didericis
c60e6b7e9f
Addresses the review finding that buildah lived only in the orchestrator
image, so the persistent infra VM wasn't the builder — a separate throwaway
builder VM contended with it for the orchestrator TAP. Consolidate:
- **Rebase the gateway (and thus infra) on `python:3.12-slim` = Debian
trixie**, pip-installing mitmproxy instead of `FROM mitmproxy/mitmproxy`
(Debian bookworm). trixie ships buildah 1.39, which can build agent
Dockerfiles that use heredocs; bookworm's 1.28 can't (`Unknown
instruction: "{"`). CA path is unchanged (set via `--set confdir=`).
- **buildah lives only in `Dockerfile.infra`** now (removed from the
orchestrator image, which is lean/stdlib-only again).
- **Shared orchestrator content**: `Dockerfile.orchestrator` is the single
definition of the control-plane payload; the infra image `COPY --from`s
it (same trixie base → clean copy, and future deps like iroh are added
once). The docker backend runs the orchestrator image directly.
- **`image_builder` builds inside the infra VM** (which now has buildah)
over SSH — no throwaway builder VM, so the `bborch0` contention is gone.
`ensure_built` builds orchestrator + gateway before infra (FROM gateway,
COPY --from orchestrator).
Verified on a KVM host: images build (buildah 1.39 in infra), the agent
image builds *inside* the infra VM (heredoc Dockerfile and all), the infra
VM stays healthy, the agent boots and `claude --version` = 2.1.172. The
rebased gateway still starts as a docker container and generates its CA
(docker backend unaffected).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WBMWTEtQdJ4W5UrWuLHCck
37 lines
1.8 KiB
Docker
37 lines
1.8 KiB
Docker
# Orchestrator control-plane image (PRD 0070, #384).
|
|
#
|
|
# This is the **single definition of the orchestrator's content** — the
|
|
# `bot_bottle` package baked onto a Python runtime — referenced by BOTH:
|
|
# * the docker backend, which runs this image directly as the lean
|
|
# control-plane container; and
|
|
# * the firecracker infra image (Dockerfile.infra), which `COPY --from`s
|
|
# this image's `/app/bot_bottle` so the single infra VM runs the same
|
|
# control plane. Keeping it in one place means future orchestrator deps
|
|
# (e.g. iroh) are added here once, not duplicated per backend.
|
|
#
|
|
# It stays deliberately lean: the control plane is **stdlib-only** today, so
|
|
# no third-party payload — none of the gateway's mitmproxy/git/gitleaks
|
|
# (that's Dockerfile.gateway) and no buildah (that's the firecracker
|
|
# builder, and lives only in Dockerfile.infra). Keeping the secret-dense
|
|
# control plane on a minimal dependency surface is the point (PRD 0070's
|
|
# "secret concentration").
|
|
#
|
|
# Shares the trixie `python:3.12-slim` base with the gateway image, so when
|
|
# the orchestrator grows real deps they can be `COPY --from`'d into the
|
|
# infra image cleanly (same base/python — installed packages copy safely).
|
|
|
|
FROM python:3.12-slim
|
|
|
|
WORKDIR /app
|
|
|
|
# The orchestrator content. Baked so the image is self-contained (runs from
|
|
# a built image, no runtime bind-mount); the docker backend may still
|
|
# bind-mount /app for dev live-reload, which simply overlays this copy.
|
|
# `.dockerignore` keeps .git/docs/*.md out of the context. (Future deps like
|
|
# iroh go here too — a shared requirements installed on this same base.)
|
|
COPY bot_bottle /app/bot_bottle
|
|
|
|
# Documentation only; lifecycle.py overrides the entrypoint to
|
|
# `python3 -m bot_bottle.orchestrator` with the runtime flags.
|
|
ENTRYPOINT ["python3", "-m", "bot_bottle.orchestrator"]
|