didericis-codex
0fb9cf1782
refresh-image-locks / refresh (push) Successful in 25s
lint / lint (push) Successful in 1m5s
prd-number-check / require-numbered-prds (pull_request) Successful in 10s
tracker-policy-pr / check-pr (pull_request) Successful in 12s
test / image-input-builds (pull_request) Successful in 20s
test / integration-docker (pull_request) Successful in 1m10s
test / unit (pull_request) Successful in 2m17s
test / coverage (pull_request) Successful in 23s
38 lines
1.8 KiB
Docker
38 lines
1.8 KiB
Docker
# Orchestrator control-plane image (PRD 0070, #384).
|
|
#
|
|
# This is the **single definition of the orchestrator's content** — the
|
|
# `bot_bottle` package baked onto a Python runtime — referenced by BOTH:
|
|
# * the docker backend, which runs this image directly as the lean
|
|
# control-plane container; and
|
|
# * the firecracker orchestrator VM image (Dockerfile.orchestrator.fc),
|
|
# which is `FROM` this image and adds buildah for in-VM agent builds.
|
|
# Keeping the content in one place means future orchestrator deps (e.g.
|
|
# iroh) are added here once, not duplicated per backend.
|
|
#
|
|
# It stays deliberately lean: the control plane is **stdlib-only** today, so
|
|
# no third-party payload — none of the gateway's mitmproxy/git/gitleaks
|
|
# (that's Dockerfile.gateway) and no buildah (that's the firecracker
|
|
# builder, and lives only in Dockerfile.orchestrator.fc). Keeping the
|
|
# secret-dense control plane on a minimal dependency surface is the point
|
|
# (PRD 0070's "secret concentration").
|
|
#
|
|
# Shares an exact multi-architecture Python/trixie manifest with the gateway
|
|
# image. The version-qualified tag keeps the human-readable upstream version;
|
|
# the digest makes the bytes immutable.
|
|
|
|
ARG PYTHON_BASE_IMAGE
|
|
FROM ${PYTHON_BASE_IMAGE}
|
|
|
|
WORKDIR /app
|
|
|
|
# The orchestrator content. Baked so the image is self-contained (runs from
|
|
# a built image, no runtime bind-mount); the docker backend may still
|
|
# bind-mount /app for dev live-reload, which simply overlays this copy.
|
|
# `.dockerignore` keeps .git/docs/*.md out of the context. (Future deps like
|
|
# iroh go here too — a shared requirements installed on this same base.)
|
|
COPY bot_bottle /app/bot_bottle
|
|
|
|
# Documentation only; lifecycle.py overrides the entrypoint to
|
|
# `python3 -m bot_bottle.orchestrator` with the runtime flags.
|
|
ENTRYPOINT ["python3", "-m", "bot_bottle.orchestrator"]
|