TD2 — Build our application image

Step 1 — Complete the image definition · 30 minutes

Read the starter Dockerfile, .dockerignore, wsgi.py and locked requirements.txt. Finish the marked Dockerfile tasks: install hash-locked dependencies in a builder, use a separate runtime stage, copy only runtime dependencies and the supplied API files, select UID/GID 10001, add version/source/revision OCI labels, expose the API's port 8000, provide a bounded /healthz check, and start Gunicorn with wsgi:application in exec form. Complete .dockerignore so Git metadata, credentials, local environments, caches, tests and evidence stay out of the build context. Keep the approved digest-pinned base. Review docker build --help and Dockerfile reference syntax as needed. Inspect both files before building; remove the TD2 task markers only after you have implemented and explained each item.

Step 2 — Build twice and inspect source identity · 35 minutes

Commit the completed definition and record the full Git SHA with git rev-parse HEAD. Build the same source twice with docker build, passing your version, Git SHA and repository URL as build arguments. Save both build logs under evidence/TD02/ and compare which steps used cache. Inspect the resulting image's configured user, OCI revision/source labels and health check. A tag helps find the candidate; your recorded source SHA explains which commit it represents. If build fails, keep the first error and check the locked dependency install and the wsgi:application target.

Use this build invocation after completing your own Dockerfile. It exercises your definition; it does not supply it. Repeat the same build with a different log filename to compare cache behavior.

set -o pipefail
. scripts/course-env.sh
release_sha="$(git rev-parse HEAD)"
local_image="delivery-api:$release_sha"
read -r -p 'Your repository web URL: ' source_url
mkdir -p evidence/TD02
docker build --platform "$COURSE_IMAGE_PLATFORM" --progress=plain \
  --build-arg "PYTHON_IMAGE=$PYTHON_IMAGE" --build-arg "GIT_SHA=$release_sha" \
  --build-arg APP_VERSION=0.2.0 --build-arg "SOURCE_URL=$source_url" \
  --tag "$local_image" . 2>&1 | tee evidence/TD02/build-first.txt
docker image inspect "$local_image" --format '{{.Config.User}} {{json .Config.Labels}}'

Step 3 — Run the candidate and test its HTTP contract · 30 minutes

Run your image as td02-api with only host loopback port 8080 mapped to container port 8000. Use a TD02 label so cleanup is bounded. The supplied app requires a password field to start. For this database-absent test only, pass --env POSTGRES_PASSWORD=unused-td02-placeholder to your run command. This is an explicitly unused example value, not a credential. TD3 replaces it with a protected file secret; never use a real password in a run argument. PostgreSQL is intentionally absent today. Request /healthz, /version and /readyz with curl, saving status codes and bodies. For example, once the container is running:

curl --include http://127.0.0.1:8080/healthz
curl --include http://127.0.0.1:8080/version
curl --include http://127.0.0.1:8080/readyz

Expect liveness to succeed, version to report the image's Git SHA, and readiness to report a non-ready HTTP response until TD3 supplies PostgreSQL. Inspect the container user, logs and port binding when any result differs.

Step 4 — Publish and test an immutable registry reference · 55 minutes

Use your own private project repository and package namespace. Authenticate to GHCR without putting a token in a shell argument, file or screenshot. Tag the tested candidate with its full Git SHA, push it, resolve the registry @sha256: digest, then pull and run by that digest. Repeat the version request and compare its Git SHA with your saved build revision. Record the observed registry reference in release.env as DELIVERY_API_IMAGE=ghcr.io/...@sha256:...; never substitute a local image ID or mutable tag for the registry digest. If access is unavailable, mark this gate BLOCKED with the redacted error and keep the local tests; do not claim a published digest.

These commands teach the registry mechanics for your tested image. Set the namespace to your own lower-case GitHub owner/repository, not a course account. First read the block, then run it in the same Bash terminal as your local build.

read -r -p 'Your GitHub username: ' GHCR_USERNAME
read -r -p 'Your lower-case owner/repository: ' PROJECT_REPOSITORY
registry_image="ghcr.io/$PROJECT_REPOSITORY/delivery-api"
(
  set -euo pipefail
  set +x
  ghcr_endpoint="$(docker context inspect "$(docker context show)" --format '{{.Endpoints.docker.Host}}')"
  case "$ghcr_endpoint" in unix://*) ;; *) echo 'Stop: use the intended local Engine'; exit 1;; esac
  export DOCKER_HOST="$ghcr_endpoint"
  unset DOCKER_CONTEXT
  export DOCKER_CONFIG="$(mktemp -d)"
  trap 'unset ghcr_token; docker logout ghcr.io >/dev/null 2>&1 || true; rm -f -- "$DOCKER_CONFIG/config.json"; rmdir -- "$DOCKER_CONFIG"' EXIT
  read -r -s -p 'GHCR package-write token: ' ghcr_token
  printf '\n'
  printf '%s' "$ghcr_token" | docker login ghcr.io --username "$GHCR_USERNAME" --password-stdin
  unset ghcr_token
  docker tag "$local_image" "$registry_image:$release_sha"
  docker push "$registry_image:$release_sha" 2>&1 | tee evidence/TD02/push.txt
  docker pull "$registry_image:$release_sha"
  docker image inspect "$registry_image:$release_sha" --format '{{json .RepoDigests}}'
  read -r -p 'Paste your observed ghcr.io/...@sha256:... coordinate: ' digest_ref
  case "$digest_ref" in ghcr.io/*@sha256:*) ;; *) echo 'Expected your observed registry digest'; exit 1;; esac
  docker pull "$digest_ref" 2>&1 | tee evidence/TD02/pull-digest.txt
  printf 'DELIVERY_API_IMAGE=%s\n' "$digest_ref" > release.env
)

Package-write authentication must be yours and authorized for that namespace. The block keeps registry login in a temporary directory and does not expose the token. If it fails, preserve the redacted error; do not create release.env with a made-up digest. Next run your image by the observed digest and repeat the HTTP checks from Step 3. After the temporary login closes, a fresh private pull needs a new authorized login. Existing local images remain available for your test.

Step 5 — Check and hand off to TD3 · 30 minutes

Remove only your labelled temporary td02-api container. Keep the tested local image, actual build logs, HTTP results and digest evidence. Compare the image revision with the /version response and, if Step 4 succeeded, the digest-run response. Write the result and any BLOCKED gate in evidence/TD02/OBSERVATIONS.md. Commit the non-secret release.env only when it contains an actual registry digest. TD3 will attach this same API image to PostgreSQL.