doc(BA-7272): add docker/README.md for published images and container privileges - #13702
Open
kyujin-cho wants to merge 5 commits into
Open
doc(BA-7272): add docker/README.md for published images and container privileges#13702kyujin-cho wants to merge 5 commits into
kyujin-cho wants to merge 5 commits into
Conversation
…hare location per review
kyujin-cho
force-pushed
the
docs/BA-7272/docker-readme-v2
branch
from
August 11, 2026 13:47
a31b49c to
6e477cf
Compare
13597.doc.md -> 13702.doc.md 13700.feature.md -> 13702.feature.md 13596.misc.md -> 13702.misc.md Co-authored-by: octodog <mu001@lablup.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Documents published Backend.AI container images and operator deployment requirements.
Changes:
- Adds image and tagging references.
- Documents privileges, path parity, and cgroup requirements.
- Provides a manager/agent Compose fragment.
Reviewed changes
Copilot reviewed 2 out of 4 changed files in this pull request and generated 6 comments.
| File | Description |
|---|---|
docker/README.md |
Adds Docker deployment documentation. |
changes/13597.doc.md |
Adds the documentation changelog entry. |
Suppressed comments (1)
docker/README.md:149
- This repeats the incorrect local-registry-only condition. A manager configured for Docker overlay networks also needs this mount, otherwise the overlay plugin cannot reach the host daemon and multi-node session networking is unavailable.
- /var/run/docker.sock:/var/run/docker.sock # only when the `local` container registry is used
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| |---|---|---| | ||
| | halfstack services (PostgreSQL, Valkey/Redis, etcd) | all | the reference definitions live in `docker-compose.halfstack-main.yml` | | ||
| | `supergraph.graphql` + a GraphQL gateway (e.g. `ghcr.io/graphql-hive/gateway`) | GraphQL federation | the supergraph schema is generated per release (`scripts/generate-graphql-schema.sh`); the gateway composes manager subgraphs | | ||
| | RPC auth key distribution | manager, agent | the agent needs the manager's RPC **public** key to authenticate RPC calls — e.g. share the parity-mounted fixtures directory across nodes, or mount a common key directory at `/etc/backend.ai/keys:ro` | |
| | halfstack services (PostgreSQL, Valkey/Redis, etcd) | all | the reference definitions live in `docker-compose.halfstack-main.yml` | | ||
| | `supergraph.graphql` + a GraphQL gateway (e.g. `ghcr.io/graphql-hive/gateway`) | GraphQL federation | the supergraph schema is generated per release (`scripts/generate-graphql-schema.sh`); the gateway composes manager subgraphs | | ||
| | RPC auth key distribution | manager, agent | the agent needs the manager's RPC **public** key to authenticate RPC calls — e.g. share the parity-mounted fixtures directory across nodes, or mount a common key directory at `/etc/backend.ai/keys:ro` | | ||
| | `wheelhouse/` mount at `/app/wheelhouse` (optional) | manager, agent | an operator convention only — nothing in the images consumes it automatically; to add extra plugin wheels (e.g. accelerator plugins), the operator must `docker exec <container> pip install /app/wheelhouse/*.whl` or build a derived image | |
Comment on lines
+81
to
+82
| | `network_mode: host` | optional | ✅ | Agent: kernel↔agent ZMQ/service ports and agent RPC are advertised on host addresses; kernels spawned on the host network must reach them. Manager: convenience only — the bridge alternative works via the `announce-addr` / `announce-internal-addr` knobs | | ||
| | `privileged: true` | — | ✅ | Agent: container/device management against the host daemon; sysfs reads for metrics. The manager does not need it — the Docker socket alone suffices for its (conditional) Docker use | |
| |---|---|---|---| | ||
| | `network_mode: host` | optional | ✅ | Agent: kernel↔agent ZMQ/service ports and agent RPC are advertised on host addresses; kernels spawned on the host network must reach them. Manager: convenience only — the bridge alternative works via the `announce-addr` / `announce-internal-addr` knobs | | ||
| | `privileged: true` | — | ✅ | Agent: container/device management against the host daemon; sysfs reads for metrics. The manager does not need it — the Docker socket alone suffices for its (conditional) Docker use | | ||
| | `/var/run/docker.sock` bind mount | conditional | ✅ | DooD: containers are created by talking to the **host** Docker daemon. Manager: only when the `local` container registry is used | |
Comment on lines
+139
to
+140
| reference for the two elevated services, verified against a live deployment. | ||
| Replace `<version>` with a tag from the tagging scheme above. The `cgroup:` |
Comment on lines
+136
to
+139
| `docker-compose.monorepo.yml` at the repository root is a **partial, legacy | ||
| example** — it uses different image names, includes no agent or storage-proxy, | ||
| and runs on a bridge network. The fragment below is the authoritative | ||
| reference for the two elevated services, verified against a live deployment. |
fregataa
approved these changes
Aug 11, 2026
fregataa
approved these changes
Aug 11, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Replaces #13597.
Resolves BA-7272
Resolves #13591