cbcd13e4be
deploy/Containerfile builds the service in two stages, each base pinned by digest, from the locked dependencies with paths remapped and the timestamp fixed, and runs it as an unprivileged user with its store and keys on one volume; deploy/check-image.sh builds it, runs it, holds it to the smoke checks, restarts it to see it keep its jobs, and removes everything, pushing nothing. docs/self-host.md covers running it, its configuration, the store, the receipt keys and their rotation, API keys, energy and a reverse proxy; docs/provenance.md maps every field to the categories provenance surveys use; docs/scheduler.md describes the task interface by function. CI runs the engine's set, provenance and package-energy tests by name, and on the hardware runner the live package counter and a fully metered smoke. The READMEs and the changelog say what changed. Co-Authored-By: Claude Opus 5.5 <[email protected]>
36 lines
2.1 KiB
Shell
Executable file
36 lines
2.1 KiB
Shell
Executable file
#!/usr/bin/env bash
|
|
# check-image.sh: build the service's image, run it, and hold it to the
|
|
# service's smoke checks over HTTP; then remove the container, the image and
|
|
# its volume. Nothing is pushed anywhere.
|
|
#
|
|
# bash wai/wai-quantum-service/deploy/check-image.sh (from the repository's root)
|
|
#
|
|
# ENGINE picks the container engine (docker, or podman), JOBS bounds the
|
|
# build's parallel jobs, PORT the host port the container is published on.
|
|
set -euo pipefail
|
|
ENGINE=${ENGINE:-docker}
|
|
JOBS=${JOBS:-8}
|
|
PORT=${PORT:-18743}
|
|
here=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
|
|
wai=$(cd "$here/../.." && pwd)
|
|
tag="wai-quantum-service-check:$$"
|
|
name="wai-quantum-service-check-$$"
|
|
volume="wai-quantum-service-check-$$"
|
|
cleanup() {
|
|
"$ENGINE" rm -f "$name" >/dev/null 2>&1 || true
|
|
"$ENGINE" volume rm -f "$volume" >/dev/null 2>&1 || true
|
|
"$ENGINE" image rm -f "$tag" >/dev/null 2>&1 || true
|
|
}
|
|
trap cleanup EXIT
|
|
"$ENGINE" build --build-arg JOBS="$JOBS" -f "$here/Containerfile" -t "$tag" "$wai"
|
|
"$ENGINE" run -d --name "$name" -p "127.0.0.1:$PORT:8241" -v "$volume:/var/lib/wai-quantum-service" \
|
|
--read-only --tmpfs /tmp --cap-drop ALL --security-opt no-new-privileges "$tag" >/dev/null
|
|
for _ in $(seq 1 100); do curl -s -o /dev/null "http://127.0.0.1:$PORT/v1/health" && break; sleep 0.2; done
|
|
bash "$here/../smoke.sh" "http://127.0.0.1:$PORT"
|
|
# The store is the volume's: a restarted container serves what it served.
|
|
id=$(curl -sS -X POST "http://127.0.0.1:$PORT/v1/run" -H 'content-type: application/json' \
|
|
-d '{"qasm": "OPENQASM 3.0; qubit[2] q; h q[0]; cx q[0], q[1];", "shots": 10}' | python3 -I -c 'import json,sys; print(json.load(sys.stdin)["id"])')
|
|
"$ENGINE" restart "$name" >/dev/null
|
|
for _ in $(seq 1 100); do curl -s -o /dev/null "http://127.0.0.1:$PORT/v1/health" && break; sleep 0.2; done
|
|
curl -sS "http://127.0.0.1:$PORT/v1/jobs/$id" | python3 -I -c 'import json,sys; d=json.load(sys.stdin); assert d["status"]=="done" and "receipt" in d["result"], d; print("image: a restarted container serves the job it ran, with its receipt")'
|
|
echo "image: built, ran, and held to the smoke checks"
|