Add agent base image composition enhancement#296
Conversation
|
Warning Review limit reached
More reviews will be available in 47 minutes and 4 seconds. Learn how PR review limits work. Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file). ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits. 🚦 How do rate limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughAdds a new enhancement proposal document for the Konveyor Agentic Platform defining a three-layer container image hierarchy, filesystem conventions, non-root execution requirements, multi-arch build expectations, CI pipeline strategy, test plan, security checklist, drawbacks, and alternatives. ChangesAgent Base Image Composition Enhancement Proposal
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 5
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@enhancements/agentic-platform-agent-images/README.md`:
- Around line 71-75: The Summary section states that skills are NOT baked into
the image, but the filesystem table description for the /opt/skills/ directory
suggests that core skills can be baked in. Clarify the contract by deciding
whether base images ship with baked-in skills or only reserve the /opt/skills/
directory as a runtime fallback location. Update both the Summary section and
the filesystem table entries (at lines 71-75 and 173-181) to be consistent and
explicit about this contract so implementers understand whether skills are
expected to be present in base images or only mounted at runtime.
- Around line 264-275: The documentation describes the harness writing results
to `/.konveyor/` and the controller reading from this path after Pod completion,
but only `/workspace/` is mentioned as a PVC mount. Since `/.konveyor/` would
reside on the container's ephemeral rootfs without a dedicated volume mount,
those results will be lost when the Pod exits. Update the README to clarify that
`/.konveyor/` must be mounted on a persistent volume (either as a separate PVC
mount or by relocating the path to `/workspace/` which is already mounted on the
PVC), ensuring results are persisted for the AgentRun controller to read after
Pod completion.
- Around line 378-391: The README documentation contains references to the
"main" branch for CI triggers and the `:latest` tag build source, but this
repository uses "master" as the default branch. Update the documentation by
replacing the references to "main" with "master" in two places: in the `:latest`
tag description where it states the tag is built from "main branch", and in the
CI section where it mentions "push to main". This ensures the documentation
accurately reflects the actual branch configuration and prevents developer
confusion about CI trigger behavior.
- Around line 156-230: The documentation currently uses `:latest` tags in all
image references (registry.access.redhat.com/ubi9/ubi-minimal:latest,
quay.io/konveyor/agent-base:latest, and the Dockerfile examples), which creates
nondeterministic builds and SBOMs. Replace all instances of `:latest` tags
throughout the README with explicit version tags using either release versions
(like :v1.0.0) or commit-based tags (like :sha-abc1234). Keep :latest as an
optional alternative reference only where it serves as documentation of the
general pattern, but make the primary examples use specific, pinned versions.
This applies to all image references across the base layer documentation,
runtime layer Dockerfiles, and language toolchain layer Dockerfiles sections.
- Around line 299-306: The README incorrectly states that OpenShift sets `$HOME`
to a writable tmpdir, but OpenShift's Restricted SCC only guarantees a random
non-root UID and does not modify the `$HOME` environment variable. Replace the
statement in point 3 about OpenShift setting `$HOME` with a corrected
explanation that `$HOME` is determined by the container image itself (via
Dockerfile WORKDIR or ENV instruction), and clarify that the harness must either
explicitly set `$HOME` in the Dockerfile or entrypoint, or it must be configured
in the pod specification, before the harness creates `$HOME/.config/<runtime>/`
directories at startup.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: bc7f476e-7668-4c59-bcfb-1b90b3e5527b
📒 Files selected for processing (1)
enhancements/agentic-platform-agent-images/README.md
| **Base**: `registry.access.redhat.com/ubi9/ubi-minimal:latest` | ||
|
|
||
| **Contents**: | ||
|
|
||
| | Path | Component | Purpose | | ||
| |---|---|---| | ||
| | `/usr/local/bin/konveyor-harness` | Harness entrypoint (Go binary) | Translates KONVEYOR_* env vars to runtime-specific config, discovers skills, invokes runtime | | ||
