feat(worker): define unified agent image artifact
This commit is contained in:
DCCONSTRUCTIONS
@@ -0,0 +1,57 @@
|
||||
FROM nvcr.io/nvidia/tritonserver:26.06-py3@sha256:58df7489c3f2276f9591d500a012dee03e23d35543ce3c390b4c001e6bf90794
|
||||
|
||||
ARG NODEDC_SOURCE_REVISION
|
||||
ARG NODEDC_BUILD_CONTEXT_SHA256
|
||||
ARG SOURCE_DATE_EPOCH
|
||||
|
||||
ENV PYTHONPATH=/opt/nodedc/mission-core/src \
|
||||
PYTHONNOUSERSITE=1 \
|
||||
PYTHONDONTWRITEBYTECODE=1 \
|
||||
PYTHONUNBUFFERED=1
|
||||
|
||||
WORKDIR /opt/nodedc/mission-core
|
||||
|
||||
COPY src/k1link ./src/k1link
|
||||
COPY config ./config
|
||||
COPY experiments/perception/worker/observatory_portable/worker-006-agent-build-context.json \
|
||||
./release/worker-006-agent-build-context.json
|
||||
|
||||
RUN case "${NODEDC_SOURCE_REVISION}" in \
|
||||
*[!0-9a-f]* ) exit 64 ;; \
|
||||
* ) ;; \
|
||||
esac \
|
||||
&& test "${#NODEDC_SOURCE_REVISION}" -eq 40 \
|
||||
&& case "${NODEDC_BUILD_CONTEXT_SHA256}" in \
|
||||
*[!0-9a-f]* ) exit 64 ;; \
|
||||
* ) ;; \
|
||||
esac \
|
||||
&& test "${#NODEDC_BUILD_CONTEXT_SHA256}" -eq 64 \
|
||||
&& case "${SOURCE_DATE_EPOCH}" in \
|
||||
''|*[!0-9]* ) exit 64 ;; \
|
||||
* ) ;; \
|
||||
esac \
|
||||
&& test "${SOURCE_DATE_EPOCH}" -gt 0 \
|
||||
&& find /opt/nodedc/mission-core -type d -exec chmod 0555 {} + \
|
||||
&& find /opt/nodedc/mission-core -type f -exec chmod 0444 {} + \
|
||||
&& python3 -c "import k1link.observatory.m49_worker_container_main as entrypoint; import k1link.observatory.m49_worker_service as composition; assert callable(entrypoint.main); assert callable(composition.compose_installed_m49_worker_service)"
|
||||
|
||||
LABEL org.opencontainers.image.title="NODE.DC Observatory Worker 006 agent" \
|
||||
org.opencontainers.image.source="NODEDC_MISSION_CORE" \
|
||||
org.opencontainers.image.revision="${NODEDC_SOURCE_REVISION}" \
|
||||
com.nodedc.product="mission-core" \
|
||||
com.nodedc.stack="ndc-mission-core-observatory" \
|
||||
com.nodedc.role="observatory-worker-agent" \
|
||||
com.nodedc.managed-by="mission-core-worker-release" \
|
||||
com.nodedc.worker-contour="worker-006" \
|
||||
com.nodedc.authority="observation-only" \
|
||||
com.nodedc.models="external" \
|
||||
com.nodedc.base-image.sha256="58df7489c3f2276f9591d500a012dee03e23d35543ce3c390b4c001e6bf90794" \
|
||||
com.nodedc.build-context.sha256="${NODEDC_BUILD_CONTEXT_SHA256}"
|
||||
|
||||
# The current private token and sealed release mounts are provisioned for root.
|
||||
# Runtime confinement is mandatory in the install plan: read-only rootfs,
|
||||
# cap-drop ALL, no-new-privileges, bounded resources and no device requests.
|
||||
USER 0:0
|
||||
|
||||
ENTRYPOINT ["python3", "-m", "k1link.observatory.m49_worker_container_main"]
|
||||
CMD []
|
||||
+76
@@ -0,0 +1,76 @@
|
||||
{
|
||||
"schema_version": "missioncore.observatory-worker-agent-build-context/v1",
|
||||
"artifact_id": "observatory-worker-006-agent",
|
||||
"worker_id": "worker-006",
|
||||
"source_contract": {
|
||||
"required_state": "clean-committed-snapshot",
|
||||
"revision_format": "full-git-sha1",
|
||||
"materialization": "git-archive",
|
||||
"timestamp_source": "selected-commit-committer-epoch",
|
||||
"uncommitted_files_allowed": false
|
||||
},
|
||||
"base_image": {
|
||||
"reference": "nvcr.io/nvidia/tritonserver:26.06-py3@sha256:58df7489c3f2276f9591d500a012dee03e23d35543ce3c390b4c001e6bf90794",
|
||||
"sha256": "58df7489c3f2276f9591d500a012dee03e23d35543ce3c390b4c001e6bf90794",
|
||||
"pull_allowed": false
|
||||
},
|
||||
"dockerfile": "experiments/perception/worker/observatory_portable/Dockerfile.worker-006-agent",
|
||||
"context_digest": {
|
||||
"algorithm": "sha256",
|
||||
"subject": "git-archive-tar-bytes",
|
||||
"archive_format": "tar",
|
||||
"path_order": "git-archive-native-order"
|
||||
},
|
||||
"context_entries": [
|
||||
{
|
||||
"path": "src/k1link",
|
||||
"kind": "tree",
|
||||
"image_path": "/opt/nodedc/mission-core/src/k1link"
|
||||
},
|
||||
{
|
||||
"path": "config",
|
||||
"kind": "tree",
|
||||
"image_path": "/opt/nodedc/mission-core/config"
|
||||
},
|
||||
{
|
||||
"path": "experiments/perception/worker/observatory_portable/Dockerfile.worker-006-agent",
|
||||
"kind": "file",
|
||||
"image_path": null
|
||||
},
|
||||
{
|
||||
"path": "experiments/perception/worker/observatory_portable/worker-006-agent-build-context.json",
|
||||
"kind": "file",
|
||||
"image_path": "/opt/nodedc/mission-core/release/worker-006-agent-build-context.json"
|
||||
}
|
||||
],
|
||||
"required_configuration": [
|
||||
"config/observatory-portable-run-definitions.json",
|
||||
"config/observatory-worker-runtime-candidates.json",
|
||||
"config/perception/m49-tgs-portable-v2.json",
|
||||
"config/perception/lab-v1-eomt-ddrnet-portable-v2.json"
|
||||
],
|
||||
"runtime": {
|
||||
"pythonpath": "/opt/nodedc/mission-core/src",
|
||||
"entrypoint": [
|
||||
"python3",
|
||||
"-m",
|
||||
"k1link.observatory.m49_worker_container_main"
|
||||
],
|
||||
"composition_module": "k1link.observatory.m49_worker_service",
|
||||
"models_baked_into_image": false,
|
||||
"executor_releases_baked_into_image": false
|
||||
},
|
||||
"forbidden_context": [
|
||||
"model weights",
|
||||
"recorded K1 sessions",
|
||||
"worker bearer credentials",
|
||||
"executor release payloads",
|
||||
"runtime work directories"
|
||||
],
|
||||
"authority": {
|
||||
"commands_enabled": false,
|
||||
"actuation_allowed": false,
|
||||
"navigation_or_safety_accepted": false,
|
||||
"production_accepted": false
|
||||
}
|
||||
}
|
||||
+227
@@ -0,0 +1,227 @@
|
||||
{
|
||||
"schema_version": "missioncore.observatory-worker-agent-install-plan/v1",
|
||||
"state": "planned-not-built",
|
||||
"artifact_id": "observatory-worker-006-agent",
|
||||
"worker_id": "worker-006",
|
||||
"build": {
|
||||
"source_revision": null,
|
||||
"source_revision_requirement": "full clean committed Git revision",
|
||||
"source_date_epoch": null,
|
||||
"build_context_sha256": null,
|
||||
"context_manifest": "experiments/perception/worker/observatory_portable/worker-006-agent-build-context.json",
|
||||
"dockerfile": "experiments/perception/worker/observatory_portable/Dockerfile.worker-006-agent",
|
||||
"materialization": {
|
||||
"method": "git archive",
|
||||
"include_only_context_manifest_entries": true,
|
||||
"reject_dirty_worktree": true,
|
||||
"archive_format": "tar",
|
||||
"archive_paths_source": "context manifest context_entries in declared order",
|
||||
"build_context_sha256_subject": "exact git-archive tar bytes"
|
||||
},
|
||||
"base_image": {
|
||||
