KernelCI Pull Labs
What is KernelCI Pull Labs?
The Linaro Managed Pull Lab Service provides a turn-key bridge between private, on-premise hardware and the global open source kernel testing ecosystem established by KernelCI.
It utilizes a "Pull Lab" architecture to ensure proprietary silicon remains securely behind corporate firewalls. Instead of exposing internal labs to external networks, the infrastructure securely pulls standardized test jobs from the upstream CI, executes them locally, and reports the results back to community maintainers.
Key capabilities
100% Secure, On-Premise Testing: Test unreleased or specialised SoC platforms (ARM, RISC-V, x86) without compromising IP. Your hardware never leaves your facility, and no inbound firewall ports need to be opened.
Shift Bug Detection Left: Catch regressions in critical subsystems (drivers, power management, peripherals) during the upstream development cycle - long before they hit your internal validation pipelines.
Lower Enablement & Support Costs: By aligning your lab with standardised upstream testing practices, you ensure higher-quality, day-zero kernel support for your silicon at launch and throughout its lifecycle.
Zero Infrastructure Friction: Setting up and maintaining a CI bridge is a full-time DevOps job. Linaro's expert engineers handle the integration, maintenance, and upstream synchronisation, allowing your team to focus on product innovation rather than pipeline maintenance.
Example Product Screenshots
Dashboard
Get an at-a-glance overview of your appliances, recent jobs, and overall test success rate.
Click image to view full screenshotFeatures
Egress-Only Architecture
The architecture is completely egress-only, meaning no inbound firewall ports need to be opened. A dedicated Linaro Automation Appliance (LAA) deployed inside the lab initiates an outbound 'heartbeat' to pull test jobs. Because the LAA acts as a secure bridge requiring zero inbound rules, proprietary IP remains safely on-premise.
Zero-Trust Network Isolation
The lab environment is designed on a 'Zero-Trust' model. To prevent any lateral movement within the corporate network, the Device Under Test (DUT) sits on a completely separate VLAN. Strict data boundaries ensure that only metadata, public kernel binaries, and test results or logs leave the lab; proprietary design files and source code are never transferred.
Managed Lifecycle & Security
Setting up and maintaining a CI bridge is typically a full-time DevOps undertaking. Linaro's expert engineers handle the integration, maintenance, and upstream synchronization. Rather than relying on ad-hoc internal security, the service includes managed LAA updates and ongoing security hardening, allowing your team to focus strictly on silicon.
Technical Overview
Ready to get started?
Contact Linaro to set up a Pull Labs subscription for your organisation.