The publish image¶
registry.gitlab.com/phpboyscout/go/dispatch/publish is a FROM scratch image holding one file,
the static cmd/publish binary, at /publish. It exists so a
Kubernetes pod can get the binary into a training container it does not own: a pod can take a file
only from an image or a volume, and the training image stays the user's. The design is D15 of
go/dispatch-kubeflow spec 0001.
Tags¶
| Tag | Published | Moves |
|---|---|---|
sha-<short commit> |
by every default-branch pipeline | never |
vX.Y.Z |
when go/dispatch releases vX.Y.Z |
never |
vX.Y |
with each vX.Y.Z |
to the latest patch |
latest |
with each release | to the latest release |
A release tag is a retag of the default branch's sha- image for the same commit, so vX.Y.Z and
its sha- tag share a digest. Reference the image by digest, never by tag:
registry.gitlab.com/phpboyscout/go/dispatch/publish@sha256:…. Read a release's digest with
crane digest registry.gitlab.com/phpboyscout/go/dispatch/publish:vX.Y.Z.
Layout¶
There is no shell, no cp, no CA bundle and no libc. The entrypoint is /publish and the user is
65532, which matters only to docker run; an image volume uses neither.
How a Kubeflow job uses it¶
The Kubeflow adapter puts the binary at /opt/dispatch/publish in the trainer's container, where a
job script runs it. Mount the publish image
covers the two routes and what each needs of the cluster, and the adapter's
publish settings name the image.
Building it¶
The Dockerfile is cmd/publish/Dockerfile; build it from the repository root. CI builds it with
Buildah, with SOURCE_DATE_EPOCH set to the commit's timestamp:
SOURCE_DATE_EPOCH="$(git log -1 --format=%ct)" \
buildah bud --format docker --source-date-epoch "$SOURCE_DATE_EPOCH" \
--rewrite-timestamp --omit-history -f cmd/publish/Dockerfile .
Two builds of one commit give the same digest. Every merge request checks that by building twice and comparing, and scans the image with trivy before the default branch publishes it.