cbcd13e4be
deploy/Containerfile builds the service in two stages, each base pinned by digest, from the locked dependencies with paths remapped and the timestamp fixed, and runs it as an unprivileged user with its store and keys on one volume; deploy/check-image.sh builds it, runs it, holds it to the smoke checks, restarts it to see it keep its jobs, and removes everything, pushing nothing. docs/self-host.md covers running it, its configuration, the store, the receipt keys and their rotation, API keys, energy and a reverse proxy; docs/provenance.md maps every field to the categories provenance surveys use; docs/scheduler.md describes the task interface by function. CI runs the engine's set, provenance and package-energy tests by name, and on the hardware runner the live package counter and a fully metered smoke. The READMEs and the changelog say what changed. Co-Authored-By: Claude Opus 5.5 <[email protected]>
49 lines
2.5 KiB
Docker
49 lines
2.5 KiB
Docker
# The WAI quantum job service as an OCI image, for running it yourself.
|
|
#
|
|
# Build from the repository's wai/ directory, with the ignore file beside
|
|
# this one keeping the context to the two crates the service is built from:
|
|
#
|
|
# docker build -f wai-quantum-service/deploy/Containerfile -t wai-quantum-service wai/
|
|
# (or: podman build -f ... the same)
|
|
#
|
|
# Two stages. The first builds the service with the repository's pinned
|
|
# toolchain from the locked dependencies; the second holds the binary alone,
|
|
# run as an unprivileged user. Both bases are pinned by digest, the build is
|
|
# locked, paths are remapped and the timestamp is fixed, so the same source
|
|
# builds the same binary. See ../docs/self-host.md for running it.
|
|
|
|
# The build stage: the language's build image at the repository's toolchain, pinned by digest.
|
|
FROM docker.io/library/rust:1.98.0-slim-trixie@sha256:17d1ba895198f9934c6314ec5346a0d5115372f3243390c3d731e242f35c2f27 AS build
|
|
ENV CARGO_INCREMENTAL=0 \
|
|
CARGO_TERM_COLOR=never \
|
|
SOURCE_DATE_EPOCH=0 \
|
|
RUSTFLAGS="--remap-path-prefix=/src=/build --remap-path-prefix=/usr/local/cargo=/cargo -C strip=symbols"
|
|
WORKDIR /src
|
|
COPY wai-quantum ./wai-quantum
|
|
COPY wai-quantum-service ./wai-quantum-service
|
|
WORKDIR /src/wai-quantum-service
|
|
# JOBS bounds the build's parallel jobs on a shared host (--build-arg JOBS=8).
|
|
ARG JOBS
|
|
RUN cargo build --locked --release ${JOBS:+--jobs "$JOBS"} && cp target/release/wai-quantum-service /wai-quantum-service
|
|
|
|
# The run stage: a slim base of the same release, pinned by digest, and the binary.
|
|
FROM docker.io/library/debian:trixie-slim@sha256:89c1ea91e897f0fe0a3731595330bc45b8bdef4047464a07116f891a94054b31
|
|
RUN useradd --system --uid 10001 --home-dir /var/lib/wai-quantum-service --create-home wai \
|
|
&& mkdir -p /var/lib/wai-quantum-service/store /var/lib/wai-quantum-service/keys \
|
|
&& chown -R wai:wai /var/lib/wai-quantum-service \
|
|
&& chmod 0700 /var/lib/wai-quantum-service/keys
|
|
COPY --from=build /wai-quantum-service /usr/local/bin/wai-quantum-service
|
|
USER wai
|
|
# Everything the service keeps lives under one volume: its job store and its receipt keys.
|
|
VOLUME ["/var/lib/wai-quantum-service"]
|
|
ENV WAI_QSVC_ADDR=0.0.0.0:8241 \
|
|
WAI_QSVC_STORE=/var/lib/wai-quantum-service/store \
|
|
WAI_QSVC_KEY=/var/lib/wai-quantum-service/keys/signing.key \
|
|
WAI_QSVC_PUBLIC_BASE=http://localhost:8241 \
|
|
WAI_QSVC_CONSOLE=http://localhost:8241/v1 \
|
|
WAI_QSVC_BUDGET_GB=8 \
|
|
WAI_QSVC_JOB_GB=4 \
|
|
WAI_QSVC_WORKERS=2
|
|
EXPOSE 8241
|
|
ENTRYPOINT ["/usr/local/bin/wai-quantum-service"]
|
|
CMD ["serve"]
|