feat(containers): publish :main-<lane> images, and document the flags that actually work - #424
Merged
Merged
Conversation
… that work FOLLOWING_AGENTS_PROTOCOL main produced NO image at all. The original design published on tags only, so anyone wanting to run the tree had to build it themselves -- a real gap, and the reason for this change. Each lane now also publishes a moving :main-<lane>. It is a convenience, not a release: it carries no support claim, and it must never touch :latest* or a version tag. That is enforced, not assumed -- promote (which moves :latest*) stays gated on is_release publish/manifest/attest gated on `publishes` = tag OR main, never PR the immutable-tag guard applies to version tags only; main moves plan refuses to classify a pull_request as main with a mutation case for each, including one asserting a main run cannot write a version tag and one asserting promote cannot touch main tags. WHEN it builds is a cost decision, stated because it is a trade: container INFRASTRUCTURE changes (docker/**, the matrix, the validator, the build scripts, the workflow) rebuild immediately, and everything else rides a nightly. main takes dozens of pushes a day and three lanes on two architectures per push is prohibitive; the nightly bounds staleness at a day. DOCS, written from what was actually run rather than from the design. The two NVIDIA families need different flags and the docs previously gave only one: SBSA / x86_64 --gpus all (verified GB10 sm_121a) Jetson / Tegra --runtime nvidia --gpus all (verified AGX Orin sm_87) plus a startup-failure table for the three ways this actually bit during bring-up: weights not readable by uid 1000 (reads as a corrupt checkpoint), libcuda.so.1 missing (a Jetson flag problem, not a broken image), and flags passed to the wrong place. Thor (sm_110) is recorded as owed, not assumed: the node was unavailable. Orin makes Thor plausible, not proven -- a different SoC on a newer L4T, which is the kind of assumption this row has already been wrong about once. Issue: #170 Following-Agents-Protocol: true AI-Assisted: true Assisted-by: Claude:claude-opus-5 [Claude Code]
localai-bot
pushed a commit
to bakon11/vllm.cpp
that referenced
this pull request
Aug 11, 2026
…EFAULTS Second forward-merge in the same session: origin/main advanced to 76f20ba (containers, mudler#424) while this row's gates were running. No overlap with the Muse Glimmer config paths; the muse gates were re-run on the merged tree and are green. FOLLOWING_AGENTS_PROTOCOL Following-Agents-Protocol: true AI-Assisted: true Assisted-by: AGENT:claude-opus-5 [Claude Code]
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
mainproduced no image at all — the original design published on tags only, so anyone wanting to run the tree had to build it. Refs #170.Main images
Each lane now publishes a moving
:main-<lane>. It is a convenience, not a release: no support claim, and it must never touch:latest*or a version tag.That is enforced, not assumed:
:latest*follows a release onlypromotestays gated onis_releasepublishes= tag OR mainplanrefuses to classifypull_requestas mainEach has a mutation case, including one asserting a main run cannot write a version tag and one asserting
promotecannot touch main tags.When it builds — a stated trade
Container infrastructure changes (
docker/**, the matrix, the validator, the build scripts, the workflow) rebuild immediately; everything else rides a nightly.maintakes dozens of pushes a day and three lanes on two architectures per push is prohibitive. The nightly bounds staleness at a day.If you'd rather have an image per main push, that's a one-line change to the
paths:filter — say the word.Docs, written from what was actually run
The two NVIDIA families need different flags, and the docs previously gave only one:
sm_121a--gpus allsm_87, L4T R36.4.3--runtime nvidia --gpus allPlus a startup-failure table for the three ways this actually bit during bring-up:
safetensors: cannot open file→ weights not readable by uid 1000 (looks like a corrupt checkpoint)libcuda.so.1: cannot open shared object file→ a Jetson flag problem, not a broken image--model <dir> is required→ flags go after the image nameThor
Recorded as owed, not assumed — the node was unavailable. Orin makes Thor plausible, not proven: different SoC, newer L4T, and this row has already been wrong about exactly that kind of assumption once.
Gates
scripts/agent-preflight.sh --stagedexits 0;test_check_container_workflow.py34/34; container matrix and workflow guards green.🤖 Generated with Claude Code