@@ -54,9 +54,8 @@ jobs:
           files: ./coverage.out
           flags: unit
 
-  # the built miso must also behave on arm64 hosts, which the amd64 runner
-  # cannot show
-  cli-arm64:
+  # miso must also behave on arm64 hosts, which the amd64 runner cannot show
+  arm64:
     runs-on: ubuntu-24.04-arm
     steps:
       - uses: actions/checkout@v7
@@ -72,4 +71,9 @@ jobs:
           assert-install: false
           detik-install: false
           file-install: false
-      - run: just test-cli
+      # the qemu tests claim a CID on the host's real vsock device
+      - name: open the vsock device
+        run: |
+          sudo modprobe vhost_vsock
+          sudo chmod o+rw /dev/vhost-vsock
+      - run: just test test-cli
@@ -76,6 +76,20 @@ func TestAnElfOptionWithAValueFailsAtItsLineNamingIt(t *testing.T) {
 	assert.ErrorContains(t, err, "--elf")
 }
 
+func TestAnElfOptionForAnArm64ImageFailsAtItsLine(t *testing.T) {
+	// arrange
+	source := planned(t, "FROM debian:13\nOUTPUT kernel --elf vmlinux\n")
+	source.Arch = "arm64"
+
+	// act
+	_, err := build.Requests(source, network)
+
+	// assert
+	require.ErrorIs(t, err, build.ErrELFNeedsBzImage)
+	assert.ErrorContains(t, err, "line 2")
+	assert.ErrorContains(t, err, "--elf")
+}
+
 func TestAKernelOutputWithAPathAsksForThatFileOfTheImage(t *testing.T) {
 	// arrange
 	source := planned(t, "FROM debian:13\nOUTPUT kernel --path=/src/linux/arch/x86/boot/bzImage vmlinuz\n")
 
@@ -16,8 +16,8 @@ import (
 // A disk, an ISO or a rootfs takes the tools from where their stage ends, the
 // kernel and the initrd are taken from the image, and an unpacked kernel
 // takes the tools too.
-func outputRequest(step plan.Step, instruction imagefile.Output, under rootfs, tools rootfs, inputs diskInputs) (protocol.Message, error) {
-	refused := refusal(instruction)
+func outputRequest(step plan.Step, instruction imagefile.Output, under rootfs, tools rootfs, inputs diskInputs, arch string) (protocol.Message, error) {
+	refused := refusal(instruction, arch)
 	if refused == nil && instruction.Kind == plan.KindUpdate {
 		refused = updateRefusal(instruction, inputs.partitions)
 	}
@@ -39,8 +39,9 @@ func outputRequest(step plan.Step, instruction imagefile.Output, under rootfs, t
 	return protocol.Disk{Key: step.Key, Layers: under.layers, Tools: tools.layers, ElTorito: instruction.Kind == plan.KindISO, Split: instruction.Kind == plan.KindUpdate, Partitions: slices.Clone(inputs.partitions), Cmdline: strings.Join(inputs.cmdline, " ")}, nil
 }
 
-// refusal is why miso cannot make an output, or nil when it can.
-func refusal(instruction imagefile.Output) error {
+// refusal is why miso cannot make an output for an image of arch, or nil
+// when it can.
+func refusal(instruction imagefile.Output, arch string) error {
 	unknown, hasUnknown := unknownOption(instruction.Options, plan.Options(instruction.Kind))
 	switch {
 	case !plan.Known(instruction.Kind):
@@ -49,6 +50,8 @@ func refusal(instruction imagefile.Output) error {
 		return fmt.Errorf("--%s: %w", unknown, ErrUnknownOption)
 	case instruction.Options[plan.OptionELF] != "":
 		return fmt.Errorf("--%s: %w", plan.OptionELF, ErrOptionTakesNoValue)
+	case plan.Unpacks(instruction) && arch != "" && arch != "amd64":
+		return fmt.Errorf("--%s: %w", plan.OptionELF, ErrELFNeedsBzImage)
 	case pathGiven(instruction.Options) && !path.IsAbs(instruction.Options[plan.OptionPath]):
 		return fmt.Errorf("--%s=%s: %w", plan.OptionPath, instruction.Options[plan.OptionPath], ErrPathNotAbsolute)
 	case plan.TakesFormat(instruction.Kind) && !slices.Contains(formats, formatOf(instruction.Options)):
 
@@ -30,6 +30,10 @@ var ErrPathNotAbsolute = errors.New("path is not absolute")
 // ErrOptionTakesNoValue is an option that only says yes, given a value.
 var ErrOptionTakesNoValue = errors.New("option takes no value")
 
+// ErrELFNeedsBzImage is --elf on an image for an architecture whose kernel
+// is no bzImage.
+var ErrELFNeedsBzImage = errors.New("needs an x86 bzImage, other kernels are unpacked already")
+
 // ErrUnknownFormat is a file system a rootfs cannot be.
 var ErrUnknownFormat = errors.New("unknown file system")
 
@@ -126,7 +130,7 @@ func requestsUntil(planned plan.Plan, network protocol.Network, shell shellAt) (
 
 			inputs.add(step.Instruction)
 
