2026-10-03 19:42:32 +00:00
1 changed files with 52 additions and 0 deletions
@@ -0,0 +1,52 @@
 ---
 status: open
 opened: 2026-10-03
 located-in:
  - mesh-controller
  - mesh-catalog
 fixed-by:
 amended-design:
 ---
 # 213 — The controller is a Go program, and it still runs in a container
 ## What was observed
 2026-10-03. The controller — the program that holds the `mesh-controller` seat and answers its
 verbs (`status`, `nodes`, `push`, `assign` …), composes every machine's declaration and plans the
 builds — runs on its machine as a container built from an image:
 ```
 mesh-controller   Up …        (docker ps on the machine that runs it)
 ```
 It is written in Go and compiles to one static binary, as the node host does. The host is delivered
 as a bundle and run as a process; the node's tool runtime now is too
 ([ADR 0193](../../02-DECISIONS/0193-every-bundle-the-runtime-serves-is-launched-and-the-runtime-knows-no-language.md)).
 The controller is the one piece of the mesh's own Go code still shipped as an image.
 ## Why it matters beyond this instance
 [ADR 0188](../../02-DECISIONS/0188-a-modules-own-code-is-bundles-in-any-language-and-a-tools-bundle-speaks-mcp-to-the-runtime.md)
 §1 says a module's own code is bundles, never an image, and §3 that a bundle that is a service is a
 `process` the host runs. The controller breaks the rule it is the mechanism of: the registration
 gate that will refuse an image of a module's own code has to exempt the controller, or refuse it.
 It also costs what an image costs — a container runtime on its machine as a hard requirement,
 eight mounts standing in for files a process would simply read, an image rebuild for a binary
 change — and
 every restart of it is a container recreation, which is how the controller restarts in the middle
 of a plan today.
 ## What a fix has to settle
 - The controller's module declares a Go bundle (`system`, `binary`) and a `process` running it
  (`./<binary>`, mesh-host #81), with its credential and store connection as files and words, not
  container mounts and a container network name.
 - What the container gives it now that a process would not: it runs on the host's network already,
  as an unprivileged user (65534), with eight mounts. Each mount named and replaced by a path, and
  the user by an account the host declares.
 - The handover: the controller restarting itself as a process, on the one machine that runs it,
  without a window where nothing answers the mesh's verbs.
 Located only by owner; the move is a change of the controller's module and its deployment, not of
 its code.