P1 — publish Nix-built `zara-server` OCI image to GHCR #149

New issue

Open

opened 2026-08-22 21:30:09 +00:00 by lost-rob0t · 1 comment

lost-rob0t commented

2026-08-22 21:30:09 +00:00

(Migrated from github.com)

Parent architecture context: daemon epic #127.

Goal: provide a reproducible OCI/container image for the long-lived zara-server service, built by Nix and published by GitHub Actions to GitHub Container Registry (ghcr.io/lost-rob0t/zara).

Scope:

add a Nix OCI image output (prefer dockerTools.buildLayeredImage unless repo constraints require otherwise);
image runs zara-server as its service entrypoint;
include only runtime dependencies required by the server path;
preserve external writable state/config/key locations as volumes/mounts rather than baking secrets into the image;
add deterministic smoke test for image contents/entrypoint where practical;
publish immutable SHA tag plus branch/release-friendly tags from GitHub Actions;
use GITHUB_TOKEN with packages: write; no long-lived registry secret;
do not publish from untrusted pull requests;
keep zara as the client executable and zara-server as the daemon executable.

Acceptance:

nix build .#zara-server-image succeeds;
resulting OCI/Docker archive can be loaded and starts the packaged zara-server entrypoint;
master/release workflow publishes ghcr.io/lost-rob0t/zara with immutable commit-SHA provenance;
no credentials, local state, conversation DB, or CURVE secret key is embedded in the image.

This issue should be consumed through the repository RAGE/TDD workflow before implementation.

Parent architecture context: daemon epic #127. Goal: provide a reproducible OCI/container image for the long-lived `zara-server` service, built by Nix and published by GitHub Actions to GitHub Container Registry (`ghcr.io/lost-rob0t/zara`). Scope: - add a Nix OCI image output (prefer `dockerTools.buildLayeredImage` unless repo constraints require otherwise); - image runs `zara-server` as its service entrypoint; - include only runtime dependencies required by the server path; - preserve external writable state/config/key locations as volumes/mounts rather than baking secrets into the image; - add deterministic smoke test for image contents/entrypoint where practical; - publish immutable SHA tag plus branch/release-friendly tags from GitHub Actions; - use `GITHUB_TOKEN` with `packages: write`; no long-lived registry secret; - do not publish from untrusted pull requests; - keep `zara` as the client executable and `zara-server` as the daemon executable. Acceptance: - `nix build .#zara-server-image` succeeds; - resulting OCI/Docker archive can be loaded and starts the packaged `zara-server` entrypoint; - master/release workflow publishes `ghcr.io/lost-rob0t/zara` with immutable commit-SHA provenance; - no credentials, local state, conversation DB, or CURVE secret key is embedded in the image. This issue should be consumed through the repository RAGE/TDD workflow before implementation.

lost-rob0t commented

2026-08-22 22:00:12 +00:00

(Migrated from github.com)

Parent epic is now #153. This remains the canonical first OCI/GHCR implementation slice; do not duplicate it. Later hardening/gates are #180 -> #181 -> #182, with final container security/capability-placement proof in #183.