From b7599ed146870a5f3052dac63587f9ef8fefd8a7 Mon Sep 17 00:00:00 2001 From: didericis Date: Sat, 25 Jul 2026 15:05:04 -0400 Subject: [PATCH] refactor(firecracker): drop the orphaned Dockerfile.infra intermediate MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The orchestrator/gateway container split retired the docker backend's combined `bot-bottle-infra` container, leaving `Dockerfile.infra` used only as the base layer for the firecracker rootfs image — and its header still (falsely) claimed "used directly by the Docker backend." Fold its one `COPY --from orchestrator` into `Dockerfile.infra.fc` (now `FROM bot-bottle-gateway` directly + the copy + buildah), delete Dockerfile.infra, and drop the now-dead build step + artifact-version entry. `build_infra_images_with_docker` builds three images instead of four; the firecracker rootfs is unchanged in content (still gateway + orchestrator package + buildah, one artifact). Co-Authored-By: Claude Opus 4.8 --- Dockerfile.infra | 22 ------------ Dockerfile.infra.fc | 35 ++++++++++++------- .../backend/firecracker/infra_artifact.py | 2 +- bot_bottle/backend/firecracker/infra_vm.py | 25 +++++++------ 4 files changed, 36 insertions(+), 48 deletions(-) delete mode 100644 Dockerfile.infra diff --git a/Dockerfile.infra b/Dockerfile.infra deleted file mode 100644 index 0bd1e76e..00000000 --- a/Dockerfile.infra +++ /dev/null @@ -1,22 +0,0 @@ -# Shared infra image: gateway data plane + orchestrator control plane. -# -# Used directly by the Docker backend (run as one `bot-bottle-infra` -# container, replacing the prior two-container split). The Firecracker -# backend extends this via Dockerfile.infra.fc, adding buildah/crun/ -# netavark for in-VM agent-image building. -# -# Dockerfile.orchestrator is the single definition of the orchestrator -# content (the lean `bot_bottle` package on python:3.12-slim). Both this -# image and Dockerfile.infra.fc pull it in via `COPY --from`. -# -# multi-`FROM` can't union two bases (that's multi-stage, not multiple -# inheritance), so the orchestrator content is pulled in via `COPY --from` -# rather than a second base. Both images share the trixie `python:3.12-slim` -# base, so the copy is clean (same python; future installed deps copy too). -FROM bot-bottle-gateway:latest - -# The orchestrator content, from its single definition. The gateway image -# already has the flat daemon modules under /app; this adds the full -# `bot_bottle` package so `python3 -m bot_bottle.orchestrator` resolves — -# used by gateway_init when BOT_BOTTLE_GATEWAY_DAEMONS includes `orchestrator`. -COPY --from=bot-bottle-orchestrator:latest /app/bot_bottle /app/bot_bottle diff --git a/Dockerfile.infra.fc b/Dockerfile.infra.fc index 422fd60c..c2e7dc4f 100644 --- a/Dockerfile.infra.fc +++ b/Dockerfile.infra.fc @@ -1,19 +1,30 @@ # Firecracker infra VM image (PRD 0070 Stage B). # -# Extends the shared infra base (Dockerfile.infra: gateway + orchestrator -# control plane) with the in-VM agent-image builder. The Firecracker backend -# builds users' agent Dockerfiles *inside this VM* with buildah (rootless, -# daemonless) instead of on the host — no host Docker daemon, no -# root-equivalent `docker` group. +# The shared rootfs both firecracker infra VMs boot: the gateway data plane + +# the orchestrator control plane + the in-VM agent-image builder. A `bb_role=` +# kernel-cmdline arg selects which plane the guest init starts (see +# `infra_vm._infra_init`), so there is one artifact to build/publish/pull. # -# Requires the trixie base from bot-bottle-gateway (buildah 1.39: bookworm's -# 1.28 can't parse Dockerfile heredocs that agent images use). +# `Dockerfile.orchestrator` is the single definition of the orchestrator +# content (the lean `bot_bottle` package on trixie `python:3.12-slim`); it's +# pulled in via `COPY --from` (multi-`FROM` can't union two bases). Both images +# share the trixie base, so the copy is clean. # -# `crun` is the OCI runtime; `netavark` + `aardvark-dns` are the network -# backend for `FROM` pulls + `RUN` egress. `vfs` + `chroot`: buildah works -# as root in the bare microVM (no fuse-overlayfs / overlay module / subuid -# maps). Matches image_builder. -FROM bot-bottle-infra:latest +# The Firecracker backend builds users' agent Dockerfiles *inside the +# orchestrator VM* with buildah (rootless, daemonless) instead of on the host — +# no host Docker daemon, no root-equivalent `docker` group. Requires the trixie +# base