| CI builds the image, Modal serves it 5693bd5 nandi 10h ago | 1 | # `web` |
| 2 | |
| 3 | FRQ_WEB_IMAGE=registry.gitlab.com/<ns>/frq/web:<sha> \ |
| 4 | modal deploy .modal/web/container.py |
| 5 | |
| 6 | Defined by `container.toml`; `../_loader.py` is what reads it, and |
| 7 | its comments are the spec. |
| 8 | |
| 9 | Unlike `dev`, this container builds nothing. CI builds the image -- |
| 10 | `Dockerfile` here, two stages, the second one just the bundle and a |
| 11 | python -- and pushes it to the GitLab registry; this deploys that |
| 12 | exact tag. So the thing served is the thing that was built and |
| 13 | tested, and a deploy is a pull rather than a compile. |
| 14 | |
| 15 | `runtime = "web"`: a Function whose [run] command listens on the one |
| 16 | [network] port, fronted by a stable https URL. `modal deploy` leaves |
| 17 | it up, and deploying again replaces it in place because the app is |
| 18 | named by `[container] name`. |
| 19 | |
| 20 | Two credentials live outside the repo: |
| 21 | |
| 22 | * `MODAL_TOKEN_ID` / `MODAL_TOKEN_SECRET`, as protected CI variables. |
| 23 | * A Modal Secret named `gitlab-registry`, holding `REGISTRY_USERNAME` |
| 24 | and `REGISTRY_PASSWORD` -- a GitLab deploy token with |
| 25 | `read_registry`. Modal pulls the private image on every cold start, |
| 26 | not once at deploy time, so this has to be Modal's to keep. |