[PiquelChips]

piqueld builds images on the host that runs them, so on a small production host a build competes with the applications it is about to replace, and a larger machine nearby can't help (#403).

A [build] table now names a build machine. The host still checks repositories out, then sends each build to that machine's BuildKit daemon, which pushes the image to a registry by digest. The host's Docker Engine pulls it from there, like an image source.

[build]
builder = "tcp://build.example.ts.net:1234"
repository = "build.example.ts.net:5000/piqueld"

• Configuration: build.builder and build.repository, set together or not at all, in config.toml, the NixOS module, the example configuration and the references. The dashboard's Host settings show them.
• Builder: at startup the daemon registers the builder with Buildx's remote driver in <data_dir>/buildx, so nothing depends on the daemon user's Docker configuration. Registering only records the address: the build machine can be off.
• Build: for the platform of the host's engine, pushed by digest without a tag, then pulled by that digest.
• Identity: a Git source resolves to a BuiltImage: a local image ID, or a repository digest. It is stored as the same string as before, so existing deployments and releases read back unchanged. A pushed image can be pulled again when the engine has lost it, so a restore no longer needs a rebuild for it.

Differs from the issue

Every image goes to one configured repository by digest, instead of <registry>/<application>/<service>. All images then share their layers within the registry, renames change nothing, and cleanup (#409) has one place to look.

Settled first, as the issue asked

• Transport: Buildx's remote driver over TCP to a rootless BuildKit daemon builds and pushes by digest. The connection is unauthenticated, so the docs require that only the host can reach the port. mTLS and SSH are not covered.
• Registry outage: Swarm restarts a digest-pinned service from the local image while the registry is unreachable, and rejects the task with the registry's error when the image is also missing.
• Builder outage: registering succeeds while the builder is down. A build then fails after about 20 seconds with git_build_failed, and its output ends with waiting for connection and context deadline exceeded. feat(builds): handle an unreachable builder #406 turns that into its own error.
• Cleanup: Docker removes a pulled built image by ID without force, and it keeps its ownership labels, so image cleanup treats it like a local build.

Notes for review

• The build machine's settings (BuilderEndpoint, BuildRepository, RemoteBuild) are in piqueld_core::build_machine, so piqueld-config parses them and piqueld-docker builds with them without depending on each other.

Testing

• Unit tests for the settings, the Buildx options, and the stored form of BuiltImage.
• End to end on a development instance, whose engine uses the containerd image store, against a BuildKit daemon and a registry: an application built from Git deployed, its service ran the registry digest, the next deployment reused the image, --rebuild built again, and a deployment with the builder stopped failed as described while the service kept running.
• The pull by digest was also checked by hand on an engine with the classic image store.
• No automated test drives a real BuildKit daemon and registry.

Stacked on #425. Closes #405. Part of #403.

Note

Written by Claude Fable 5.2 in Claude Code (via T3 Code)

🤖 Generated with Claude Code

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn