jschoubben
c9b98477b7
The program serves the store's port 5000 in front of the registry container, now on the node's loopback (127.0.0.1:5001), listed before the program so the port is free when it starts (E14). The tools bundle serves each seat's verbs as <seat>.<verb> and registry_incoming, registry_holds, registry_old_name and registry_direct_writes, on distribution's own account, with the caller the tool runner proved. The manifest claims container-image-registry and oci-artifact-registry with their verbs, keeps mesh-artifact-store and provides artifact-store until the old name closes (E15), asks its bus state in requires (incoming, transfers, holds, windows, findings, events) and declares its health outside the program. The bootstrap's one-off credential is discarded at the first publish answered. Not yet: the runtime's object store helper for incoming (mesh-sdk), the windows' driver on delivered and manifest-reads-changed, the read-side health probe calling versions per seat. Claude-Session: https://claude.ai/code/session_01JG73KJNrH5EgFXMKKYSrig
245 lines
5.2 KiB
JSON
245 lines
5.2 KiB
JSON
{
|
|
"module": "distribution",
|
|
"version": "2",
|
|
"provides": [
|
|
{
|
|
"name": "artifact-store",
|
|
"scope": "mesh",
|
|
"credential": {
|
|
"form": "none"
|
|
}
|
|
}
|
|
],
|
|
"claims": [
|
|
{
|
|
"name": "container-image-registry",
|
|
"scope": "mesh",
|
|
"serves": [
|
|
"hold",
|
|
"mirror",
|
|
"publish",
|
|
"publish-part",
|
|
"release",
|
|
"remove",
|
|
"tags",
|
|
"versions"
|
|
]
|
|
},
|
|
{
|
|
"name": "oci-artifact-registry",
|
|
"scope": "mesh",
|
|
"serves": [
|
|
"hold",
|
|
"publish",
|
|
"publish-part",
|
|
"release",
|
|
"remove",
|
|
"versions"
|
|
]
|
|
},
|
|
{
|
|
"name": "mesh-artifact-store",
|
|
"scope": "mesh"
|
|
}
|
|
],
|
|
"tools": [
|
|
"registry_direct_writes",
|
|
"registry_holds",
|
|
"registry_incoming",
|
|
"registry_old_name"
|
|
],
|
|
"invokes": [
|
|
"mesh-delivery-builder.builder_versions",
|
|
"mesh-delivery-view.node_haves",
|
|
"seat:node-engine.manifest-reads"
|
|
],
|
|
"consumes": [
|
|
"mesh-delivery-view.delivered"
|
|
],
|
|
"emits": [
|
|
"old-name-closed",
|
|
"direct-writes-closed"
|
|
],
|
|
"config": {
|
|
"callers": {
|
|
"type": "string",
|
|
"trusted": true,
|
|
"description": "per verb, the modules that may call it (JSON object of verb to modules; operator for the operator's session); empty is design 51's list"
|
|
}
|
|
},
|
|
"requires": [
|
|
{
|
|
"name": "incoming",
|
|
"storage": "object-store",
|
|
"template": "objects",
|
|
"options": {
|
|
"max-mib": 8192
|
|
}
|
|
},
|
|
{
|
|
"name": "transfers",
|
|
"storage": "key-value",
|
|
"template": "state",
|
|
"options": {
|
|
"ttl-seconds": 86400
|
|
}
|
|
},
|
|
{
|
|
"name": "holds",
|
|
"storage": "key-value",
|
|
"template": "state"
|
|
},
|
|
{
|
|
"name": "windows",
|
|
"storage": "key-value",
|
|
"template": "state"
|
|
},
|
|
{
|
|
"name": "findings",
|
|
"storage": "key-value",
|
|
"template": "state"
|
|
},
|
|
{
|
|
"name": "events",
|
|
"storage": "stream",
|
|
