Skip to content

1.2. Containers

Why package an agent as a container?

The Ops Copilot includes Python, native dependencies, an A2A server, and seed data. An OCI image turns those inputs into one immutable artifact for local k3d and GKE. Runtime state, credentials, and telemetry remain outside the image.

Which container engine should you use?

The validated course commands use the open-source Docker CLI, Docker Engine API, and Compose specification. Open-source runtime choices include:

Docker Desktop can also run the commands but is a proprietary product with its own license terms. It is optional, not part of the OSS stack claim. The Chapter 5 gateway:host* wrapper currently invokes docker directly. Podman users may adapt the transparent wrapper, but that is not the validated learner path until the same smoke tests run against it.

How do you verify the engine?

docker version
docker info
docker run --rm hello-world
docker compose version

The client, daemon/VM, pull, run, and Compose plugin must all respond. Do not continue with a client-only installation that cannot reach an engine.

What is inside the agent image?

agents/python/Dockerfile uses a multi-stage build and runs as UID/GID 10001 on a minimal Wolfi runtime with an exact Python 3.13 package. The final image contains the locked application environment plus the immutable agents/data seed. It starts python -m agent.server and listens for A2A on port 8080.

It does not include provider keys, writable development state, MLflow, evaluation dependencies, or an Ollama model. Kubernetes supplies endpoint configuration and writable storage at runtime.

Why is the build context agents/?

The Dockerfile lives under agents/python, but it needs both python/ and sibling data/. Skaffold therefore builds with agents/ as the context:

docker build -f agents/python/Dockerfile -t ops-copilot:dev agents

Chapter 6 uses Skaffold and a local registry so the same image reference can be consumed by k3d.

What is the container checkpoint?

mise run doctor:gateway

Continue when the gateway doctor can reach the Docker engine. Do not build the agent image during initial setup; Chapter 6 validates the non-root image, local registry, and Kubernetes deployment together.