Containers and configuration without surprises
A container is reproducible only when its image, inputs, configuration, and outputs all have explicit identities.
A churn notebook cannot be reproduced by the teammate expected to ship it.
This chapter moves from pin the runtime to record resolved values. We will make the idea concrete in a small code example before placing it back inside a production system with a declared latency, cost, and operator-capacity budget.
Validate configuration types and ranges, redact secrets, then write the complete effective configuration into the manifest.
Verify the behavior illustrated in reproduce.sh, then measure decision utility, slice reliability, and system latency.
A mutable data/latest path and unpinned dependencies create a different model from the same command. An unsafe release must degrade to a named baseline or the last known-good version.
Build the idea one layer at a time.
A container freezes the runtime, but it does not freeze mutable data, hidden defaults, or a tag that later points somewhere else.
Reproducible containers are selected by immutable image digest and receive all run choices through validated configuration. The image supplies software; mounted inputs supply data; neither should be silently rewritten during training.
A single resolved configuration should be logged after defaults and overrides are applied. Without that snapshot, an operator can know which YAML file was passed yet still not know the values the program actually used.
- run manifests
- schema contracts
- golden inference
- idempotency
Follow the reasoning before touching the code.
- 01
Pin the runtime
Run an OCI image by digest so the same reference cannot resolve to new operating-system or library bits.
- 02
Mount immutable inputs
Expose data and configuration read-only, and give outputs a separate run-scoped writable location.
- 03
Record resolved values
Validate configuration types and ranges, redact secrets, then write the complete effective configuration into the manifest.
set -euo pipefail
IMAGE='ghcr.io/acme/trainer@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'
DATA='snapshots/churn-2026-08.parquet'
CONFIG='configs/baseline.yaml'
test -r "$DATA"
test -r "$CONFIG"
mkdir -p outputs/run-017
docker run --rm --read-only -v "$PWD/$DATA:/input/data.parquet:ro" -v "$PWD/$CONFIG:/input/config.yaml:ro" -v "$PWD/outputs/run-017:/output" "$IMAGE" train --config /input/config.yamlLaunch a pinned trainer with read-only declared inputs.
What to notice
- The digest identifies image content; a friendly tag such as latest would not.
- Read-only mounts make accidental mutation fail immediately instead of corrupting the evidence for later replays.
YOUR TURN Pause and predict before revealing the answer.
Which value in this launcher still prevents two simultaneous invocations from being safely independent?
Need a hint?
Look for a destination chosen by a human rather than derived from run identity.
Check your reasoning
The fixed outputs/run-017 path can collide; derive a unique run-scoped path from the manifest ID and publish atomically.
Lessons 1, 2, 3 in this course.
Connect the chapter to the course’s quantitative spine.
A container is reproducible only when its image, inputs, configuration, and outputs all have explicit identities. The content-addressed run identity below is the shared course-level lens that helps quantify the surrounding system. Name each symbol, check its units or shape, and use only values that were available at the production cutoff.
Content-addressed run identity
| Symbol | Meaning / shape / unit |
|---|---|
code | source revision digest |
data | immutable dataset digest |
image | OCI image digest |
seed | declared random seed |
Open derivation and numerical substitution
Start from the production quantity being optimized, substitute the observed values with their declared units, then isolate the model-controlled term. Preserve shape annotations at each step so broadcasting or aggregation cannot silently change the result.
- Write the named inputs: code, data, image, seed.
- Substitute one small, hand-checkable batch before vectorizing.
- Calculate an independent reference value and compare within a declared tolerance.
# equation → code contract
inputs = validate_shapes_and_units(batch)
value = compute_c01(inputs)
assert is_finite(value)Change one assumption and make the tradeoff visible.
Use the worked chapter as your prediction, then change one input in the lab and explain why the output moves. The lab runs predefined TypeScript and never executes learner code, so the focus stays on the concept rather than setup.
Reproducibility fault injector
Change how many declared inputs remain mutable and observe replay parity.
Assumption: Each mutable input independently creates a 14-point replay risk.
Open nonvisual data table
| Item | Computed state | Interpretation |
|---|---|---|
| input 1 | mutable | replay risk |
| input 2 | mutable | replay risk |
| input 3 | content-addressed | verified |
| input 4 | content-addressed | verified |
| input 5 | content-addressed | verified |
Trace the complete operating path.
Carry the chapter’s central idea into the system: A container is reproducible only when its image, inputs, configuration, and outputs all have explicit identities. The path below shows where that reasoning needs an artifact, a test, an owner, or a fallback.
- 01
Turn “Pin the runtime” into a written invariant and a failing test.
- 02
Promote reproduce.sh from illustration to a versioned implementation with representative fixtures.
- 03
Use “Record resolved values” as the release checkpoint: Validate configuration types and ranges, redact secrets, then write the complete effective configuration into the manifest.
- 04
Serve or materialize behind explicit a declared latency, cost, and operator-capacity budget.
- 05
Join telemetry to mature outcomes and retain a rollback path.
Observability
Join service health, input quality, prediction distributions, slice behavior, and mature outcomes by exact version.
Cost
Measure storage, preprocessing, compute, queueing, and human review under a representative arrival pattern.
Failure modes
A mutable data/latest path and unpinned dependencies create a different model from the same command. Add a detector, owner, mitigation, and stop condition for this class of failure.
Alternatives
Compare a rule, a simpler statistical baseline, and a different system boundary before adding model complexity.
Explain the contract, not just the vocabulary.
Reproducible baseline package
Design a Docker-only workflow that validates data, trains, evaluates, serializes, performs golden inference, and emits complete lineage.
- Run manifest and data contract
- Raw-input golden parity test
- Failure and retry runbook
- Model card with residual nondeterminism
Read primary material with a purpose.
Return to the opening failure.
Reject promotion when any artifact lacks lineage, golden raw-request parity, or a failure-safe recovery path.
For this lesson, the release evidence is the worked code example, a hand-checked formal result, deterministic simulation output, a ≥80% checkpoint, the production rubric, and a named fallback. The course resolves when the system can produce a seeded, tested, packaged, versioned training workflow with a model card.