Add the image build module: buildah and mesh-build-image, rootless, publishing only from the trunk (issues 1702, 1703, 1704, 1707) #435

Merged

mesh-tools merged 8 commits from feat/r4c9-image-build into main 2026-10-22 08:57:10 +00:00

Conversation 1 Commits 8 Files Changed 55

+3599 -14

mesh-tools commented 2026-10-22 08:47:07 +00:00

Member

Copy Link

Copy Source

Part of design 47's milestone R4c-9 (ADR 0487): the image build module. A container image becomes one more artifact kind the builder builds through a build module, like Go and Node: mesh-build-image builds rootless with buildah, a candidate's check publishes nothing, a trunk build publishes exactly one digest and its build key names the reference. build-agent keeps building and delivering every image until R4g; nothing the operator sees changes. One delivery group on branch feat/r4c9-image-build in mesh-catalog and mesh-delivery. After the delivery the lead assigns buildah and mesh-build-image to shanks and ace.

Said with the Approve: an image build on a build node has no CPU or memory limit yet, like the other build modules (issue 1806); the builder's capacity bounds how many run. Until the operator answers whether R4g waits only for images that outlive it, mesh-build-image refuses an image whose build input is a whole repository or whose build argument is another module's artifact, naming why (only build-agent's and the toolchain images use those forms, and R4g deletes them).

Review: one review, three rounds, approved (reviewer-r4c9@shanks). The real-buildah integration tests skip loudly where the check has no buildah; ADR 0487 §2 and §6 are proved live after the delivery.

This member: the buildah module (1702) providing rootless-image-build with reach machine; mesh-build-image (1703): account, store outside the home, fetch and build steps, push only with publish and the digest read back from the registry (a mismatch or an unreadable digest file fails), a bus integration test and captured result fixtures; the refusal naming buildah when it is missing (1704) and the checks imagebuild and imageplace (1707); gitea reads mesh-build-image.keys.

Reviewed-by: reviewer-r4c9@shanks at 7b5f7f84ac

Part of design 47's milestone R4c-9 (ADR 0487): the image build module. A container image becomes one more artifact kind the builder builds through a build module, like Go and Node: mesh-build-image builds rootless with buildah, a candidate's check publishes nothing, a trunk build publishes exactly one digest and its build key names the reference. build-agent keeps building and delivering every image until R4g; nothing the operator sees changes. One delivery group on branch `feat/r4c9-image-build` in mesh-catalog and mesh-delivery. After the delivery the lead assigns buildah and mesh-build-image to shanks and ace. Said with the Approve: an image build on a build node has no CPU or memory limit yet, like the other build modules (issue 1806); the builder's capacity bounds how many run. Until the operator answers whether R4g waits only for images that outlive it, mesh-build-image refuses an image whose build input is a whole repository or whose build argument is another module's artifact, naming why (only build-agent's and the toolchain images use those forms, and R4g deletes them). Review: one review, three rounds, approved (reviewer-r4c9@shanks). The real-buildah integration tests skip loudly where the check has no buildah; ADR 0487 §2 and §6 are proved live after the delivery. This member: the buildah module (1702) providing rootless-image-build with reach machine; mesh-build-image (1703): account, store outside the home, fetch and build steps, push only with publish and the digest read back from the registry (a mismatch or an unreadable digest file fails), a bus integration test and captured result fixtures; the refusal naming buildah when it is missing (1704) and the checks imagebuild and imageplace (1707); gitea reads mesh-build-image.keys. Reviewed-by: reviewer-r4c9@shanks at 7b5f7f84acb73aaf8189200548ff69fd9aac04b2

mesh-tools added 6 commits 2026-10-22 08:47:07 +00:00

Add the buildah module and the check that only it provides rootless-image-build (issues 1702, 1704) 8815f950b0

Check that every image builds from a Dockerfile in its own module's directory (issue 1707) f5153a490c

Let gitea read the image build module's keys, so its key is the builders' (issue 1703f) ce8d52ed0b

Add mesh-build-image: rootless image builds with buildah, pushed by tag from trunk only (issue 1703) 692fc3e1ab

Fail a push whose digest file cannot be read; test the image steps through a real bus against captured shapes (issue 1703) 3dcaa7a996

Skip the real fetch test where buildah is not installed: every step is guarded by it 7c5d11e55d

mesh-tools commented 2026-10-22 08:47:27 +00:00

Author

Member

Copy Link

Copy Source

Delivery novox/mesh-catalog@7b5f7f84acb7 — delivered since 2026-10-22T09:02:24Z

Delivery plan — builds gitea, mesh-issues, new: modules/buildah, modules/mesh-build-image → novox; no bus step

• tier 0: gitea, mesh-issues
• novox: receives gitea, mesh-issues
• gitea provides npm-package-registry, git, gitea-read, forge-account: its consumers are sent again after it
• gitea keeps data (ADR 0233): what it holds is backed up before it moves

Group feat/r4c9-image-build: novox/mesh-catalog@7b5f7f84ac, novox/mesh-delivery@db62e82e26

• composed together: pass — every machine composes with the change as it did without (4 of 4 compose)

Machines

• gitea on every machine running it: sent
• mesh-delivery-builder on every machine running it: sent
• mesh-issues on every machine running it: sent

Transitions

• 2026-10-22 08:51 (new) → proposed (announced): novox/mesh-catalog#435's head announced
• 2026-10-22 08:52 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit
• 2026-10-22 08:52 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
• 2026-10-22 08:59 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move
• 2026-10-22 08:59 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path — not a failed walk that carried a later commit for it, after which it waits for a walk of its own commit
• 2026-10-22 09:02 delivering → delivered (done): its walk is done, carrying its own commit: every machine of its deploy plan passed, or was left as its policy says

The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.

<!-- mesh-delivery:view --> **Delivery** `novox/mesh-catalog@7b5f7f84acb7` — **delivered** since 2026-10-22T09:02:24Z **Delivery plan** — builds gitea, mesh-issues, new: modules/buildah, modules/mesh-build-image → novox; no bus step - tier 0: gitea, mesh-issues - novox: receives gitea, mesh-issues - gitea provides npm-package-registry, git, gitea-read, forge-account: its consumers are sent again after it - gitea keeps data (ADR 0233): what it holds is backed up before it moves **Group** `feat/r4c9-image-build`: novox/mesh-catalog@7b5f7f84acb7, novox/mesh-delivery@db62e82e26d7 - composed together: pass — every machine composes with the change as it did without (4 of 4 compose) **Machines** - gitea on every machine running it: sent - mesh-delivery-builder on every machine running it: sent - mesh-issues on every machine running it: sent **Transitions** - 2026-10-22 08:51 (new) → proposed (announced): novox/mesh-catalog#435's head announced - 2026-10-22 08:52 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit - 2026-10-22 08:52 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail - 2026-10-22 08:59 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move - 2026-10-22 08:59 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path — not a failed walk that carried a later commit for it, after which it waits for a walk of its own commit - 2026-10-22 09:02 delivering → delivered (done): its walk is done, carrying its own commit: every machine of its deploy plan passed, or was left as its policy says The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.

jschoubben added 2 commits 2026-10-22 08:51:43 +00:00

Merge origin/main into feat/r4c9-image-build 3508be1476

List mesh-build-image among the issue tracker's owners 7b5f7f84ac

mesh-tools merged commit 5a6d082e8c into main 2026-10-22 08:57:10 +00:00

mesh-tools deleted branch feat/r4c9-image-build 2026-10-22 08:57:10 +00:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

mesh/ready

Reviewed and ready: mesh-delivery merges at the marked head once its checks pass (hq ADR 0364)

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

agent-ace agent-g14 agent-novox agent-shanks jschoubben mesh-tools miel.truyen nox-agent

No Assignees

2 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-catalog#435