-			message, err := messageOf(step, under, ends, network, inputs)
+			message, err := messageOf(step, under, ends, network, inputs, planned.Arch)
 			if err != nil {
 				return nil, false, err
 			}
@@ -174,14 +178,14 @@ func importOf(stage plan.Stage) Request {
 
 // messageOf is what the agent is asked for a step on the root file system
 // under it, or nothing for a step the agent has no part in.
-func messageOf(step plan.Step, under rootfs, ends map[string]rootfs, network protocol.Network, inputs diskInputs) (protocol.Message, error) {
+func messageOf(step plan.Step, under rootfs, ends map[string]rootfs, network protocol.Network, inputs diskInputs, arch string) (protocol.Message, error) {
 	switch instruction := step.Instruction.(type) {
 	case imagefile.Run:
 		return protocol.Run{Key: step.Key, Layers: under.layers, Env: under.env, Command: instruction.Command, Network: networkFor(instruction, network)}, nil
 	case imagefile.Copy:
 		return copyRequest(step, instruction, under, ends[instruction.From])
 	case imagefile.Output:
-		return outputRequest(step, instruction, under, ends[plan.BuiltinTools], inputs)
+		return outputRequest(step, instruction, under, ends[plan.BuiltinTools], inputs, arch)
 	}
 
 	return nil, nil
 
@@ -6,6 +6,9 @@ import "github.com/The127/miso/internal/imagefile"
 type Plan struct {
 	Agent string
 
+	// the architecture the image is built for, empty is amd64
+	Arch string
+
 	// the bases a build fetches before it plans again, in FROM order
 	Downloads []string
 	Stages    []Stage
 
@@ -46,7 +46,7 @@ boot it. The initrd is made again with the driver of the virtual disk. The
 Result: `out/os.ext4`, `out/vmlinuz` and `out/initrd.img`
 
 The `Imagefile` has a `qemu-system-x86_64` command that boots them. Firecracker
-needs the kernel as an ELF file, so write `OUTPUT kernel vmlinux --elf`
+on x86 needs the kernel as an ELF file, so write `OUTPUT kernel vmlinux --elf`
 instead of `OUTPUT kernel vmlinuz`. The `Imagefile` also has a Firecracker
 configuration that boots the result to a login prompt.
 
 
@@ -246,7 +246,7 @@ to `miso build -o`.
 | `sysext` | A system extension in a disk image with one root partition. | `--format` |
 | `confext` | A configuration extension in a disk image with one root partition. | `--format` |
 | `update` | A directory with the files `systemd-sysupdate` uses. | `--version=<version>` (required) |
-| `kernel` | The kernel of the image. | `--elf` unpacks it to an ELF file, `--path=<file>` names it |
+| `kernel` | The kernel of the image. | `--elf` unpacks an x86 kernel to an ELF file, `--path=<file>` names it |
 | `initrd` | The initrd of the image. | `--path=<file>` names it |
 
 The kernel and the initrd are found in the image. miso uses the newest
 
@@ -99,8 +99,10 @@ OUTPUT initrd initrd.img --path=/src/initrd.img
 
 The kernel and the initrd of the image, copied as they are.
 
-`--elf` unpacks the kernel to the ELF file it contains. Firecracker needs
-that form.
+`--elf` unpacks an x86 bzImage to the ELF file it contains, which
+Firecracker needs on x86. An arm64 kernel is an `Image` that is unpacked
+already, and Firecracker takes it as it is, so an arm64 build refuses
+`--elf`.
 
 `--path` names the file in the image, for a kernel or an initrd that a `RUN`
 built somewhere else. It must be an absolute path. It works together with
@@ -214,6 +216,8 @@ It also gives the reason. These are the ones from the `OUTPUT` line itself:
 - `unknown kind of output`
 - `--x: unknown option`
 - `--elf: option takes no value`
+- `--elf: needs an x86 bzImage, other kernels are unpacked already`, on an
+  arm64 image
 - `--path=x: path is not absolute`
 - `--format=x: unknown file system`
 - `not a plain file name`, when the name has a `/` in it
 
@@ -25,7 +25,7 @@ own_arch() {
     [[ "$output" == *"amd64"* ]]
 }
 
-# only a host that is not amd64 tells the two runs apart, see the cli-arm64 job
+# only a host that is not amd64 tells the two runs apart, see the arm64 job
 @test "a build without --arch is a build for the arch miso runs on" {
     # the cache of the test, which is not the user's
     export XDG_CACHE_HOME="$BATS_TEST_TMPDIR/cache"
Original file line number	Diff line number	Diff line change
`@@ -25,7 +25,7 @@ own_arch() {`
`25`	`25`	`[[ "$output" == "amd64" ]]`
`26`	`26`	`}`
`27`	`27`
`28`		`-# only a host that is not amd64 tells the two runs apart, see the cli-arm64 job`
	`28`	`+# only a host that is not amd64 tells the two runs apart, see the arm64 job`
`29`	`29`	`@test "a build without --arch is a build for the arch miso runs on" {`
`30`	`30`	`# the cache of the test, which is not the user's`
`31`	`31`	`export XDG_CACHE_HOME="$BATS_TEST_TMPDIR/cache"`