Docker Publishing Guide

This document describes the recommended workflow for building, signing, and publishing EvoSpikeNet-Core Docker images across environments (development, staging, pre-prod, production).

Overview

Publishing strategy by security level (example):

development → staging → pre-production → production

Recommended flow: 1. Local development: build in source mode for rapid iteration 2. CI: matrix build and test all modes (source, wheel, cython, nuitka) 3. Staging verification: deploy wheel or cython images to staging 4. Production release: build nuitka image, sign and push to production registry 5. Deploy after signature verification

Prerequisites - Docker (20.10+), Docker Buildx, optional crane (image inspection), cosign (image signing)

Registry options - Azure Container Registry (ACR) - Docker Hub - GitHub Container Registry (GHCR) - Private on-prem registry

CI/CD example (summary) - Use a matrix job with mode: [source, wheel, cython, nuitka] - Use docker/build-push-action@v5 for build/push with --target determined by matrix - Use docker/metadata-action@v5 to generate image tags - Login via docker/login-action@v3 using the appropriate registry credentials

Image signing (optional) - Use cosign to generate key pair and sign images before pushing to production

Staging & production steps (examples) - Build with --build-arg APP_IMAGE_MODE=cython for staging, push to staging registry - For production, build with --build-arg APP_IMAGE_MODE=nuitka, sign with cosign, push to production registry, and verify signature with cosign verify prior to deployment

Kubernetes deployment notes - Use imagePullPolicy: Always for production to ensure latest image - Enforce securityContext (non-root user, seccomp) in pod specs

Local reproduction Use docker build commands or act to reproduce CI behavior locally; examples are provided in the original Japanese guide.

If desired, I can add a GitHub Actions workflow snippet for docker-publish.yml to this repo.