Docker image reference#

One server image is published to ghcr.io/jezdez/conda-presto for linux/amd64 and linux/arm64. The root Dockerfile is the canonical recipe. The image runs as UID and GID 10001 from /app and starts conda presto --serve --host 0.0.0.0 on port 8000.

Tags and publication#

Tag	Selection
`latest`	Latest released server image
`<version>`	Immutable exact release
`<major>.<minor>`	Mutable minor-line alias
`<short-git-sha>`	Immutable source revision

Major-zero releases do not publish a 0 alias. Publication refuses to overwrite an exact release or source revision tag. The release workflow dispatches the image build from the released tag and uses the protected ghcr environment. Pin a manifest digest when reproducibility must be independent of tag policy.

Image verification#

BuildKit publishes maximum-mode provenance and an SPDX SBOM for each image manifest. A separate job creates a GitHub artifact attestation after the registry returns the pushed digest. For an existing release:

gh attestation verify \
  oci://ghcr.io/jezdez/conda-presto:0.8.0 \
  --repo jezdez/conda-presto \
  --signer-workflow jezdez/conda-presto/.github/workflows/docker.yml

CI builds and scans the server on amd64 and arm64 before publication. Trivy blocks fixed high and critical findings, subject to narrow expiring exceptions. Full reports are uploaded as trivy-server-amd64 and trivy-server-arm64. Trivy does not provide a complete vulnerability inventory for conda packages.

Build and runtime base images are pinned by digest. The recipe applies the Debian PCRE2 security update, removes setuid and setgid permissions, and keeps application source and the environment outside its package cache read-only for the runtime user.

Worker and health check#

The image sets CONDA_PRESTO_PERSISTENT_WORKER=1 and CONDA_PRESTO_CONCURRENCY=1. It applies CONDA_NO_LOCK=false after Pixi activation so workers sharing the package cache retain conda filesystem locking. A failed worker is replaced by the server.

The built-in health check requests /health on CONDA_PRESTO_PORT, defaulting to 8000. It runs every 30 seconds with a 5-second timeout, 120-second startup period and three retries. It reports failure while the persistent worker is unavailable. Deployments that require another port, including a Space on port 7860, can set CONDA_PRESTO_PORT=7860 while using the same recipe.

Build configuration#

docker build --build-arg CONDA_PRESTO_VERSION=0.9.0.dev0 \
  --tag conda-presto:dev .

The image uses the locked prod environment and includes conda-sboms and conda-sigstore for SBOM generation, signing and verification. Signing remains disabled until explicitly enabled with an operator identity and trust configuration. See Configuration for the requirements.

The default image includes the Redis client. Cache settings are described in Cache reference. See Run conda-presto with Docker for operation.