ajp_anton/docker-images
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Simplify python-tools task configuration
Build custom container images / build (map[base_image:php:8-fpm-alpine build_args:PHP_VERSION=8 context:php8-pgsql fingerprint_command:{ apk info -v | LC_ALL=C sort; find /usr/local/lib/php/extensions /usr/local/etc/php/conf.d -type f -exec sha256sum {} + | LC_ALL=C sort; } name:ph… (push) Successful in 42s
Details
Build custom container images / build (map[base_image:postgres:18 build_args:PG_VERSION=18 POSTGIS_VERSION=3 VCHORD_VERSION=0.5.3 context:postgres fingerprint_command:{ dpkg-query -W -f='${binary:Package}=${Version}\n' | LC_ALL=C sort; find /usr/lib/postgresql -type f -exec sha256su… (push) Successful in 53s
Details
Build custom container images / build (map[base_image:python:3 build_args:PYTHON_VERSION=3 context:python-tools fingerprint_command:{ dpkg-query -W -f='${binary:Package}=${Version}\n' | LC_ALL=C sort; pip freeze | LC_ALL=C sort; } name:python-tools oci_labels:org.opencontainers.ima… (push) Successful in 1m18s
Details
Build custom container images / build (map[base_image:python:3.12-slim build_args:PYTHON_VERSION=3.12-slim context:linkki-tiedotus fingerprint_command:{ dpkg-query -W -f='${binary:Package}=${Version}\n' | LC_ALL=C sort; pip freeze | LC_ALL=C sort; } name:linkki-tiedotus oci_labels:… (push) Successful in 26s
Details

Browse Source
This commit is contained in:
ajp_anton
2026-08-24 15:40:31 +00:00
parent 8ec3cde4f2
commit cb80d420c0
4 changed files with 135 additions and 47 deletions
Download Patch File Download Diff File Expand all files Collapse all files
python-tools/README.md
+23 -4
View File
@@ -18,10 +18,17 @@ The image contains application code only. Mount these paths at runtime:
- `/opt/credentials` read-only: named credential files used by those scripts.
- `/var/lib/server-maintenance`: persistent SQLite data, logs, and task state.
Task processes receive a minimal environment. To forward non-secret container
settings to tasks, list their names in `SERVER_MAINTENANCE_TASK_ENV`, separated
by commas. This allowlist prevents unrelated container configuration from
being exposed to every task; credentials should remain in `/opt/credentials`.
Each group's durable task data lives under
`/var/lib/server-maintenance/tasks/<group-id>`. When a task group disappears
from the mounted task directory, its state is retained for 14 days and then
removed automatically. Tasks that need more focused retention should clean up
their own state within that group.
Task processes receive only runner-provided paths for input, artifacts,
credentials, and state. Keep task-specific non-secret configuration in an
optional `task-config.json` beside that group's scripts, and credentials in
`/opt/credentials`. The runner does not interpret `task-config.json`; its
schema belongs to the task group that reads it.
Tasks are never imported during discovery. Their optional description is the
first line of their module docstring. A task must not require stdin or command
@@ -122,6 +129,12 @@ are stored in a private per-run directory; their absolute paths are provided in
the input JSON and the files are removed when the task finishes, fails, or is
cancelled.
A group may also include a private `task-config.json` for stable local details
such as mounted filesystem roots. This is not part of discovery or the web
form schema: task code reads and validates it itself. Keeping it beside the
group makes a task's runtime requirements clear and avoids a global
task-environment allowlist.
## Artifacts
Tasks can write files to the directory named by
@@ -154,3 +167,9 @@ stack. Set `PYTHON_TOOLS_VOLUME_ROOT` to the host directory that will hold
`state`, `tasks`, and `credentials`; set
`SERVER_MAINTENANCE_ALLOWED_PROXY_IPS` to the reverse proxy's direct peer
address. Keep the application behind an authenticated reverse proxy.
Tasks receive a group-specific writable directory in
`SERVER_MAINTENANCE_STATE`. Tasks which intentionally maintain application-wide
state, such as run-history maintenance, can use
`SERVER_MAINTENANCE_STATE_ROOT`; normal task state should remain
group-specific.