statecraft.
Catalog/rahi

031-single-container-packaging

Single-container packaging: one image, one volume, first boot, keys, die-together supervision

Lifecycle approvedImplementation completeVerification unknownQualification unknown

One container plus one volume is a complete authenticated application. The image carries the app binary and the rauthy release binary. First boot generates every key (ledger, session, backup, rauthy ENC_KEYS, the admin token), writes rauthy's environment derived from one public URL, and bootstraps the OIDC client; a restart regenerates nothing. The app is the supervisor: it starts rauthy on loopback, waits for its health, starts serve, and when either exits the other is stopped and the container exits. The volume layout is /data/hiqlite, /data/rauthy, /data/keys, and /data/backups. Carries enrahitu://007.

Read the full pinned specification ↗

Relationships

Claimed units

  • establishes
    {
  "kind": "file",
  "path": "crates/rahi-ops/src/first_boot.rs"
}
  • establishes
    {
  "kind": "file",
  "path": "crates/rahi-ops/src/keys.rs"
}
  • establishes
    {
  "kind": "file",
  "path": "crates/rahi-ops/src/supervise.rs"
}
  • establishes
    {
  "kind": "file",
  "path": "crates/rahi-ops/src/rauthy_env.rs"
}
  • establishes
    {
  "kind": "file",
  "path": "crates/rahi-ops/tests/first_boot.rs"
}
  • establishes
    {
  "kind": "file",
  "path": "crates/rahi-ops/tests/supervise.rs"
}
  • establishes
    {
  "kind": "file",
  "path": "docker/Dockerfile"
}
  • establishes
    {
  "kind": "file",
  "path": "docker/entrypoint.sh"
}
  • establishes
    {
  "kind": "file",
  "path": "docker/smoke.sh"
}
  • establishes
    {
  "kind": "file",
  "path": ".github/workflows/image.yml"
}
  • extends
    {
  "nature": "additive",
  "spec": "030-operational-verbs",
  "unit": {
    "kind": "file",
    "path": "crates/rahi-ops/src/lib.rs"
  }
}
  • extends
    {
  "nature": "additive",
  "spec": "030-operational-verbs",
  "unit": {
    "kind": "file",
    "path": "crates/rahi-ops/Cargo.toml"
  }
}
  • extends
    {
  "nature": "additive",
  "spec": "030-operational-verbs",
  "unit": {
    "kind": "file",
    "path": "crates/rahi-cli/src/lib.rs"
  }
}
  • extends
    {
  "nature": "additive",
  "spec": "030-operational-verbs",
  "unit": {
    "kind": "file",
    "path": "crates/rahi-cli/src/serve.rs"
  }
}
  • extends
    {
  "nature": "additive",
  "spec": "030-operational-verbs",
  "unit": {
    "kind": "file",
    "path": "crates/rahi-cli/tests/cli.rs"
  }
}
  • extends
    {
  "nature": "additive",
  "spec": "010-workspace-and-core-types",
  "unit": {
    "anchor": "workspace.dependencies",
    "file": "Cargo.toml",
    "kind": "section"
  }
}
  • extends
    {
  "nature": "additive",
  "spec": "025-api-tokens-and-resource-server",
  "unit": {
    "kind": "file",
    "path": "crates/rahi-idp/tests/bearer.rs"
  }
}
  • extends
    {
  "nature": "additive",
  "spec": "001-agentic-harness",
  "unit": {
    "kind": "file",
    "path": ".github/workflows/govern.yml"
  }
}

Source headings

  1. 031: Single-container packaging
  2. 1. Purpose
  3. 2. Territory
  4. 3. Behavior
  5. 4. Functional requirements
  6. 5. Acceptance criteria
  7. 6. Out of scope
  8. 7. Resolved decisions
  9. 8. Status
  10. Verification

Frozen anchors

No frozen anchors declared.