybox GitHub release.
+# TARGETARCH is set automatically by Docker --platform.
+ARG BUSYBOX_VERSION=1.36.1
+
 FROM golang:${GOLANG_VERSION}-${DEBIAN_VERSION} AS builder
+ARG BUSYBOX_VERSION
+ARG TARGETARCH
 
 # Cached golang dependencies
 WORKDIR /build/shared
@@ -24,6 +30,10 @@ WORKDIR /build
 COPY ./shared/pkg ./shared/pkg
 COPY ./clickhouse/pkg ./clickhouse/pkg
 
+# Download busybox from fc-busybox release for go:embed
+ADD https://github.com/e2b-dev/fc-busybox/releases/download/v${BUSYBOX_VERSION}/busybox_v${BUSYBOX_VERSION}_${TARGETARCH} \
+    ./orchestrator/pkg/template/build/core/systeminit/busybox
+
 COPY ./orchestrator/pkg ./orchestrator/pkg
 COPY ./orchestrator/cmd ./orchestrator/cmd
 COPY ./orchestrator/main.go ./orchestrator/main.go

packages/orchestrator/Makefile

@@ -27,15 +27,26 @@ build:
 	$(eval COMMIT_SHA := $(shell git rev-parse --short HEAD))
 	@docker build --platform $(BUILD_PLATFORM) --output=bin --build-arg COMMIT_SHA="$(COMMIT_SHA)" -f ./Dockerfile ..
 
+BUSYBOX_VERSION ?= 1.36.1
+BUSYBOX_EMBED := pkg/template/build/core/systeminit/busybox
+
+.PHONY: fetch-busybox
+fetch-busybox:
+	@if [ ! -f $(BUSYBOX_EMBED) ]; then \
+		echo "Downloading busybox v$(BUSYBOX_VERSION) ($(BUILD_ARCH))..."; \
+		curl -sL -o $(BUSYBOX_EMBED) "https://github.com/e2b-dev/fc-busybox/releases/download/v$(BUSYBOX_VERSION)/busybox_v$(BUSYBOX_VERSION)_$(BUILD_ARCH)"; \
+		chmod +x $(BUSYBOX_EMBED); \
+	fi
+
 .PHONY: build-local
-build-local:
+build-local: fetch-busybox
 	# Allow for passing commit sha directly for docker builds
 	$(eval COMMIT_SHA ?= $(shell git rev-parse --short HEAD))
 	CGO_ENABLED=1 GOOS=linux GOARCH=$(BUILD_ARCH) go build -o bin/orchestrator -ldflags "-X=main.commitSHA=$(COMMIT_SHA)" .
 	CGO_ENABLED=1 GOOS=linux GOARCH=$(BUILD_ARCH) go build -o bin/clean-nfs-cache -ldflags "-X=main.commitSHA=$(COMMIT_SHA)" ./cmd/clean-nfs-cache
 
 .PHONY: build-debug
-build-debug:
+build-debug: fetch-busybox
 	CGO_ENABLED=1 GOOS=linux GOARCH=$(BUILD_ARCH) go build -race -gcflags=all="-N -l" -o bin/orchestrator .
 
 .PHONY: run-debug

packages/orchestrator/pkg/template/build/core/systeminit/busybox_1.36.1-2_amd64

@@ -1,11 +1,11 @@
 //go:build amd64
 
-// Busybox v1.36.1 static binary for amd64 (musl, minimal ~16 applets).
-// Custom build added in #1002 — origin unknown, no distro tag in binary.
+// Busybox static binary for amd64.
+// Downloaded from https://github.com/e2b-dev/fc-busybox/releases at build time.
 
 package systeminit
 
 import _ "embed"
 
-//go:embed busybox_1.36.1-2_amd64
+//go:embed busybox
 var BusyboxBinary []byte

packages/orchestrator/pkg/template/build/core/systeminit/busybox_1.36.1-2_arm64

@@ -1,12 +1,11 @@
 //go:build arm64
 
-// Busybox v1.36.1 static binary for arm64 (glibc, full 271 applets).
-// Source: Debian busybox-static 1:1.36.1-9 (https://packages.debian.org/busybox-static)
-// TODO: rebuild both binaries from the same minimal config for consistency.
+// Busybox static binary for arm64.
+// Downloaded from https://github.com/e2b-dev/fc-busybox/releases at build time.
 
 package systeminit
 
 import _ "embed"
 
-//go:embed busybox_1.36.1-2_arm64
+//go:embed busybox
 var BusyboxBinary []byte