feat(hetzner-node-image): bake the ARM image on the Job executor #130

Merged

binjovi-bot merged 1 commit from feat/node-image-kubernetes-job into trunk 2026-09-08 13:27:49 +00:00

Conversation 0 Commits 1 Files changed 2 +5 -2

sean commented 2026-09-08 13:27:32 +00:00

Owner

Copy link

Last of three steps taking hetzner-node-image off Argo Workflows, and the
first time anything actually runs the new path. One line, so a revert is one
line.

The bake becomes a single disposable Job: checkout, bake and build as
ordered initContainers over a shared 40Gi ephemeral workspace on zfs-nvme-1m,
then a collect container that reports the artifact version, the QEMU boot
proof and the image digest through its termination message.

Privilege stays confined to the bake container. That is why this is a Job and
not a native agent task: agents run runAsNonRoot with every capability
dropped, and the bake needs privileged: true for the QEMU disk build. Making
an agent privileged to suit it would make every native task privileged.

Landed ahead of this, both inert until now:

binjovi 6f5a4d21 (v0.1.454)	the Job renderer and the evidence gate
binjovi 8ac6d9db (v0.1.456)	the plan, the parser and the watcher

The guard pinned the whole project object, so it moved first and went red before
this flip made it green.

Rollback is putting argo_workflow back — the Argo path is untouched, and
NodeImageWorkflow is still there.

After this, the only thing left on Argo is zot-src, which is already moving to
shipwright.

https://claude.ai/code/session_01KZoQin34jeyt6nDGqvJA76

Last of three steps taking `hetzner-node-image` off Argo Workflows, and the first time anything actually runs the new path. **One line, so a revert is one line.** The bake becomes a single disposable Job: `checkout`, `bake` and `build` as ordered initContainers over a shared 40Gi ephemeral workspace on `zfs-nvme-1m`, then a `collect` container that reports the artifact version, the QEMU boot proof and the image digest through its termination message. Privilege stays confined to the `bake` container. That is why this is a Job and not a native agent task: agents run `runAsNonRoot` with every capability dropped, and the bake needs `privileged: true` for the QEMU disk build. Making an agent privileged to suit it would make every native task privileged. Landed ahead of this, both inert until now: | | | |---|---| | binjovi `6f5a4d21` (`v0.1.454`) | the Job renderer and the evidence gate | | binjovi `8ac6d9db` (`v0.1.456`) | the plan, the parser and the watcher | The guard pinned the whole project object, so it moved first and went red before this flip made it green. **Rollback** is putting `argo_workflow` back — the Argo path is untouched, and `NodeImageWorkflow` is still there. After this, the only thing left on Argo is `zot-src`, which is already moving to `shipwright`. https://claude.ai/code/session_01KZoQin34jeyt6nDGqvJA76

sean added 1 commit 2026-09-08 13:27:32 +00:00

feat(hetzner-node-image): bake the ARM image on the Job executor ... 0d8911b76c

Last of three steps taking this project off Argo Workflows, and the first
time anything runs the new path. One line, so a revert is one line.

The bake is now a single disposable Job: checkout, bake and build as
ordered initContainers over a shared 40Gi ephemeral workspace on
zfs-nvme-1m, then a collect container that reports the artifact version,
the QEMU boot proof and the image digest through its termination message.

Privilege stays confined to the bake container, which is why this is a Job
and not a native agent task: agents run runAsNonRoot with every capability
dropped, and the bake needs privileged: true for the QEMU disk build.

Landed ahead of this, both inert until now:
  binjovi 6f5a4d21 (v0.1.454) -- the Job renderer and the evidence gate
  binjovi 8ac6d9db (v0.1.456) -- the plan, the parser and the watcher

The guard pinned the whole project object, so it moved first and went red
before this flip made it green.

Rollback is putting argo_workflow back; the Argo path is untouched.

Claude-Session: https://claude.ai/code/session_01KZoQin34jeyt6nDGqvJA76

binjovi-bot merged commit 0d8911b76c into trunk 2026-09-08 13:27:49 +00:00

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

sean/binjovi-plans!130

No description provided.