feat: replace Dockerfile builds with reproducible: true - #28
Merged
Conversation
Every example that built its rootfs from a Dockerfile now declares `reproducible: true` and carries its build steps in `install:`. The platform no longer runs `docker build` on the compute host, so the Dockerfile, its baked config files, and the `build:` map are gone from all 21 apps. Each install script is idempotent: it also runs on a plain (non-reproducible) deploy, so nothing depends on the freeze happening. Wrapper entrypoints that used to be written by the Dockerfile are now repo files (start.sh), matching the convention the CONTRACT documents. Three apps (open-webui, firecrawl, hermes-agent) and excalidraw previously sized their image with build.sizeMb above the builder VM's fixed 3 GB disk. Their READMEs say so; sizing the builder is a platform gap tracked separately.
The Dockerfile builds these apps replaced sized the produced ext4 with build.sizeMb; the reproducible builder takes its disk from workspace.resources.diskSizeMb instead. Four apps declared a workspace smaller than the image they need, so restore the old sizes there: excalidraw 4096, firecrawl 12288, hermes-agent 6144, n8n 8192. READMEs and the contract now say the builder inherits that value rather than being pinned to the 3 GB default.
Contributor
Author
|
Second commit resolves the builder-disk gap this PR originally flagged. The platform side now sizes the builder VM from The READMEs and |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The platform is dropping Dockerfile and prebuilt-image build sources: they made the compute host run user-controlled
docker buildas root, clone arbitrary git URLs, and extract uploaded tarballs. Reproducible builds stay, but they now run the app'sinstall:script inside an ephemeral builder VM and freeze the result — no user code on the host.What changed
All 21 Dockerfile-based apps converted:
build: { dockerfile: … }→reproducible: true, with the Dockerfile'sRUNsteps moved intoinstall:. Deleted 21 Dockerfiles plus the config files they baked in (routing scripts, provider JSON, codexconfig.toml). Wrapper entrypoints became repostart.shfiles. READMEs updated per app, plus the root and catalog READMEs.Every
install:is idempotent because it also runs on a plain deploy. Verified: all 29rig.yamlfiles parse, the 21 converted ones havereproducible: trueand a non-emptyinstall:, everyinstall:passesbash -n, and no Dockerfile ordockerfile:key remains.Merge order
Safe to merge before the rig 0.12.63 release: the released CLI (0.12.62) ignores the unknown
reproduciblekey, so these apps still deploy normally with it — they simply do not get the frozen image until users upgrade.Known gap
open-webui(8192),firecrawl(12288),hermes-agent(6144) andexcalidraw(4096) previously setbuild.sizeMbabove the builder VM's fixed 3 GB disk. Their app definitions are correct, but a cold reproducible build of the first two will not fit until the builder's disk is sizable. Each README carries a note; the platform fix is tracked separately.