I0930 — The real image runs under the real limits before anything is deployed
Build the actual production image and run it under the resource limits of the cheap profile, verifying the process, its user, its port and its routes without fixed ports and without sleeping.
BLOCKED wave 5 · p0 · implementation profile · parallel safe
Blocked. This issue cannot start until I0906, I0909, I0912 are done. The status is derived from that, not declared.
Objective
Build the actual production image and run it under the resource limits of the cheap profile, verifying the process, its user, its port and its routes without fixed ports and without sleeping.
Why
Everything before this is a claim about an image. Running it under the limits it will actually face is the first evidence that the deployment can work, and it is far cheaper to learn here than after a deploy.
Current state
No image and no container test exist.
Desired state
One test builds the production image, runs it constrained, polls readiness with a bounded timeout, and asserts the behaviour the deployment depends on.
Scope
- test/cases
Out of scope
- A fixed host port
- A sleep standing in for readiness
- A test image that differs from the production one
Dependencies
- I0906BLOCKED Termination is graceful and proved against the real container
- I0909BLOCKED The production image is a generated projection of the build specification
- I0912BLOCKED The image serves the site the canonical pipeline produced
What waits on this
- I0922BLOCKED The memory hypothesis is tested, not asserted
- I0923BLOCKED Cold start and endpoint cost are benchmark targets like everything else
- I0928BLOCKED A pull request cannot merge a deployment that would not work
- I0931BLOCKED The application exists, one machine runs it, and the URL answers
Acceptance criteria
- The image under test is the production image, built by the canonical build
- It runs under the declared memory and CPU limits of the cheap profile, and with a read-only filesystem where the application permits it
- The process stays alive, its user id is not zero, and it listens on the declared port
- Liveness and readiness answer, and the landing, documentation, API document and static assets are served
- Readiness is reached by bounded polling on an ephemeral port, with no sleep and no fixed port
Validation
- bash test/run.sh
Evidence required
- image_built
- constrained_run
- routes_pass
- uid_nonzero
Evidence
None recorded. Every token above needs a command or an artifact behind it before this issue can be completed; narrative is refused.
Risk
A container test needs a container runtime, which not every environment has. It must skip explicitly and visibly where the runtime is absent rather than passing quietly.
Timeline
- started
- —
- verified
- —
- completed
- —
Those three fields, the evidence above and the state of the dependencies are all the status is made of. There is no status field to disagree with them.
Canonical record: .ai/repo/project/issues/I0930.yaml. Read it back with majordomus plan show I0930.