A snapshot: read at commit 707a04c7ce8 on 2026-10-18T00:06:01Z by majordomus 0.29.0. Nothing on this page is read again. See it live
I0909
The production image is a generated projection of the build specification
Where it stands
devtask.issueMoves
plan.transitionWhat it is
- Objective
- Generate a multi-stage container build and its ignore file from the deployment object's build specification: a pinned Alpine runtime holding the binary, the runtime assets and nothing else, executed by an unprivileged user.
- Why
- A hand-written Dockerfile is a second description of the binary, the assets and the port. Generating it keeps one description; pinning the base by digest keeps the image reproducible; keeping the runtime stage minimal keeps the attack surface and the bill small.
- Now
- deploy/Dockerfile exists and is generated: apps/majordomus-cli/src/deploy/render.rs renders it and .dockerignore from the deployment object, and generate.rs owns them as targets; docker-image.yml and release.yml's image job build it into ghcr.io/korczis/prismatic-majordomus. fly.toml was rendered beside them until 2026-10-12, when Fly.io was ruled out as a target and the file left the tree. The statement this field used to carry -- that no Dockerfile exists anywhere -- was falsified before 2026-09-10 and never corrected. Measured on master 6042f4286, 2026-09-10; fly.toml removal on 722228ef3c, 2026-10-12.
- Wanted
- The generated Dockerfile is idiomatic and reviewable, carries a header naming its source and its regeneration command, and is refused by generate --check when edited by hand.
- Done when
- unknown: the record declares no `completion`
- Risk
- Generation can make the Dockerfile unreadable, which is worse than duplication. The source describes intent, the output describes mechanics, and the output has to survive review by someone who has never seen the generator.
Acceptance
- The base image is pinned to an explicit current stable Alpine version and, where obtainable, its digest; no floating tag appears in the production build
- The runtime stage contains the binary, the declared runtime assets, certificates if they are required, and nothing else — no compiler, no toolchain, no source tree, no history, no caches, no tests
- The process runs as a dedicated unprivileged user and a test proves its user id is not zero
- The entrypoint invokes the executable directly in exec form with no shell wrapper
- The musl and static-linking decision is made against the actual native dependency graph, and any remaining dynamic runtime dependency is named, justified, installed deliberately and tested
- The generated file states its source and its regeneration command without breaking the format, and generate --check fails on a manual edit
- Validation
majordomus generate --checkcargo test --workspace --all-features- Evidence required
generated_dockerfilepinned_basenon_rootmusl_decision- Evidence present
- unknown: the record carries no `evidence` entries
Scope
- Touches
deploy/flyapps/majordomus-cli/src/deploy/container.rs- Not
Buildpacks, Nixpacks or a second container implementationAny build argument, layer or file carrying a credentialA shell entrypoint, or any shell in the runtime stage- Depends on
- Priority
- p0
- Profile
- deep-work
- Parallel safe
- true
- Owner
- unknown: the record declares no `owner`
The work so far
- Branches
- none
- Merged
- none
- Commits
0- Trunk
- master
- Sessions
- none
- Created
- 2026-09-06
- Updated
- 2026-10-12
- Started
- unknown: the record declares no `started_at`
- Verified
- unknown: the record declares no `verified_at`
- Completed
- unknown: the record declares no `completed_at`
Synchronisation
- Adapter
scripts/github-sync- Repository
- unknown: the derived plan's header carries no repository
- External issue
- unknown: a live GitHub state; this executable makes no network call, so only `scripts/github-sync --check` can answer it
- State there
- unknown: a live GitHub state; this executable makes no network call, so only `scripts/github-sync --check` can answer it
Findings
Nothing is wrong with these records.