Module render 

The deployment artifacts, rendered from the canonical deployment object: the container image definition and the ignore file that bounds its build context. No provider configuration is rendered: no hosting provider is a target (see super).

Neither is authoritative and neither is written by hand. Each carries a header naming the object it came from and the command that regenerates it, and majordomus generate --check refuses a tree where one of them was edited. That is the whole point of the kind: the port, the routes and the build inputs are stated once, and these files are views of that one statement.

Constants

ALPINE

The Alpine release both stages are built on: the builder links against its musl and the runtime runs the result, so the two are one number rather than two that could disagree. Pinned, because a floating tag would make the image a different thing on different days.

APP_DIR

Where the layer and the tool distribution live inside the image.

BINARY_ARG

The build argument that chooses where the image’s executable comes from: build (the default) compiles it from the context, release takes the release’s own published, checksummed and attested executable (.github/workflows/release.yml). BuildKit builds only the stages the final image reaches, so with release nothing is compiled at all, and the image a release publishes runs the very bytes its archives ship.

BUILDER_STAGES

The stages of the builder, in order, before the runtime stage. Each is a layer cache boundary, and what invalidates each is the point of the split:

COMMIT_ARG

The build argument that carries the commit into the builder stage. It is the variable the crate’s build script reads, so an image built with it answers the commit on its health routes and one built without it answers unknown.

DIRTY_ARG

The build argument that says whether that commit’s tree was dirty (true/false).

DOCKERFILE

Where the image definition goes.

DOCKERIGNORE

Where the build context’s ignore file goes. Docker reads it from the context root, so it lives at the repository root whatever the image definition’s own path is.

LOCAL_DIR

The layer’s checkout-local half, relative to APP_DIR: never in the build context (the ignore file excludes it), and the one directory the deployed process writes.

RELEASE_CONTEXT

The named build context a release build is given: a directory holding majordomus-<arch> for each platform (amd64, arm64), BuildKit’s TARGETARCH names.

RUN_USER

The unprivileged user the deployed process runs as.

SCCACHE_DIR

Where sccache keeps compiled units inside the builder: a BuildKit cache mount, never layer content. Two caches with two jobs, because neither does the other’s:

SCCACHE_MOUNT_ID

The id of the sccache mount, the name under which a builder keeps it between builds and the name a workflow restores it by.

SCCACHE_SIZE

The bound sccache evicts to: the dependency graph compiled for one profile and target is well under it, and a bound is what keeps a long-lived builder’s disk from growing forever. The builder also sets SCCACHE_IDLE_TIMEOUT=0: sccache’s server stops after 600 s without a new request, and the package’s own release compile alone ran 612 s on a loaded builder, so the server stopped under it and the wrapper compiled the package a second time.

TOOLCHAIN_FILE

The repository file whose exact channel is the builder’s Rust version. It is the pin rustup, the workflows and every developer already build with; the image does not get a second one (rust:1.85 stood here while the repository built with 1.98.1).

Functions

artifacts

The two artifacts of one deployment; rust is the builder’s exact Rust version.

builder_rust

The exact Rust version a builder stage may pin, read from what the repository declares in TOOLCHAIN_FILE. A channel that is not a version number (stable, nightly) or no declaration at all is refused, with the correction: an image built from a floating channel is not reproducible, and guessing a version would be the second pin this function exists to prevent.

dockerfile

The container image, as a multi-stage build: builder stages that hold the toolchain (BUILDER_STAGES) and a runtime that holds the binary, the layer and nothing else. The runtime carries no compiler, no cargo registry, no repository history and no shell history — what is not copied in cannot leak out. rust is the exact version the builder pins, from builder_rust.

dockerignore

The build context: nothing but the declared inputs. Everything is excluded and each input is let back in, so a file that appears in the repository tomorrow does not appear in the image tomorrow.

runtime_image

The runtime base: the same Alpine release as the builder.

rust_image

The builder image for an exact Rust version: rust:<version>-alpine<ALPINE>.