syncode/control

feat: build an image of the control plane #9

Merged

day01 merged %!d() commits from %!s() into %!s()

2026-08-11 14:37:04 +00:00

day01 commented

2026-08-11 14:32:59 +00:00

Owner

There was no way to run this anywhere but from a checkout: no Dockerfile, and the only workflow was the one validating a pull request. A control plane that cannot be deployed cannot replace anything.

The image follows the runner's shape — validation stage, release build, slim runtime with just the binary and certificates — and is tagged by the digest of the sources it was built from, so rebuilding the same tree reuses the published image instead of producing a near-identical second one.

Two decisions worth reading

The test suite is not in the validation stage. The store tests refuse to pass without a Postgres and an image build has none. Running the rest and calling it validation would say "verified" about precisely the part that was not. The full suite runs in pull-request.yml, where the database is a service.

The image overrides the listen addresses. The binary defaults to the loopback, which is correct on a developer machine and useless in a container, where the network is the only way in. The image states every interface in its CMD; the container's isolation is what keeps that private.

Verification

Built locally: 111 MB, starts against a real Postgres and stays up, --help and issue-token both reachable.

There was no way to run this anywhere but from a checkout: no Dockerfile, and the only workflow was the one validating a pull request. A control plane that cannot be deployed cannot replace anything. The image follows the runner's shape — validation stage, release build, slim runtime with just the binary and certificates — and is tagged by the digest of the sources it was built from, so rebuilding the same tree reuses the published image instead of producing a near-identical second one. ## Two decisions worth reading **The test suite is not in the validation stage.** The store tests refuse to pass without a Postgres and an image build has none. Running the rest and calling it validation would say "verified" about precisely the part that was not. The full suite runs in `pull-request.yml`, where the database is a service. **The image overrides the listen addresses.** The binary defaults to the loopback, which is correct on a developer machine and useless in a container, where the network is the only way in. The image states every interface in its `CMD`; the container's isolation is what keeps that private. ## Verification Built locally: 111 MB, starts against a real Postgres and stays up, `--help` and `issue-token` both reachable.

day01 added 1 commit 2026-08-11 14:33:00 +00:00

feat: build an image of the control plane

		There was no way to run this anywhere but from a checkout: no Dockerfile, and
the only workflow was the one that validates a pull request. A control plane
that cannot be deployed cannot replace anything.

The image follows the runner's: a validation stage, a release build, and a slim
runtime carrying only the binary and the certificates it needs. It is tagged by
the digest of the sources it was built from, so rebuilding the same tree reuses
the published image rather than producing a second one differing only in
timestamps.

The test suite is deliberately not part of the validation stage. Its store tests
refuse to pass without a Postgres to run against and an image build has none;
running the rest and calling that validation would say "verified" about exactly
the part that was not. The full suite, database included, runs in
pull-request.yml.

The binary listens on the loopback by default, which is right on someone's own
machine and useless in a container, where the network is the only way in. The
image therefore states every interface in its command, and the container's
isolation is what keeps that private.

day01 merged commit d4f0dd48c3 into %!s()

2026-08-11 14:37:04 +00:00

day01 deleted branch feat/build-an-image-of-the-control-plane

2026-08-11 14:37:04 +00:00

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: syncode/control#9