Containers: Nix-build audit — mcpx Containerfile, duplicate lab-ops Dockerfile, amd-crd definition-or-waiver

Containers track of the deployment-architecture epic (design: PR #5764 §5).

Rule from the design: software we own → Nix-built images, from scratch by default (dockerTools.streamLayeredImage/buildLayeredImage or nix2container; exactly the binary's closure + cacert/tzdata when needed). Third-party software → digest-pinned images, still tracked as deploy targets. A Dockerfile for our own software is a migration bug.

Current state (2026-11-04 inventory):

lab-ops-hub crawler: already Nix-built (pkgs/lab-ops-hub/container-image.nix, crane push) — the precedent. But a parallel container/Dockerfile builds "the same app" for Docker machines. → Delete the Dockerfile path once the Nix image is the deploy target's artifact.
mcpx: 3-stage pkgs/mcpx/Containerfile (golang build + bun copied in + debian-slim runtime), built in CI for verification. → Replace with a Nix image package; the bun sidecar becomes a closure question in the package.
identity packages: pkgs/identity/Dockerfile is already FROM scratch (good shape, prebuilt binary — make the binary a flake package so the image is one derivation); pkgs/identity/provider/Dockerfile is FROM ubuntu + apt-get (the anti-pattern — Nix-compose it).
pm-apps (Grist, Pad): third-party, digest-pinned via oci-containers — correct; bring the pins under deploy-target tracking. Kaneo/PostgreSQL are compose-managed outside pm-apps (per the pm-stack module) — bring under the same pin discipline or record why not.
amd-crd (Chrome Remote Desktop): no definition exists in any repo — the only trace is a secret name (chrome-remote-desktop.amd-pin, sops). → Definition-or-waiver: either Nix-build it (likely the "fuller userspace, still Nix-composed" exception: explicit contents list, never apt-get) or record it as a named exception with an owner and a reason.
Cloudflare's 4 container classes (CrawlerContainerV2, HelloContainer, HelloLite, CrawlerProbe) become image targets; the orphaned legacy CrawlerContainer app gets an explicit retire-or-keep decision instead of "left in place, unused".

Acceptance: an inventory table in this issue's closing comment listing every container in the estate with {builder, base, target?}; zero Dockerfiles remain for fleet-owned software except any carrying a written exception; amd-crd resolved one way or the other.

CODE-1457

🤖 Agent note · triaged

Agent: queue worker (repo-worker-code), lane code-s
Session / ID: task 10177
Found via: queue claim (coverage-audit triage packet)
Task: Triage of the containers Nix-build audit — every inventory item re-verified against current origin/main (04f78696abfb), one item the inventory missed found, workstreams scoped into a single execution task (task 10498).

Verified inventory (fresh, 2026-11-05; design PR #5764 is MERGED):

Container	Builder today	Base	Disposition
mcpx (`pkgs/mcpx/Containerfile`)	3-stage Containerfile	golang + debian-slim, bun copied in	Workstream A in task 10498: Nix image package, Containerfile deleted after CI verifies
lab-ops-hub crawler	Nix (`container-image.nix`, crane) and duplicate `container/Dockerfile`	python:3.13-alpine (Dockerfile path)	Workstream C: verify the deploy artifact, then delete the Dockerfile path (or record the live consumer blocking it)
identity (`pkgs/identity/Dockerfile`)	Dockerfile, prebuilt binary	`FROM scratch`	Workstream B: binary becomes a flake package, image = one derivation
identity provider (`pkgs/identity/provider/Dockerfile`)	Dockerfile	`FROM ubuntu` + apt-get	Workstream B: Nix-compose — the anti-pattern case
identity web (`pkgs/identity/web/Dockerfile`)	Dockerfile, gowebly-generated	golang:1.21-alpine builder	Missed by the original inventory — workstream B: Nix-build, repoint the generator, or a written exception naming the generator (a hand edit regeneration reverts is not a fix)
pm-apps (Grist, Pad)	third-party, digest-pinned via oci-containers	—	Correct shape; workstream D in task 10498: bring pins under deploy-target tracking; Kaneo/PostgreSQL pin discipline or a recorded why-not
amd-crd (Chrome Remote Desktop)	no definition in any repo	—	Traces verified: only the sops secret name `chrome-remote-desktop.amd-pin` and the design doc. Decision item below
Cloudflare classes (CrawlerContainerV2, HelloContainer, HelloLite, CrawlerProbe)	in `pkgs/lab-ops-hub` (`src/index.ts`, `wrangler.jsonc`)	—	Become image targets (workstream F); legacy `CrawlerContainer` retire-or-keep is a decision item below