"reference": "nvcr.io/nvidia/tritonserver:26.06-py3@sha256:58df7489c3f2276f9591d500a012dee03e23d35543ce3c390b4c001e6bf90794",
|
||||
"sha256": "58df7489c3f2276f9591d500a012dee03e23d35543ce3c390b4c001e6bf90794",
|
||||
"must_exist_locally": true,
|
||||
"pull_allowed": false
|
||||
},
|
||||
"docker_build": {
|
||||
"network": "none",
|
||||
"pull": false,
|
||||
"no_cache": true,
|
||||
"provenance": false,
|
||||
"platform": "linux/amd64",
|
||||
"context_input": "exact git-archive tar bytes",
|
||||
"required_build_args": [
|
||||
"NODEDC_SOURCE_REVISION",
|
||||
"NODEDC_BUILD_CONTEXT_SHA256",
|
||||
"SOURCE_DATE_EPOCH"
|
||||
]
|
||||
},
|
||||
"required_preflight": [
|
||||
"Git worktree and index are clean",
|
||||
"selected revision resolves to exactly one commit",
|
||||
"selected revision equals HEAD",
|
||||
"base image inspect ID equals the pinned SHA-256",
|
||||
"context archive contains exactly the context manifest entries"
|
||||
],
|
||||
"image_tag_template": "ndc/mission-core-observatory-worker-agent:<source-revision-12>"
|
||||
},
|
||||
"build_acceptance": {
|
||||
"required_labels": {
|
||||
"org.opencontainers.image.revision": "<source-revision>",
|
||||
"com.nodedc.product": "mission-core",
|
||||
"com.nodedc.stack": "ndc-mission-core-observatory",
|
||||
"com.nodedc.role": "observatory-worker-agent",
|
||||
"com.nodedc.worker-contour": "worker-006",
|
||||
"com.nodedc.authority": "observation-only",
|
||||
"com.nodedc.models": "external",
|
||||
"com.nodedc.base-image.sha256": "58df7489c3f2276f9591d500a012dee03e23d35543ce3c390b4c001e6bf90794",
|
||||
"com.nodedc.build-context.sha256": "<build-context-sha256>"
|
||||
},
|
||||
"smoke": {
|
||||
"network": "none",
|
||||
"read_only_rootfs": true,
|
||||
"platform": "linux/amd64",
|
||||
"entrypoint": [
|
||||
"python3",
|
||||
"-c",
|
||||
"import k1link.observatory.m49_worker_container_main as e; import k1link.observatory.m49_worker_service as c; assert callable(e.main); assert callable(c.compose_installed_m49_worker_service)"
|
||||
],
|
||||
"expected_result": "exit-0"
|
||||
}
|
||||
},
|
||||
"runtime": {
|
||||
"container_name": "ndc-observatory-worker-006-agent",
|
||||
"fixed_environment": {
|
||||
"MISSIONCORE_OBSERVATORY_WORKER_BASE_URL": "http://127.0.0.1:18080",
|
||||
"MISSIONCORE_OBSERVATORY_WORKER_TOKEN_FILE": "/run/secrets/observatory-worker.token",
|
||||
"MISSIONCORE_OBSERVATORY_WORKER_WORK_ROOT": "/work",
|
||||
"MISSIONCORE_OBSERVATORY_WORKER_DEFINITIONS_FILE": "/opt/nodedc/mission-core/config/observatory-portable-run-definitions.json",
|
||||
"MISSIONCORE_OBSERVATORY_WORKER_RUNTIME_REGISTRY_FILE": "/opt/nodedc/mission-core/config/observatory-worker-runtime-candidates.json",
|
||||
"MISSIONCORE_OBSERVATORY_M49_INSTALLATION_RECEIPT_FILE": "/release/worker-installation-receipt.json"
|
||||
},
|
||||
"user": {
|
||||
"uid": 0,
|
||||
"gid": 0,
|
||||
"reason": "existing private token and sealed executor-release mounts are root-readable; changing their ownership is a separate reviewed runtime transition"
|
||||
},
|
||||
"hardening": {
|
||||
"read_only_rootfs": true,
|
||||
"cap_drop": [
|
||||
"ALL"
|
||||
],
|
||||
"no_new_privileges": true,
|
||||
"init": true,
|
||||
"pids_limit": 256,
|
||||
"cpus": 12,
|
||||
"memory_bytes": 17179869184,
|
||||
"tmpfs": [
|
||||
"/tmp:rw,nosuid,nodev,noexec,size=256m"
|
||||
],
|
||||
"published_ports": [],
|
||||
"device_requests": []
|
||||
},
|
||||
"docker_engine_control": {
|
||||
"transport": "Docker Engine HTTP API over Unix domain socket; Docker CLI is not used",
|
||||
"authority": "host-equivalent Docker Engine control",
|
||||
"risk": "a compromised Worker agent can control the Docker host; agent namespace and rootfs hardening do not reduce authority granted by this socket",
|
||||
"socket_mount": {
|
||||
"type": "bind",
|
||||
"host_path": "/var/run/docker.sock",
|
||||
"container_path": "/var/run/docker.sock",
|
||||
"mode": "read-write",
|
||||
"exception_to_read_only_mount_policy": true
|
||||
},
|
||||
"allowed_operations": [
|
||||
"inspect exact installed image identity",
|
||||
"create one sealed LAB V1 sibling",
|
||||
"start exact created container ID",
|
||||
"wait exact created container ID",
|
||||