| | `/usr/local/bin/skillctl` | skillimage CLI | Skill discovery, inspection, build, push, pull of OCI skill artifacts | | ||
| | `/usr/local/bin/graphify` | graphify CLI (Python package) | Code graph analysis via tree-sitter AST extraction | | ||
| | `/usr/local/bin/fetch-analysis` | Konveyor tool | Fetches analysis results from Hub API | | ||
| | `/usr/local/bin/run-analysis` | Konveyor tool | Runs Kantra analysis against application source | | ||
| | `/usr/bin/git` | git | Version control | | ||
| | `/usr/bin/jq` | jq | JSON processing | | ||
| | `/usr/bin/curl` | curl | HTTP client | | ||
| | `/usr/bin/ssh` | ssh | Git SSH access | | ||
| | `/usr/bin/python3` | Python 3.12 | Required by graphify | | ||
|
|
||
| **Directories**: | ||
|
|
||
| | Path | Purpose | Permissions | | ||
| |---|---|---| | ||
| | `/opt/skills/` | Core skills (baked in, if any) | Read-only, readable by any UID | | ||
| | `/.konveyor/` | Harness output (session ID, results) | Writable by any UID | | ||
| | `/workspace/` | Workspace PVC mount point | Writable by any UID | | ||
| | `$HOME/.config/` | Runtime config (written by harness at startup) | Writable by any UID | | ||
|
|
||
| **Entrypoint**: `/usr/local/bin/konveyor-harness` | ||
|
|
||
| **Estimated size**: ~400MB (UBI minimal + Python 3.12 + graphify + Go binaries + CLI tools) | ||
|
|
||
| ### Layer 1: Runtime Layers (agent-base-{runtime}) | ||
|
|
||
| Each runtime layer extends agent-base with a specific agent runtime | ||
| binary installed to `/usr/local/bin/`. The harness auto-detects which | ||
| runtime is present by checking PATH. | ||
|
|
||
| ```dockerfile | ||
| FROM quay.io/konveyor/agent-base:latest | ||
| # Install the runtime binary (goose, opencode, etc.) | ||
| # Must be at /usr/local/bin/{runtime} for non-root access | ||
| ``` | ||
|
|
||
| | Runtime | Binary source | Estimated size | | ||
| |---|---|---| | ||
| | goose | GitHub releases (`goose-{arch}-unknown-linux-gnu.tar.bz2`) | ~500MB | | ||
| | opencode | opencode.ai install script | ~450MB | | ||
|
|
||
| New runtimes are added by creating a new `agent-base-{runtime}` | ||
| Dockerfile. No changes to agent-base or language layers required. | ||
|
|
||
| ### Layer 2: Language Toolchain Layers (agent-{lang}-{runtime}) | ||
|
|
||
| Each language layer extends a runtime layer with build tools needed | ||
| by the verify and fix phases to compile and test migrated code. | ||
|
|
||
| ```dockerfile | ||
| FROM quay.io/konveyor/agent-base-{runtime}:latest | ||
| # Install language toolchain | ||
| ``` | ||
|
|
||
| | Language | What's installed | Estimated total size | | ||
| |---|---|---| | ||
| | `agent-java-{runtime}` | OpenJDK 21, Maven 3.9+ | ~1.1GB | | ||
| | `agent-node-{runtime}` | Node.js 20 LTS, npm | ~700MB | | ||
| | `agent-dotnet-{runtime}` | .NET 8 SDK | ~900MB | | ||
| | `agent-go-{runtime}` | Go 1.23 | ~900MB | | ||
| | `agent-full-{runtime}` | All of the above | ~2.0GB | | ||
|
|
||
| Every language layer is identical regardless of runtime — only the | ||
| FROM line changes. A single Dockerfile with a build arg handles all | ||
| combinations: | ||
|
|
||
| ```dockerfile | ||
| ARG RUNTIME=goose | ||
| FROM quay.io/konveyor/agent-base-${RUNTIME}:latest |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
# First, locate the file
find . -path "*/enhancements/agentic-platform-agent-images/README.md" -type fRepository: konveyor/enhancements
Length of output: 120
🏁 Script executed:
# Read the file to check content around the specified lines
if [ -f "enhancements/agentic-platform-agent-images/README.md" ]; then
wc -l "enhancements/agentic-platform-agent-images/README.md"
echo "=== Lines 156-230 ==="
sed -n '156,230p' "enhancements/agentic-platform-agent-images/README.md"
echo "=== Lines 333-374 ==="
sed -n '333,374p' "enhancements/agentic-platform-agent-images/README.md"
fiRepository: konveyor/enhancements
Length of output: 4525
🏁 Script executed:
# Search for all :latest references in the file
if [ -f "enhancements/agentic-platform-agent-images/README.md" ]; then
echo "=== All :latest references ==="
grep -n ":latest" "enhancements/agentic-platform-agent-images/README.md"
fiRepository: konveyor/enhancements
Length of output: 819
🏁 Script executed:
# Read lines around 378 to understand tag strategy
sed -n '375,385p' "enhancements/agentic-platform-agent-images/README.md"Repository: konveyor/enhancements
Length of output: 337
Pin documented image references to specific versions for reproducible builds.
