init

A one-shot container for an Arkitekt deployment. It creates the buckets, users and policy attachments the services expect in a RustFS object store, then exits. It is not a server: run it once after RustFS is up and before the services start.

Everything it does, it does through the RustFS client rc, which is bundled in the image.

Usage

rustfs:
  image: rustfs/rustfs:latest
  environment:
    RUSTFS_ACCESS_KEY: root
    RUSTFS_SECRET_KEY: changeme
    RUSTFS_VOLUMES: /data
    RUSTFS_ADDRESS: ":9000"
init:
  image: jhnnsrs/init
  depends_on:
    rustfs:
      condition: service_started
  environment:
    RUSTFS_HOST: http://rustfs:9000
    RUSTFS_ACCESS_KEY: root
    RUSTFS_SECRET_KEY: changeme
  volumes:
    - ./rustfs.yaml:/workspace/config.yaml

Variable	Required	What it is
RUSTFS_HOST	yes	The RustFS endpoint, e.g. http://rustfs:9000
RUSTFS_ACCESS_KEY	yes	RustFS's root access key
RUSTFS_SECRET_KEY	yes	RustFS's root secret key
CONFIG_PATH	no	Path of the config file (default ./config.yaml, i.e. /workspace/config.yaml)
LOG_LEVEL	no	DEBUG also logs the output of successful rc commands (default INFO)

If a required variable is missing, the container names it and exits 1.

Configuration

The config file lists what to create. Both keys are required; either list may be empty.

buckets:
  - name: media
  - name: zarr

users:
  - name: mikro            # a label, used in the logs only
    access_key: mikro
    secret_key: changeme
    policies:
      - readwrite

For each bucket it runs rc bucket create -p. For each user it runs rc admin user add, then rc admin policy attach <policy> --user <access_key> for each policy.

What to expect

• It fails loudly. Each rc command is logged before it runs, with secrets masked. A non-zero exit is logged with its output and aborts the container with status 1.
• It does not wait for RustFS. depends_on: service_started only waits for the RustFS container to start, not to serve, so the init container can lose that race and exit before provisioning anything. Give RustFS a health check and depend on service_healthy, or wait for RustFS's /health and run the container again.
• A wrong-architecture rc shows up first. The host platform and rc --version are logged on startup, so an "exec format error" is the first line, not a later mystery.

Image

jhnnsrs/init, for linux/amd64 and linux/arm64. rc is downloaded per architecture at build time, at a pinned release, and checked against a recorded sha256; the Python dependencies in requirements.txt are pinned exactly.

Releases are tags: a push to main cuts a stable version, a push to next a release candidate. Each one publishes the image under its version (X.Y.Z, X.Y, X), plus latest from main and next from next. Release notes are on GitHub Releases.

To build locally:

docker build -t init:local .