feat: use {version}/{arch} path for Firecracker binaries

Standardize Firecracker binary paths to include architecture:
  {version}/{arch}/firecracker (e.g. v1.12.1/arm64/firecracker)

This aligns with the fc-kernels convention of {version}/{arch}/ and
prepares for multi-arch production deployments.

Changes:
- config.go: FirecrackerPath includes runtime.GOARCH in path
- create-build: download FC from GCS bucket (not GitHub releases),
  using {version}/{arch}/firecracker with legacy fallback on 404
- create-build: add errNotFound sentinel for reliable 404 detection,
  handle url.JoinPath errors explicitly
- script_builder_test.go: update expected paths for arch directory

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: tomassrnka

packages/orchestrator/cmd/create-build/main.go

@@ -11,6 +11,7 @@ import (
 	"net/url"
 	"os"
 	"path/filepath"
+	"runtime"
 	"strings"
 	"time"
 
@@ -417,30 +418,71 @@ func setupKernel(ctx context.Context, dir, version string) error {
 		return nil
 	}
 
-	kernelURL, _ := url.JoinPath("https://storage.googleapis.com/e2b-prod-public-builds/kernels/", version, "vmlinux.bin")
+	// On arm64, try arch-specific URL first (e.g. .../vmlinux-6.1.102/arm64/vmlinux.bin)
+	if runtime.GOARCH == "arm64" {
+		archURL, err := url.JoinPath("https://storage.googleapis.com/e2b-prod-public-builds/kernels/", version, "arm64", "vmlinux.bin")
+		if err != nil {
+			return fmt.Errorf("invalid kernel URL for arm64: %w", err)
+		}
+		fmt.Printf("⬇ Downloading kernel %s (arm64)...\n", version)
+		if err := download(ctx, archURL, dstPath, 0o644); err == nil {
+			return nil
+		} else if !errors.Is(err, errNotFound) {
+			return fmt.Errorf("failed to download arm64 kernel: %w", err)
+		}
+		fmt.Printf("  arm64 kernel not found, trying generic URL...\n")
+	}
+
+	kernelURL, err := url.JoinPath("https://storage.googleapis.com/e2b-prod-public-builds/kernels/", version, "vmlinux.bin")
+	if err != nil {
+		return fmt.Errorf("invalid kernel URL: %w", err)
+	}
 	fmt.Printf("⬇ Downloading kernel %s...\n", version)
 
 	return download(ctx, kernelURL, dstPath, 0o644)
 }
 
 func setupFC(ctx context.Context, dir, version string) error {
-	dstPath := filepath.Join(dir, version, "firecracker")
+	arch := runtime.GOARCH
+	dstPath := filepath.Join(dir, version, arch, "firecracker")
+
 	if err := os.MkdirAll(filepath.Dir(dstPath), 0o755); err != nil {
 		return fmt.Errorf("mkdir firecracker dir: %w", err)
 	}
 
 	if _, err := os.Stat(dstPath); err == nil {
-		fmt.Printf("✓ Firecracker %s exists\n", version)
+		fmt.Printf("✓ Firecracker %s (%s) exists\n", version, arch)
+
+		return nil
+	}
+
+	// Download from GCS bucket with {version}/{arch}/firecracker path
+	fcURL, err := url.JoinPath("https://storage.googleapis.com/e2b-prod-public-builds/fc-versions/", version, arch, "firecracker")
+	if err != nil {
+		return fmt.Errorf("invalid Firecracker URL: %w", err)
+	}
+
+	fmt.Printf("⬇ Downloading Firecracker %s (%s)...\n", version, arch)
 
+	if err := download(ctx, fcURL, dstPath, 0o755); err == nil {
 		return nil
+	} else if !errors.Is(err, errNotFound) {
+		return fmt.Errorf("failed to download Firecracker: %w", err)
 	}
 
-	fcURL := fmt.Sprintf("https://github.com/e2b-dev/fc-versions/releases/download/%s/firecracker", version)
-	fmt.Printf("⬇ Downloading Firecracker %s...\n", version)
+	// Fallback to legacy path without arch directory
+	legacyURL, err := url.JoinPath("https://storage.googleapis.com/e2b-prod-public-builds/fc-versions/", version, "firecracker")
+	if err != nil {
+		return fmt.Errorf("invalid Firecracker legacy URL: %w", err)
+	}
+
+	fmt.Printf("  %s path not found, trying legacy URL...\n", arch)
 
-	return download(ctx, fcURL, dstPath, 0o755)
+	return download(ctx, legacyURL, dstPath, 0o755)
 }
 
+var errNotFound = errors.New("not found")
+
 func download(ctx context.Context, url, path string, perm os.FileMode) error {
 	req, _ := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
 	resp, err := (&http.Client{Timeout: 5 * time.Minute}).Do(req)
@@ -449,6 +491,9 @@ func download(ctx context.Context, url, path string, perm os.FileMode) error {
 	}
 	defer resp.Body.Close()
 
+	if resp.StatusCode == http.StatusNotFound {
+		return fmt.Errorf("%w: %s", errNotFound, url)
+	}
 	if resp.StatusCode != http.StatusOK {
 		return fmt.Errorf("HTTP %d: %s", resp.StatusCode, url)
 	}

packages/orchestrator/internal/sandbox/fc/config.go

@@ -2,6 +2,7 @@ package fc
 
 import (
 	"path/filepath"
+	"runtime"
 
 	"github.com/e2b-dev/infra/packages/orchestrator/internal/cfg"
 )
@@ -35,7 +36,7 @@ func (t Config) HostKernelPath(config cfg.BuilderConfig) string {
 }
 
 func (t Config) FirecrackerPath(config cfg.BuilderConfig) string {
-	return filepath.Join(config.FirecrackerVersionsDir, t.FirecrackerVersion, FirecrackerBinaryName)
+	return filepath.Join(config.FirecrackerVersionsDir, t.FirecrackerVersion, runtime.GOARCH, FirecrackerBinaryName)
 }
 
 type RootfsPaths struct {

packages/orchestrator/internal/sandbox/fc/script_builder_test.go

@@ -1,6 +1,8 @@
 package fc
 
 import (
+	"fmt"
+	"runtime"
 	"strings"
 	"testing"
 
@@ -47,7 +49,7 @@ func TestStartScriptBuilder_Build(t *testing.T) {
 				"ln -s /orchestrator/sandbox/rootfs-test-sandbox-static-id.link /fc-vm/rootfs.ext4",
 				"mkdir -p /fc-vm/6.1.0",
 				"ln -s /fc-kernels/6.1.0/vmlinux.bin /fc-vm/6.1.0/vmlinux.bin",
-				"ip netns exec ns-789 /fc-versions/1.4.0/firecracker --api-sock",
+				fmt.Sprintf("ip netns exec ns-789 /fc-versions/1.4.0/%s/firecracker --api-sock", runtime.GOARCH),
 				"fc-test-sandbox-static-id.sock",
 			},
 		},
@@ -72,7 +74,7 @@ func TestStartScriptBuilder_Build(t *testing.T) {
 				"ln -s /orchestrator/sandbox/rootfs-legacy-sandbox-legacy-id.link /mnt/disks/fc-envs/v1/legacy-template/builds/legacy-build/rootfs.ext4",
 				"mount -t tmpfs tmpfs /fc-vm/5.10.0 -o X-mount.mkdir",
 				"ln -s /fc-kernels/5.10.0/vmlinux.bin /fc-vm/5.10.0/vmlinux.bin",
-				"ip netns exec legacy-ns /fc-versions/1.3.0/firecracker --api-sock",
+				fmt.Sprintf("ip netns exec legacy-ns /fc-versions/1.3.0/%s/firecracker --api-sock", runtime.GOARCH),
 				"fc-legacy-sandbox-legacy-id.sock",
 			},
 		},
@@ -94,7 +96,7 @@ func TestStartScriptBuilder_Build(t *testing.T) {
 			expectedScriptContent: []string{
 				"mkdir -p /fc-vm/6.2.1",
 				"ln -s /fc-kernels/6.2.1/vmlinux.bin /fc-vm/6.2.1/vmlinux.bin",
-				"ip netns exec custom-ns-id /fc-versions/1.5.0-beta/firecracker --api-sock",
+				fmt.Sprintf("ip netns exec custom-ns-id /fc-versions/1.5.0-beta/%s/firecracker --api-sock", runtime.GOARCH),
 				"fc-custom-sandbox-custom-id.sock",
 			},
 		},