from bot-bottle-gateway (buildah 1.39: bookworm's 1.28 can't parse the +# Dockerfile heredocs agent images use). `crun` is the OCI runtime; `netavark` + +# `aardvark-dns` are the network backend for `FROM` pulls + `RUN` egress. `vfs` + +# `chroot`: buildah works as root in the bare microVM (no fuse-overlayfs / +# overlay module / subuid maps). Matches image_builder. +FROM bot-bottle-gateway:latest + +# The orchestrator content, from its single definition. The gateway image +# already has the flat daemon modules under /app; this adds the full +# `bot_bottle` package so `python3 -m bot_bottle.orchestrator` resolves in the +# orchestrator-role VM. +COPY --from=bot-bottle-orchestrator:latest /app/bot_bottle /app/bot_bottle RUN apt-get update \ && apt-get install -y --no-install-recommends \ diff --git a/bot_bottle/backend/firecracker/infra_artifact.py b/bot_bottle/backend/firecracker/infra_artifact.py index eb8396df..2d847de5 100644 --- a/bot_bottle/backend/firecracker/infra_artifact.py +++ b/bot_bottle/backend/firecracker/infra_artifact.py @@ -41,7 +41,7 @@ from . import util _ARTIFACT_FORMAT = "1" _REPO_ROOT = Path(__file__).resolve().parents[3] -_DOCKERFILES = ("Dockerfile.orchestrator", "Dockerfile.gateway", "Dockerfile.infra", "Dockerfile.infra.fc") +_DOCKERFILES = ("Dockerfile.orchestrator", "Dockerfile.gateway", "Dockerfile.infra.fc") _DEFAULT_BASE = "https://gitea.dideric.is" _DEFAULT_OWNER = "didericis" diff --git a/bot_bottle/backend/firecracker/infra_vm.py b/bot_bottle/backend/firecracker/infra_vm.py index bca52c81..12e0770e 100644 --- a/bot_bottle/backend/firecracker/infra_vm.py +++ b/bot_bottle/backend/firecracker/infra_vm.py @@ -61,9 +61,10 @@ _GUEST_SIGNING_KEY_PATH = "/var/lib/bot-bottle/orchestrator-token" # the gateway daemons present it to the orchestrator, and never see the key. _GUEST_GATEWAY_JWT_PATH = "/var/lib/bot-bottle/gateway-jwt" -# The single shared infra image: gateway data plane + baked control-plane -# source + buildah (Dockerfile.infra.fc). Built from source by default; a -# pull-from-registry mode lands later. Both VMs boot from it. +# The single shared infra image: gateway data plane + COPY'd control-plane +# `bot_bottle` package + buildah (Dockerfile.infra.fc, FROM gateway). Built from +# source by default; a pull-from-registry mode lands later. Both VMs boot from +# it, the `bb_role` cmdline selecting the plane. _INFRA_IMAGE = "bot-bottle-infra:latest" _GATEWAY_IMAGE = "bot-bottle-gateway:latest" _ORCHESTRATOR_IMAGE = "bot-bottle-orchestrator:latest" @@ -124,9 +125,9 @@ def ensure_built() -> None: Default (docker-free, PRD 0069 Stage 2): download + verify the prebuilt rootfs artifact matching this code version (see `infra_artifact`); the launch host needs no Docker. `BOT_BOTTLE_INFRA_BUILD=local` instead builds - the fixed images from source with host Docker — the infra image - `COPY --from`s the orchestrator image and is `FROM` the gateway image, so - both must exist first — for iterating on the Dockerfiles.""" + the fixed images from source with host Docker — the infra image is `FROM` + the gateway image and `COPY --from`s the orchestrator image, so both must + exist first — for iterating on the Dockerfiles.""" if infra_artifact.local_build_requested(): build_infra_images_with_docker() return @@ -135,17 +136,15 @@ def ensure_built() -> None: def build_infra_images_with_docker() -> None: - """Build the four fixed images from source with host Docker: orchestrator, - gateway, the shared infra base (Dockerfile.infra), then the Firecracker - infra image (Dockerfile.infra.fc: FROM infra + buildah). The launch host - uses this only in `BOT_BOTTLE_INFRA_BUILD=local` mode; `publish_infra` - uses it off-host to produce the published artifact.""" + """Build the three fixed images from source with host Docker: orchestrator, + gateway, then the Firecracker infra image (Dockerfile.infra.fc: FROM gateway + + COPY --from orchestrator + buildah). The launch host uses this only in + `BOT_BOTTLE_INFRA_BUILD=local` mode; `publish_infra` uses it off-host to + produce the published artifact.""" docker_mod.build_image( _ORCHESTRATOR_IMAGE, str(_REPO_ROOT), dockerfile="Dockerfile.orchestrator") docker_mod.build_image( _GATEWAY_IMAGE, str(_REPO_ROOT), dockerfile="Dockerfile.gateway") - docker_mod.build_image( - "bot-bottle-infra:latest", str(_REPO_ROOT), dockerfile="Dockerfile.infra") docker_mod.build_image( _INFRA_IMAGE, str(_REPO_ROOT), dockerfile="Dockerfile.infra.fc")