Skip to content

container-images.md

Latest commit

 

History

History
101 lines (71 loc) · 4.62 KB

container-images.md

File metadata and controls

101 lines (71 loc) · 4.62 KB
Raw

Container Images

DevHire Cloud publishes immutable service images from the protected release workflow. GHCR is the canonical registry because it links packages back to this repository through OCI labels. Docker Hub is supported as a public mirror when repository secrets are configured.

Image Matrix

Service GHCR image Docker Hub mirror
api-gateway ghcr.io/jasontm17/devhire/api-gateway:<tag> docker.io/nguyenson1710/devhire-cloud-api-gateway:<tag>
auth-service ghcr.io/jasontm17/devhire/auth-service:<tag> docker.io/nguyenson1710/devhire-cloud-auth-service:<tag>
user-service ghcr.io/jasontm17/devhire/user-service:<tag> docker.io/nguyenson1710/devhire-cloud-user-service:<tag>
company-service ghcr.io/jasontm17/devhire/company-service:<tag> docker.io/nguyenson1710/devhire-cloud-company-service:<tag>
job-service ghcr.io/jasontm17/devhire/job-service:<tag> docker.io/nguyenson1710/devhire-cloud-job-service:<tag>
application-service ghcr.io/jasontm17/devhire/application-service:<tag> docker.io/nguyenson1710/devhire-cloud-application-service:<tag>
notification-service ghcr.io/jasontm17/devhire/notification-service:<tag> docker.io/nguyenson1710/devhire-cloud-notification-service:<tag>
audit-service ghcr.io/jasontm17/devhire/audit-service:<tag> docker.io/nguyenson1710/devhire-cloud-audit-service:<tag>
ai-service ghcr.io/jasontm17/devhire/ai-service:<tag> docker.io/nguyenson1710/devhire-cloud-ai-service:<tag>
assessment-runner-service ghcr.io/jasontm17/devhire/assessment-runner-service:<tag> docker.io/nguyenson1710/devhire-cloud-assessment-runner-service:<tag>
frontend ghcr.io/jasontm17/devhire/frontend:<tag> docker.io/nguyenson1710/devhire-cloud-frontend:<tag>

Use release tags or commit SHAs. Do not deploy latest; it is intentionally not published.

Registry Metadata

Each image carries OCI labels for:

  • source repository;
  • exact Git revision;
  • release/manual image tag;
  • creation timestamp;
  • documentation URL;
  • title, description, vendor, author, and license.

The release workflow also requests BuildKit provenance and SBOM output for every published image. This makes GHCR package pages readable and lets reviewers trace each image back to source and CI evidence.

Publish Flow

Release tags publish GHCR images automatically:

git tag v0.6.0
git push origin v0.6.0

Manual publish uses the same workflow without creating a GitHub Release:

gh workflow run release.yml --ref master -f image_tag=v0.6.0-preview

Docker Hub mirroring is skipped unless these repository secrets exist:

gh secret set DOCKERHUB_USERNAME --repo JasonTM17/DevHire_Cloud_Spring_Microservices
gh secret set DOCKERHUB_TOKEN --repo JasonTM17/DevHire_Cloud_Spring_Microservices
gh variable set DOCKERHUB_NAMESPACE --body nguyenson1710 --repo JasonTM17/DevHire_Cloud_Spring_Microservices

If DOCKERHUB_NAMESPACE is omitted, the workflow uses DOCKERHUB_USERNAME as the namespace.

Current Release Mirror

The current release images are mirrored through Docker Desktop and/or the release workflow under the nguyenson1710 Docker Hub account. Each service has the release tag:

  • v0.6.0

Pull Examples

docker pull ghcr.io/jasontm17/devhire/api-gateway:v0.6.0
docker pull ghcr.io/jasontm17/devhire/frontend:v0.6.0

Docker Hub mirror examples:

docker pull docker.io/nguyenson1710/devhire-cloud-api-gateway:v0.6.0
docker pull docker.io/nguyenson1710/devhire-cloud-frontend:v0.6.0

Verify the complete Docker Hub mirror set:

.\scripts\dockerhub-image-verify.ps1 -Tags v0.6.0

Use the production compose sample with Docker Hub mirror names:

$env:IMAGE_TAG = "v0.6.0"
$env:DEVHIRE_RUNNER_MODE = "judge0"
$env:JUDGE0_BASE_URL = "https://judge0.example.internal"
docker compose -f deploy/docker-compose.prod.yml -f deploy/docker-compose.dockerhub.yml config --quiet
.\scripts\code-assessment-smoke.ps1 -GatewayUrl http://localhost:8080

Production compose and Kubernetes profiles must keep DEVHIRE_RUNNER_MODE=judge0 and require JUDGE0_BASE_URL; local deterministic mode is preview-only and should not be used for trusted candidate scoring.

For assessment-specific verification after deployment, run the code assessment runner runbook smoke sequence: Gateway workflow smoke first, then live Judge0 smoke when the sandbox is reachable.

After the first GHCR publish, package visibility may still need an owner review in GitHub Packages settings if the account defaults packages to private.