"template": "events",
|
|
"options": {
|
|
"max-age-days": 7,
|
|
"max-mib": 16
|
|
}
|
|
}
|
|
],
|
|
"capabilities": [
|
|
"container-runtime"
|
|
],
|
|
"own-secrets": {
|
|
"broker": "/var/lib/mesh/registry/broker"
|
|
},
|
|
"secrets-owner": "distribution",
|
|
"serves": {
|
|
"artifact-store": {
|
|
"port": 5000
|
|
}
|
|
},
|
|
"listens": [
|
|
{
|
|
"name": "registry",
|
|
"port": 5000,
|
|
"protocol": "tcp",
|
|
"from": "mesh",
|
|
"why": "every machine pulls images and artifacts from here; distribution's program serves it in front of the store"
|
|
}
|
|
],
|
|
"data": {
|
|
"own": [
|
|
{
|
|
"id": "registry",
|
|
"path": "${dir:registry-data}",
|
|
"class": "rebuildable",
|
|
"backup": "none",
|
|
"measure": "shallow",
|
|
"why": "the artifact store: every image is built again from its source, and too large to copy every night (ADR 0214 left it out)"
|
|
}
|
|
]
|
|
},
|
|
"resources": [
|
|
{
|
|
"id": "account",
|
|
"type": "user",
|
|
"name": "distribution",
|
|
"shell": "/usr/bin/nologin",
|
|
"home": "/var/lib/mesh/registry"
|
|
},
|
|
{
|
|
"id": "state",
|
|
"type": "directory",
|
|
"path": "/var/lib/mesh/registry",
|
|
"mode": "0700",
|
|
"unknown": "program",
|
|
"owner": "distribution"
|
|
},
|
|
{
|
|
"id": "registry-data",
|
|
"type": "directory",
|
|
"path": "/var/lib/mesh-registry",
|
|
"mode": "0700",
|
|
"unknown": "program",
|
|
"owner": "distribution"
|
|
},
|
|
{
|
|
"id": "store",
|
|
"type": "container",
|
|
"name": "mesh-registry",
|
|
"image": "registry@sha256:a3d8aaa63ed8681a604f1dea0aa03f100d5895b6a58ace528858a7b332415373",
|
|
"ports": [
|
|
"127.0.0.1:5001:5000"
|
|
],
|
|
"volumes": [
|
|
"/var/lib/mesh-registry:/var/lib/registry"
|
|
],
|
|
"env": {
|
|
"REGISTRY_STORAGE_DELETE_ENABLED": "true"
|
|
}
|
|
},
|
|
{
|
|
"id": "program",
|
|
"type": "process",
|
|
"name": "distribution",
|
|
"artifact": "program",
|
|
"run": [
|
|
"./distribution"
|
|
],
|
|
"env": {
|
|
"MESH_BROKER_FILE": "/var/lib/mesh/registry/broker",
|
|
"MESH_REGISTRY_LOOPBACK": "http://127.0.0.1:5001",
|
|
"MESH_REGISTRY_LISTEN": ":5000"
|
|
},
|
|
"user": "distribution",
|
|
"health": {
|
|
"kind": "http",
|
|
"url": "http://127.0.0.1:5000/v2/"
|
|
}
|
|
},
|
|
{
|
|
"id": "collect",
|
|
"type": "container",
|
|
"name": "mesh-registry-collect",
|
|
"image": "registry@sha256:a3d8aaa63ed8681a604f1dea0aa03f100d5895b6a58ace528858a7b332415373",
|
|
"volumes": [
|
|
"/var/lib/mesh-registry:/var/lib/registry"
|
|
],
|
|
"args": [
|
|
"garbage-collect",
|
|
"/etc/docker/registry/config.yml"
|
|
],
|
|
"schedule": "30 3 * * *",
|
|
"while-stopped": [
|
|
"store"
|
|
]
|
|
}
|
|
],
|
|
"build": {
|
|
"artifacts": [
|
|
{
|
|
"name": "program",
|
|
"kind": "bundle",
|
|
"language": "go",
|
|
"system": "arch",
|
|
"from": "cmd/distribution",
|
|
"binary": "distribution"
|
|
},
|
|
{
|
|
"name": "tools",
|
|
"kind": "bundle",
|
|
"language": "go",
|
|
"system": "arch",
|
|
"from": "cmd/distribution-tools",
|
|
"binary": "distribution-tools",
|
|
"loads": [
|
|
"distribution-tools"
|
|
]
|
|
}
|
|
]
|
|
}
|
|
}
|