30 lines
1.3 KiB
Markdown
30 lines
1.3 KiB
Markdown
|
# cameleer-runtime-loader
|
||
|
|
|
||
|
|
Init container that fetches the deployable JAR into a shared volume before the
|
||
|
|
main runtime container starts. The image is consumed by
|
||
|
|
`DockerRuntimeOrchestrator` in the **cameleer-server** repo as a tenant
|
||
|
|
sidecar — see that repo's `.claude/rules/docker-orchestration.md`
|
||
|
|
("Init-Container Loader Pattern") for the contract.
|
||
|
|
|
||
|
|
## Build
|
||
|
|
|
||
|
|
CI (`.gitea/workflows/ci.yml`, `docker` job, "Build and push runtime-loader
|
||
|
|
image" step) builds and pushes this image on every main / feature-branch
|
||
|
|
push. Manual build for local testing:
|
||
|
|
|
||
|
|
docker build -t gitea.siegeln.net/cameleer/cameleer-runtime-loader:<tag> .
|
||
|
|
docker push gitea.siegeln.net/cameleer/cameleer-runtime-loader:<tag>
|
||
|
|
|
||
|
|
## Contract (consumed by cameleer-server)
|
||
|
|
|
||
|
|
- Env: `ARTIFACT_URL` (signed download URL), `ARTIFACT_EXPECTED_SIZE` (bytes).
|
||
|
|
- Volume: writes `/app/jars/app.jar`.
|
||
|
|
- Exit 0 on success; non-zero on fetch/size failure.
|
||
|
|
- Runs as UID 1000 (loader user), drops all caps, read-only rootfs except `/app/jars`.
|
||
|
|
|
||
|
|
Contract regression coverage lives on the cameleer-server side
|
||
|
|
(`LoaderHardeningIT`); pulls the published `:latest` and asserts exit 0
|
||
|
|
under the orchestrator's hardening shape. Don't change the env vars,
|
||
|
|
mount path, or exit-code semantics without updating the cameleer-server
|
||
|
|
side in the same change.
|