The documentation and published image list reference :latest tags (lines 156, 193, 212, 230, 333, 366–374), which makes builds and SBOMs nondeterministic. The tagging strategy already defines alternatives (:v1.0.0 for releases, :sha-abc1234 for commit-based traceability). Update the documented examples and published image list to use explicit version tags instead of :latest, keeping :latest only as an optional fallback reference.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@enhancements/agentic-platform-agent-images/README.md` around lines 156 - 230,
The documentation currently uses `:latest` tags in all image references
(registry.access.redhat.com/ubi9/ubi-minimal:latest,
quay.io/konveyor/agent-base:latest, and the Dockerfile examples), which creates
nondeterministic builds and SBOMs. Replace all instances of `:latest` tags
throughout the README with explicit version tags using either release versions
(like :v1.0.0) or commit-based tags (like :sha-abc1234). Keep :latest as an
optional alternative reference only where it serves as documentation of the
general pattern, but make the primary examples use specific, pinned versions.
This applies to all image references across the base layer documentation,
runtime layer Dockerfiles, and language toolchain layer Dockerfiles sections.
hhpatel14
changed the title
Define the container image layers for Konveyor Agentic Platform agent workloads. This enhancement fills the gap identified in the agentic-platform-controller enhancement where agent container image composition was explicitly deferred. Key decisions: - Three-layer image hierarchy: agent-base → runtime → language - UBI 9 minimal as the foundation for OpenShift certification - Skills mounted at runtime via ImageVolumes, not baked into images - Non-root execution compatible with OpenShift restricted SCC - Multi-architecture support (amd64, arm64) - User extensibility via single FROM line Image matrix covers two runtimes (goose, opencode) and five language toolchains (Java, Node.js, .NET, Go, full) for 12+ image variants published to quay.io/konveyor/. Replaces the current monolithic migration-harness image (~2.7GB) with a layered approach that reduces pull sizes and enables per-migration image selection. Signed-off-by: Hit Patel <hitpatel@redhat.com> Signed-off-by: hhpatel14 <hitpatel@redhat.com>
…h OpenShift as an example. Konveyor is vendor neutral. Signed-off-by: hhpatel14 <hitpatel@redhat.com>
ed010b3 to
f1895d3
Compare
|
@hhpatel14 — We've been grilling the agentic-platform-controller enhancement (PR #295) and made several design decisions that affect the base image composition. Summarizing the changes relevant to your PR so we can align: 1. Credential handling — harness manages git push, agent does not receive credentials directly. The agent does not receive git credentials in its environment variables or git configuration. The harness reads credentials from a mounted Secret, clones with them, and configures the workspace remote without authentication —
2. ACP transport — 3. Session handoff schema ownership. The controller enhancement now explicitly defers 4. Observability — controller reads from ACP, not from files. The controller connects to the agent's ACP HTTP endpoint via SSE and reads streaming events directly. It writes AgentRun CR status at lifecycle transitions only (started, completed, failed). The harness does NOT need to update the AgentRun CR via SA token — the controller handles that. The harness's remaining observability role is committing 5. Context budget computation deferred. Context budget validation (counting rule tokens against model context windows) is deferred from the POC. Your enhancement can skip any harness logic related to context budget enforcement. These changes are reflected in the updated controller enhancement (PR #295) and ADRs 0001/0002. Happy to discuss any of these in more detail. |
| |---|---|---| | ||
| | `/opt/skills/` | Core skills (baked in, if any) | Read-only, readable by any UID | | ||
| | `/.konveyor/` | Harness output (session ID, results) | Writable by any UID | | ||
| | `/workspace/` | Workspace PVC mount point | Writable by any UID | |
There was a problem hiding this comment.
There was a problem hiding this comment.
That is correct. EVERYTHING that we want to pass along stays with the repo.
4 participants
Define the container image layers for Konveyor Agentic Platform agent workloads. This enhancement fills the gap identified in the agentic-platform-controller enhancement where agent container image composition was explicitly deferred.
Key decisions:
Image matrix covers two runtimes (goose, opencode) and five language toolchains (Java, Node.js, .NET, Go, full) for 12+ image variants published to quay.io/konveyor/.
Replaces the current monolithic migration-harness image (~2.7GB) with a layered approach that reduces pull sizes and enables per-migration image selection.
Summary by CodeRabbit
Release Notes