Container runner on by default: rev-pinned agent-tools release tags, pull verification, preflight pull retry #220

New issue

Closed

opened 2026-07-24 00:05:05 +02:00 by dominik.polakovics · 0 comments

dominik.polakovics commented

2026-07-24 00:05:05 +02:00

Owner

Follow-up to #218 / ADR-0052. Diagnosing the dev-new rollout showed the container runner never activates after a pin bump: services.lab.container.enable defaults to off, and nothing ties an agent-tools image to the lab code revision, so even an opted-in host cannot pin labctl-in-image to the server it talks to.

Scope:

Default-on container provisioning. services.lab.container.enable defaults to true whenever services.lab.enable is set. Explicit enable = false keeps the byte-identical zero-diff unit (guarded by checks).
Rev-pinned agent-tools release tags. The publish leg of .forgejo/workflows/agent-tools.yml runs on every push to main (path filter dropped) and pushes <provider>-<git-sha> tags alongside the existing <provider>-<cli-version> tags, so every lab commit has agent-tools images carrying exactly that commit's labctl.
Module default toolsImages pinned to the code. services.lab.container.toolsImages defaults to git.cloonar.com/cloonar/agent-tools:{claude,codex}-<self.rev> (CLI-version tags as fallback when the flake has no rev, e.g. dirty tree), overridable via a new toolsImageRepo option.
Publish job verifies the image is pullable. After pushing, the job logs out and re-pulls the sha-tagged refs anonymously into a scratch storage root, asserting the digest matches what was pushed — anonymous pull is the deployment contract (the module provisions no registry credentials).
Preflight retries tools-image pulls. The deploy pipeline restarts lab concurrently with the agent-tools publish for the same sha, so the startup pull can race the push. cmd/lab re-runs preflight on an interval while the only time-healing failure (CheckToolsPull) is present, republishing through the existing Gate — container spawns unblock without a restart.
Docs: ops.md option table + agent-tools section, new ADR, and lab --help gains the (already existing but undocumented) --container-image/--container-tools-image flags.

Follow-up to #218 / ADR-0052. Diagnosing the dev-new rollout showed the container runner never activates after a pin bump: `services.lab.container.enable` defaults to off, and nothing ties an agent-tools image to the lab code revision, so even an opted-in host cannot pin labctl-in-image to the server it talks to. Scope: 1. **Default-on container provisioning.** `services.lab.container.enable` defaults to `true` whenever `services.lab.enable` is set. Explicit `enable = false` keeps the byte-identical zero-diff unit (guarded by checks). 2. **Rev-pinned agent-tools release tags.** The publish leg of `.forgejo/workflows/agent-tools.yml` runs on every push to main (path filter dropped) and pushes `<provider>-<git-sha>` tags alongside the existing `<provider>-<cli-version>` tags, so every lab commit has agent-tools images carrying exactly that commit's labctl. 3. **Module default toolsImages pinned to the code.** `services.lab.container.toolsImages` defaults to `git.cloonar.com/cloonar/agent-tools:{claude,codex}-<self.rev>` (CLI-version tags as fallback when the flake has no rev, e.g. dirty tree), overridable via a new `toolsImageRepo` option. 4. **Publish job verifies the image is pullable.** After pushing, the job logs out and re-pulls the sha-tagged refs anonymously into a scratch storage root, asserting the digest matches what was pushed — anonymous pull is the deployment contract (the module provisions no registry credentials). 5. **Preflight retries tools-image pulls.** The deploy pipeline restarts lab concurrently with the agent-tools publish for the same sha, so the startup pull can race the push. cmd/lab re-runs preflight on an interval while the only time-healing failure (CheckToolsPull) is present, republishing through the existing Gate — container spawns unblock without a restart. 6. Docs: ops.md option table + agent-tools section, new ADR, and `lab --help` gains the (already existing but undocumented) --container-image/--container-tools-image flags.

dominik.polakovics referenced this issue from a commit

2026-07-24 00:48:49 +02:00

feat(nix,ci): container-ready by default — enable=true, rev-pinned agent-tools tags, verified pulls (ADR-0054)

dominik.polakovics referenced this issue from a pull request that will close it,

2026-07-24 00:49:05 +02:00

Container-ready by default: container.enable=true, rev-pinned agent-tools release tags, verified pulls #221

dominik.polakovics referenced this issue from a commit

2026-07-24 11:46:09 +02:00

refactor(nix,ci): build agent-tools only on change; pin advances only behind a published image

dominik.polakovics referenced this issue

2026-07-24 12:08:08 +02:00

Container-ready by default: container.enable=true, rev-pinned agent-tools release tags, verified pulls #221