Scott KarpandClaude Opus 4.7
55bc5bdc44
ROOT CAUSE (kohen Day-3 escalation): None of the four Dockerfiles pinned --platform. Build on Apple Silicon shipped arm64-only images to a registry consumed by amd64 SKS nodes. Init container failed exec format error before producing logs. DOCKERFILE FIX (defense in depth): Pin --platform=linux/amd64 on every FROM line in all four Dockerfiles. The build artifact now self-corrects regardless of build host. AZAZEL CO-RESIDENCE (anomaly the kohen flagged): Azazel L3 migration shipped (20260428…create_azazel_records.exs) but no separate container existed. Reading the code: azazel_processor is imported by korban_processor.external_offering at runtime in the same Python process — not a separate process. Dockerfile.korban_processor now COPYs azazel_processor/src/ alongside korban_processor. Documented in the Dockerfile (AZAZEL CO-RESIDENT section) and in deployment.yaml. Both containers (vav-pipeline + korban-processor) now mount the shared tmp-shorashim volume so the Python→Elixir file bridge (azazel_ingest.ex polls /tmp/shorashim/azazel/pending_l3/) works end-to-end. CANONICAL BUILD/PUSH (scripts/build_and_push.sh): - Pins linux/amd64 by default; PLATFORMS env for multi-arch - Pre-flight checks (repo root, buildx, registry login) - Builds and pushes all four images with one command - Closes the gap KOHEN_PROMPT.md gate 0i would otherwise leave open KOHEN.md DRIFT (kohen recorded these as anomalies through Day 1-3): - Line 58 hash fragment 99bbd07a…0a0187b → 99bbd07a…4ea377 (correct) - Inheritance table: "Not yet created" claims rewritten as "Verify before assuming" — a prior partial setup may have left state, and the kohen prompt requires verifying not assuming - L1 PV row: marked NOT REQUIRED (L1 baked into images) - §Day 3a ConfigMap recipe marked vestigial (kept as comment) - §Day 3b: removed manna-volume.yaml from kubectl apply list (deployment uses emptyDir; PVC is for a future move) - §Day 3c: "5 containers" → "4 containers + 1 init" - §Day 3 fail-mode list expanded with the four most common causes, in order, including exec format error → gate 0i KOHEN_PROMPT.md: - Gate 0f corrected to four images (talmudic-engine is image #3; azazel is co-resident in korban-processor not a separate image) - Gate 0i added: image-architecture vs node-architecture verification before Day 1, with kubectl one-liner and docker manifest inspect per image. Drift handler in the gates section: 0i FAIL → escalate to builder, do not begin Day 1. NO SPEC FILES TOUCHED: Doorpost.verify_identity() still :ok — none of these files are in @spec_files. No atomic spec+hash commit needed. NEXT STEP FOR THE KOHEN: Once these images are rebuilt and pushed via scripts/build_and_push.sh (by anyone with the Harbor CLI secret + a working docker daemon), restart from Day 1. Existing DB role shorashim_app, ALTER DEFAULT PRIVILEGES, rotated DATABASE_URL, shorashim-config, and shorashim- registry secret all remain valid across the restart. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
81 lines
2.3 KiB
Docker
81 lines
2.3 KiB
Docker
# Shorashim Vav Pipeline — Elixir/OTP release with Sanhedrin
|
|
# Construction spec §1.1: Elixir 1.16.1, OTP 26.2.1
|
|
# The pipeline and Sanhedrin run in the same BEAM VM.
|
|
#
|
|
# PLATFORM PIN:
|
|
# Both FROM directives below pin `--platform=linux/amd64`. Exoscale
|
|
# SKS nodes are amd64; without this pin, a build on an Apple Silicon
|
|
# workstation would emit an arm64 image that the cluster cannot exec
|
|
# (the kohen's Day 3 fails with "exec format error"). The pin makes
|
|
# the build artifact self-correct regardless of build host.
|
|
# Local multi-arch dev (linux/amd64,linux/arm64) is supported by
|
|
# scripts/build_and_push.sh — see that script for the canonical build.
|
|
|
|
# === BUILD STAGE ===
|
|
FROM --platform=linux/amd64 hexpm/elixir:1.16.1-erlang-26.2.1-ubuntu-jammy-20240125 AS build
|
|
|
|
RUN apt-get update && apt-get install -y git && rm -rf /var/lib/apt/lists/*
|
|
|
|
WORKDIR /app
|
|
|
|
# Copy Sanhedrin (Erlang dep, referenced as path dep from vav_pipeline)
|
|
COPY sanhedrin/ sanhedrin/
|
|
|
|
# Copy Vav Pipeline
|
|
COPY vav_pipeline/ vav_pipeline/
|
|
|
|
WORKDIR /app/vav_pipeline
|
|
|
|
# Fetch deps and compile in prod mode
|
|
ENV MIX_ENV=prod
|
|
RUN mix local.hex --force && \
|
|
mix local.rebar --force && \
|
|
mix deps.get --only prod && \
|
|
mix compile
|
|
|
|
# Build OTP release
|
|
RUN mix release
|
|
|
|
# === RUNTIME STAGE ===
|
|
FROM --platform=linux/amd64 ubuntu:jammy-20240125
|
|
|
|
RUN apt-get update && \
|
|
apt-get install -y --no-install-recommends \
|
|
libstdc++6 openssl ca-certificates locales && \
|
|
rm -rf /var/lib/apt/lists/* && \
|
|
sed -i '/en_US.UTF-8/s/^# //g' /etc/locale.gen && \
|
|
locale-gen
|
|
|
|
ENV LANG=en_US.UTF-8
|
|
ENV LANGUAGE=en_US:en
|
|
ENV LC_ALL=en_US.UTF-8
|
|
|
|
# Non-root user — the system serves, it does not own
|
|
RUN useradd --create-home --shell /bin/bash shorashim
|
|
USER shorashim
|
|
|
|
WORKDIR /home/shorashim
|
|
|
|
# Copy the release
|
|
COPY --from=build --chown=shorashim:shorashim \
|
|
/app/vav_pipeline/_build/prod/rel/vav_pipeline ./app
|
|
|
|
# L1 Torah filesystem — baked into the image (read-only, ~29MB)
|
|
# The scroll is sealed in the aron. It ships with the vessel.
|
|
COPY --chown=shorashim:shorashim l1/ /mnt/torah/
|
|
|
|
# L1 mount point
|
|
ENV L1_MOUNT_POINT=/mnt/torah
|
|
|
|
# Manna provision file location
|
|
ENV MANNA_PROVISION_FILE=/var/lib/shorashim/manna/today.json
|
|
|
|
# PostgreSQL connection for L3
|
|
# Set DATABASE_URL in production deployment
|
|
# ENV DATABASE_URL=
|
|
|
|
# Health check port
|
|
EXPOSE 4000
|
|
|
|
CMD ["./app/bin/vav_pipeline", "start"]
|