jschoubben
ee3cc1b6f4
novox/hq 04-ISSUES/025. Every image reference in every example module was sixty-four zeros — eighteen of them across five modules. Each parsed, resolved, and composed into a declaration a host accepts, and none could ever have started: the machine reaches `docker pull` and stops. That is why those modules were written and not running, and no check saw it because every check passed. The host validates the shape of a reference and nothing more, which is correct: verifying a digest exists means reaching a registry, and that is the one thing a host must never have to do. So the last place that could catch this is the wrong place to try. The guard therefore sits where a declaration is composed, not where a manifest is parsed. A file in a repository is allowed to await a pin — the design already says the manifest in a repository names artifacts while the manifest the mesh holds names digests, and the bundle works exactly that way. What must never happen is a placeholder reaching a machine, and composing is the last moment before one does. Twelve third-party images resolved to real digests without pulling anything, which is also the mechanism the open issue needs. Two discoveries came free: mailu publishes to ghcr rather than Docker Hub, so seven references named repositories that do not exist at all; and it renamed roundcube to webmail, so that one would have failed even with the right registry. What stays a placeholder is the mesh's own provisioner images, which genuinely have no digest until built and pushed — the bundle's problem, legitimately unresolved here. The stand-in consumer now stands in with a real image rather than an invented one.
52 lines
1.8 KiB
JSON
52 lines
1.8 KiB
JSON
{
|
|
"module": "object-store",
|
|
"version": "1",
|
|
|
|
"provides": [{"name": "s3-bucket", "scope": "mesh"}],
|
|
"capabilities": ["container-runtime"],
|
|
|
|
"listens": [
|
|
{"port": 9000, "protocol": "tcp", "from": "mesh",
|
|
"why": "the S3 endpoint, for modules on any machine that were granted a bucket"}
|
|
],
|
|
|
|
"serves": {
|
|
"s3-bucket": {
|
|
"port": 9000,
|
|
"scheme": "http",
|
|
"region": "us-east-1"
|
|
}
|
|
},
|
|
|
|
"receives": {"s3-bucket": "/var/lib/objectstore/grants"},
|
|
"grants": {"s3-bucket": "/var/lib/objectstore/grants"},
|
|
|
|
"own-secrets": {"root": "/var/lib/objectstore/root.secret"},
|
|
|
|
"resources": [
|
|
{"id": "state", "type": "directory", "path": "/var/lib/objectstore", "mode": "0700"},
|
|
{"id": "grants", "type": "directory", "path": "/var/lib/objectstore/grants", "mode": "0700"},
|
|
|
|
{"id": "store", "type": "container", "name": "mesh-store",
|
|
"image": "minio/minio@sha256:aefec8a86702aff0b0dcfdd9284bd7ab7c5631cbf9be63275799e6edcb30dfa2",
|
|
"args": ["server", "/data"],
|
|
"env": {"MINIO_ROOT_USER": "meshroot"},
|
|
"ports": ["9000:9000"],
|
|
"volumes": ["mesh-store-data:/data", "/var/lib/objectstore/root.secret:/run/secrets/root:ro"]},
|
|
|
|
{"id": "provisioner", "type": "container", "name": "mesh-provision-objectstore",
|
|
"image": "mesh-provision-objectstore@sha256:0000000000000000000000000000000000000000000000000000000000000000",
|
|
"env": {
|
|
"GRANTS": "/var/lib/objectstore/grants",
|
|
"MESH_OBJECTSTORE_URL": "http://127.0.0.1:9000",
|
|
"MESH_OBJECTSTORE_ROOT_USER": "meshroot",
|
|
"MESH_OBJECTSTORE_ROOT_PASSWORD_FILE": "/run/secrets/root"
|
|
},
|
|
"volumes": [
|
|
"/var/lib/objectstore/grants:/var/lib/objectstore/grants:ro",
|
|
"/var/lib/objectstore/root.secret:/run/secrets/root:ro"
|
|
],
|
|
"restart-on": ["grants"]}
|
|
]
|
|
}
|