Decisions that are Drew's (recorded, not silently parked):

amd-crd definition-or-waiver. Option 1 — define it: a Nix-composed image with a fuller userspace and an explicit contents list (never apt-get); costs real packaging effort for a third-party binary stack, and CRD's own installer/updater fights immutable images. Option 2 — waiver: a named exception with owner and reason (CRD is a vendor remote-access tool, not fleet software; the estate rule targets software we own), which closes the audit item with zero build work but leaves one unmanaged install on the amd laptop. Recommendation: waiver — the rule's purpose is our own software's reproducibility; CRD is vendor-managed by design. Either way the audit acceptance needs one of the two recorded.
Legacy CrawlerContainer retire-or-keep. Retire = delete the unused app definition (cleaner estate, tiny risk if something still binds it — nothing in the current tree references it as a deploy target). Keep = record why. Recommendation: retire, after task 10498's workstream F confirms no live binding.

Ordering: task 10498 executes A–D (engineering + tracking) and records E/F as awaiting Drew's rulings above; this issue's acceptance (closing inventory table, zero owned Dockerfiles except written exceptions) completes when task 10498 and the two rulings land. No other blockers: every file named above was read at current main today.

🤖 Agent note · handed off

Agent: queue worker (repo-worker-code), lane code-y
Session / ID: task 10498
Found via: queue claim
Task: small_fix for issue Containers: Nix-build audit — mcpx Containerfile, duplicate lab-ops Dockerfile, amd-crd definition-or-waiver #5771 — handed off to opencode claimant (assigned_lane=opencode, session_id null at handoff); claimant launches the bound opencode session
Expectation: claimant session works issue Containers: Nix-build audit — mcpx Containerfile, duplicate lab-ops Dockerfile, amd-crd definition-or-waiver #5771 at current main
Links: task 10498

🤖 Agent note · handed off

Agent: queue worker (repo-worker-code), lane code-v
Session / ID: task 10498
Found via: queue claim
Task: small_fix of issue Containers: Nix-build audit — mcpx Containerfile, duplicate lab-ops Dockerfile, amd-crd definition-or-waiver #5771 handed off to the opencode execution lane; the opencode claimant launches the bound session.
Expectation: claimant session drives task 10498 to a terminal state; parked 20 minutes for the claimant launch window.
Links: issue Containers: Nix-build audit — mcpx Containerfile, duplicate lab-ops Dockerfile, amd-crd definition-or-waiver #5771

🤖 Agent note · handed off

Agent: queue worker (repo-worker-code), lane code-r
Session / ID: task 10498
Found via: queue claim
Task: Handing task 10498 for issue Containers: Nix-build audit — mcpx Containerfile, duplicate lab-ops Dockerfile, amd-crd definition-or-waiver #5771 to the opencode claimant (execution lane assigned opencode); the bound opencode session will work issue Containers: Nix-build audit — mcpx Containerfile, duplicate lab-ops Dockerfile, amd-crd definition-or-waiver #5771 to its terminal state.
Expectation: claimant launches a bound session; task 10498 parked 1800s awaiting launch.
Links: issue Containers: Nix-build audit — mcpx Containerfile, duplicate lab-ops Dockerfile, amd-crd definition-or-waiver #5771

🤖 Agent note · handed off

Agent: queue worker (repo-worker-code), lane code-e
Session / ID: task 10498
Found via: queue claim
Task: Handed off task 10498 (small_fix) for issue Containers: Nix-build audit — mcpx Containerfile, duplicate lab-ops Dockerfile, amd-crd definition-or-waiver #5771 to the opencode claimant — execution lane assigned opencode. Fresh check: issue Containers: Nix-build audit — mcpx Containerfile, duplicate lab-ops Dockerfile, amd-crd definition-or-waiver #5771 OPEN, no hard-stop labels.
Expectation: claimant launches the bound opencode session and drives task 10498 to a terminal state
Links: issue Containers: Nix-build audit — mcpx Containerfile, duplicate lab-ops Dockerfile, amd-crd definition-or-waiver #5771

Navigation Menu

Repository navigation

Containers: Nix-build audit — mcpx Containerfile, duplicate lab-ops Dockerfile, amd-crd definition-or-waiver #5771

85 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Containers: Nix-build audit — mcpx Containerfile, duplicate lab-ops Dockerfile, amd-crd definition-or-waiver #5771

Description

Activity

developing-today commented on Nov 5, 2026

dezren39 commented on Nov 5, 2026

dezren39 commented on Nov 5, 2026

85 remaining items

dezren39 commented on Nov 6, 2026

dezren39 commented on Nov 6, 2026

dezren39 commented on Nov 6, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions