Runtime Contents

A RuntimeContent defines something a Runtime Environment can bring into a runtime: a Git repository, a subpath of the platform shared filesystem (nfs), or an S3 bucket. It is defined once, by an administrator, and it is the Environment's content — the same for everyone who launches it. What an account attaches to its own sandbox is a Contents source instead; see Contents attachments.

Short names: rtc, rc, rcs. The complete specification is available here.

Runtime Contents Specification

Every content carries a spec.uid — a ULID assigned once, when the content is defined. Runtime Environments select contents by that uid, never by name, so a content can be renamed or re-described without every Environment that uses it silently pointing elsewhere.

Field	Meaning
`uid`	The identity Environments select by. Required.
`type`	`git`, `nfs` or `s3`.
`description`	What it is, for a person reading the catalog.
`source`	The repository URI (`git`) or the bucket name (`s3`).
`subPath`	The subpath of the shared filesystem (`nfs`).
`revision`	The commit sha a `git` content is checked out at. A git content without a revision is refused at launch: a tutorial that changes under a user is not the tutorial they were promised.
`sha256`	Optional. The digest of `git archive --format=tar <revision>`; when set, the checkout is verified and the runtime pod fails to start on a mismatch.
`permissions`	The content's own access, `ro` (default) or `rw`. An Environment's selection can narrow it, never widen it.
`secret`	The Kubernetes Secret holding credentials for the content. For `s3`, the bucket credentials. For a private `git` repository, a `password` key (a token or password) and an optional `username` key (default `x-access-token`, GitHub's token user); the checkout authenticates over HTTPS through a git credential helper, so the token never reaches a command line or a file. A named secret whose `password` key is missing fails the pod rather than checking out nothing. A public repository needs no secret.

What the Operator does with a content at launch — resolving the uid, checking out the revision, mounting it or handing it to the Node Mount Gateway — is on the Operator page. Which contents can be delivered to which sandbox provider, and what a launch is refused for, is Environment Contents.

Apply the platform definitions

The platform's own definitions live in the Services repository under plane/etc/specs/runtime-contents/ (one file per content, each with its uid). They are applied with kubectl; no Plane command applies them, and redeploying the Operator (plane reup datalayer-operator) leaves them as they are — after an upgrade of the Operator that changed the specification, re-apply them:

kubectl apply -n datalayer-runtimes -f plane/etc/specs/runtime-contents/
kubectl get runtime-contents -n datalayer-runtimes -o custom-columns=NAME:.metadata.name,UID:.spec.uid,TYPE:.spec.type,REVISION:.spec.revision

Every row must show a UID; a content without one cannot be selected by any Environment, and the Operator logs RuntimeContent '<name>' has no spec.uid.

Manage the Contents

kubectl get runtime-contents.datalayer.io -A
kubectl get runtime-contents.datalayer.io -o yaml -A

AWS S3 Example

In this example, the authentication must be stored in the s3-secret secret providing the following key.

access_key_id
secret_access_key
region

cat <<EOF | kubectl apply -f -
apiVersion: datalayer.io/v1
kind: RuntimeContent
metadata:
  name: s3-satellite-sentinels-images-content
  namespace: datalayer-runtimes
spec:
  uid: 01M0YX0MXYH92ETBXWPH7A8205
  description: Satellite images from Sentinels mission.
  type: s3
  source: datalayer-dev
  permissions: ro
  secret: s3-secret
EOF

kubectl get runtime-contents.datalayer.io -A
kubectl get runtime-contents.datalayer.io -o yaml -A

Git Repository Example

In this example, the Git repository must be public.

cat <<EOF | kubectl apply -f -
apiVersion: datalayer.io/v1
kind: RuntimeContent
metadata:
  name: jakevdp-sklearn-tutorial-content
  namespace: datalayer-runtimes
spec:
  uid: 01M0YX0MXYRP0Q29YWYRE5THZE
  description: Jake VanderPlas scikit-learn tutorial
  type: git
  source: https://github.com/jakevdp/sklearn_tutorial.git
  revision: 5098cee2a638c56c311aca0c18987e407fe127fd
EOF

A new uid is minted with python -c "import ulid; print(ulid.new())" (or any ULID generator); the revision is git ls-remote <repository> HEAD at the moment you pin it.

Shared Filesystem Example

An nfs content is a subpath of the platform shared filesystem, so it needs no secret and no revision:

cat <<EOF | kubectl apply -f -
apiVersion: datalayer.io/v1
kind: RuntimeContent
metadata:
  name: nfs-models-oss-content
  namespace: datalayer-runtimes
spec:
  uid: 01M0YX0MXYD8YZVMJW016KTB4M
  type: nfs
  description: NFS content from AI Models.
  subPath: ai-models
  permissions: ro
EOF

It is delivered in the cluster only: an external sandbox provider cannot reach the platform filesystem, and a launch there of an Environment selecting one is refused.