Skip to content

Bazel image rules - #91

Merged
csvance merged 3 commits into
mainfrom
bazel-image-rules
Oct 4, 2026
Merged

csvance merged 3 commits into
mainfrom
bazel-image-rules

Conversation

@csvance

@csvance csvance commented Oct 4, 2026

Copy link
Copy Markdown
Collaborator

Rework Bazel rules using upstream OCI / image layers
Add job for publishing ReactantServer CUDA image to Docker Hub for releases

csvance and others added 3 commits October 4, 2026 19:42
…3, push :latest

rules_julia_depot now provides the Julia-specific image layers as rules (julia/image.bzl), so
//deploy stops carrying its own copies:
- julia_image_env replaces the hand-built JULIA_DEPOT_PATH. It declares the image layout once, and
  the compiled layer and the precompile test read the same layout, so the caches are built for and
  checked against the environment the image runs with. The workspace root is still an extra depot,
  which keeps the workspace's own packages relocatable.
- julia_dist_layer replaces the cp -aL genrule. It keeps the distribution's relative symlinks, so
  its libraries ship once instead of twice.
- julia_depot_layer and julia_compiled_layer replace the genrules around image_depot.sh and the
  precompile loop.
- julia_precompile_test (//deploy:image_precompile_test) checks the layers without a container,
  so it needs no podman and can gate a push in CI. image_check stays for what only a container
  shows: tini, curl and the entrypoints.

The CUDA driver stub is now a build-time layer. It goes to the compiled layer and the precompile
test, with LD_LIBRARY_PATH={root}/build/cuda-stub, and never to oci_image. That uses the {root}
placeholder added to rules_julia_depot in f8d7c22; before it, the rules had no way to name a file
in the tree they unpack.

Image behaviour changes:
- JULIA_PKG_OFFLINE=true and JULIA_CPU_TARGET are set at run time.
- PATH is /opt/julia/bin:$PATH, expanded against the base, instead of a copy of the base's PATH.
- Layers are ordered least-changed first, so a code change only moves the last ones.
- Our own tars normalise permissions the same way the module's do.

rules_oci 2.3.3 comes from the release archive because the Bazel Central Registry stops at 2.3.0.
The fix that matters is in 2.3.1 (#881): oci_load reported success even when the tar it streams
into the loader failed. 2.3.x needs a newer aspect_bazel_lib, so our Bazel 9 workaround is gone,
and bsdtar now comes from tar.bzl. rules_shell is 0.8.0. rules_julia_depot dropped //oci:podman.sh,
so the loader is now deploy/podman.sh.

.github/workflows/image.yml is triggered by hand. It runs manifest_current and
image_precompile_test, then pushes :latest to the repository in the DOCKERHUB_REPOSITORY variable.
Releases are not named yet, so each run's summary records the digest and the commit.

.bazelignore gains the export tests' .CondaPkg env, whose BUILD files broke //....

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The image-layers branch, including the {root} env placeholder (f8d7c22) that the CUDA stub layer
relies on, is merged into main as cead347. Pinning the merge commit keeps this module on
rules_julia_depot's main line instead of a feature-branch commit. The only commit added since
f8d7c22 (d266e89) changes e2e tests only.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The first full build of //deploy:image against the pinned rules_julia_depot and rules_oci 2.3.3
evaluated a module extension that analysis alone never reached (pybind11_bazel's
internal_configure), and Bazel recorded it. Committing it keeps the next build from rewriting the
lockfile in a clean checkout. It records no host-specific paths.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
@csvance
csvance merged commit 16efee9 into main Oct 4, 2026
12 checks passed
@csvance
csvance deleted the bazel-image-rules branch October 4, 2026 22:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant