builder is a real built module now, not handed over #63

2026-09-25T15:54:53Z

jschoubben commented

2026-09-25 15:54:53 +00:00

Its own image (mesh-builder@sha256:0000...0000, later manually pinned to a real digest tonight when the placeholder blocked a push) was never produced by anything the mesh tracks — cmd/mesh-builder lives in mesh-controller's own repository, and nothing declared how to build an image from it.

Uses the same context mechanism route-proxy does (mesh-controller#62): the Dockerfile compiles ./cmd/mesh-builder from a clone of mesh-controller's repository, not a vendored copy.

Unlike mesh-controller's own FROM scratch (ADR 0006 — nothing to audit but one binary), the build machine's whole job is shelling out to git and docker, so its runtime is Alpine with both installed from the base's own packages, not fetched on their own.

Bootstrapped live tonight: a manual build got the new image running long enough to build itself properly through the pipeline it had just gained, and mesh-controller itself needed the same upgrade first (it parses manifests too, and rejected the new context field with the old binary) — genesis's own kind of ordering problem, solved by hand exactly once. Already built through the real pipeline and verified live (artifact: server resolves correctly, no hardcoded image reference).

Its own image (`mesh-builder@sha256:0000...0000`, later manually pinned to a real digest tonight when the placeholder blocked a push) was never produced by anything the mesh tracks — `cmd/mesh-builder` lives in mesh-controller's own repository, and nothing declared how to build an image from it. Uses the same context mechanism route-proxy does (mesh-controller#62): the Dockerfile compiles `./cmd/mesh-builder` from a clone of mesh-controller's repository, not a vendored copy. Unlike mesh-controller's own `FROM scratch` (ADR 0006 — nothing to audit but one binary), the build machine's whole job is shelling out to `git` and `docker`, so its runtime is Alpine with both installed from the base's own packages, not fetched on their own. Bootstrapped live tonight: a manual build got the new image running long enough to build itself properly through the pipeline it had just gained, and mesh-controller itself needed the same upgrade first (it parses manifests too, and rejected the new `context` field with the old binary) — genesis's own kind of ordering problem, solved by hand exactly once. Already built through the real pipeline and verified live (`artifact: server` resolves correctly, no hardcoded image reference).

jschoubben added 1 commit 2026-09-25 15:54:53 +00:00

builder is a real built module now, not handed over 8369fe22b8

Its own image ('mesh-builder@sha256:0000...0000', later manually pinned to
a real digest tonight when the placeholder blocked a push) was never
produced by anything the mesh tracks — cmd/mesh-builder lives in
mesh-controller's own repository, and nothing declared how to build an
image from it. Uses the same context mechanism route-proxy does (mesh-
controller#62): the Dockerfile compiles ./cmd/mesh-builder from a clone of
mesh-controller's repository, not a vendored copy.

Unlike mesh-controller's own FROM scratch (ADR 0006 — nothing to audit
but one binary), the build machine's whole job is shelling out to git and
docker, so its runtime is Alpine with both installed from the base's own
packages, not fetched on their own.

Bootstrapped live tonight: a manual build got the new image running long
enough to build itself properly through the pipeline it had just gained,
and mesh-controller itself needed the same upgrade first (it parses
manifests too, and rejected the new context field with the old binary) —
genesis's own kind of ordering problem, solved by hand exactly once.

jschoubben merged commit 72b1413497 into main

2026-09-25 15:54:58 +00:00

jschoubben deleted branch feat/builder-is-a-real-built-module

2026-09-25 15:54:58 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-catalog#63