"read bounded tail logs for failed exact created container ID",
|
||||
"force-delete exact created container ID"
|
||||
],
|
||||
"sibling_runtime_fences": {
|
||||
"exact_image_sha256s": {
|
||||
"eomt": "58df7489c3f2276f9591d500a012dee03e23d35543ce3c390b4c001e6bf90794",
|
||||
"ddrnet": "591cb382c099eeb05e7ec16e2371e0b2da54d2bb5c49ec0f4ac88dbf72b0f0cd"
|
||||
},
|
||||
"commands_and_entrypoints": "exact values sealed in the LAB V1 runner installation receipt; never supplied by a queued job",
|
||||
"bind_sources": "only exact Worker-host asset roots sealed in the LAB V1 runner installation receipt and descendants of its exact work-root binding",
|
||||
"bind_targets": "fixed /opt/nodedc/assets and /run/nodedc targets; exactly one writable target at /run/nodedc/output",
|
||||
"network": "none",
|
||||
"read_only_rootfs": true,
|
||||
"cap_drop": [
|
||||
"ALL"
|
||||
],
|
||||
"no_new_privileges": true,
|
||||
"privileged": false,
|
||||
"init": true,
|
||||
"pids_limit": 512,
|
||||
"memory_swap_equals_memory": true,
|
||||
"memory_bytes": "exact sealed component value; admitted range 1073741824..137438953472",
|
||||
"nano_cpus": "exact sealed component value; admitted range 100000000..64000000000",
|
||||
"timeout_seconds": "exact sealed component value; admitted range 1..86400",
|
||||
"gpu_request": {
|
||||
"driver": "nvidia",
|
||||
"count": 1,
|
||||
"capabilities": [
|
||||
[
|
||||
"gpu"
|
||||
]
|
||||
]
|
||||
},
|
||||
"required_unique_labels": [
|
||||
"com.nodedc.authority=observation-only",
|
||||
"com.nodedc.component=<eomt-or-ddrnet>",
|
||||
"com.nodedc.definition-sha256=<installed-definition-sha256>",
|
||||
"com.nodedc.managed-by=mission-core-worker",
|
||||
"com.nodedc.request-sha256=<sealed-request-sha256>",
|
||||
"com.nodedc.product=mission-core",
|
||||
"com.nodedc.release-candidate-sha256=<installed-release-candidate-sha256>",
|
||||
"com.nodedc.stack=observatory"
|
||||
],
|
||||
"name_template": "ndc-observatory-lab-v1-<component>-<cryptographic-token>",
|
||||
"cleanup": "always force-delete only the exact 64-hex container ID returned by the successful create response"
|
||||
}
|
||||
},
|
||||
"mounts": [
|
||||
{
|
||||
"container_path": "/release",
|
||||
"mode": "read-only",
|
||||
"purpose": "sealed external executor release"
|
||||
},
|
||||
{
|
||||
"container_path": "/work",
|
||||
"mode": "read-write",
|
||||
"purpose": "bounded job workspace"
|
||||
},
|
||||
{
|
||||
"container_path": "/run/secrets",
|
||||
"mode": "read-only",
|
||||
"purpose": "private bearer token file"
|
||||
}
|
||||
],
|
||||
"external_assets": {
|
||||
"model_images": "pre-existing exact local Docker images selected only by installed executor adapters",
|
||||
"model_weights": "pre-existing exact local read-only assets selected only by installed executor adapters",
|
||||
"baked_into_agent_image": false,
|
||||
"queued_jobs_may_select_paths_or_commands": false
|
||||
},
|
||||
"lab_v1_runner_installation_input": {
|
||||
"state": "loader-contract-not-yet-defined",
|
||||
"environment_variable": null,
|
||||
"container_path": null,
|
||||
"reason": "the current local runner module defines an in-memory sealed installation receipt but no environment loader or installed receipt path"
|
||||
},
|
||||
"protected_contours": [
|
||||
"K1 connection and control",
|
||||
"Simulation and Gaussian",
|
||||
"legacy LAB and Rerun profiles"
|
||||
]
|
||||
},
|
||||
"receipt_skeleton": {
|
||||
"schema_version": "missioncore.observatory-worker-agent-image-receipt/v1",
|
||||
"receipt_state": "not-built",
|
||||
"worker_id": "worker-006",
|
||||
"source_revision": null,
|
||||
"source_date_epoch": null,
|
||||
"build_context_sha256": null,
|
||||
"base_image_sha256": "58df7489c3f2276f9591d500a012dee03e23d35543ce3c390b4c001e6bf90794",
|
||||
"image": {
|
||||
"tag": null,
|
||||
"id": null,
|
||||
"size_bytes": null
|
||||
},
|
||||
"smoke": {
|
||||
"network": "none",
|
||||
"result": "not-run"
|
||||
},
|
||||
"models_baked_into_image": false,
|
||||
"authority": {
|
||||
"commands_enabled": false,
|
||||
"actuation_allowed": false,
|
||||
"navigation_or_safety_accepted": false,
|
||||
"production_accepted": false
|
||||
}
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user