Environments
The images workloads run on — register a digest-pinned image, or build a content-addressed one from an install spec.
postBuild Environment
Builds a content-addressed image from an install spec on the shared BuildKit and registers it, streaming build log frames and ending with either the new Environment or a build failure. install.base_image or stages is required, every stage needs a base_image, and apt package names must be plain tokens (InvalidArgument). Base images given as tags are pinned to digests first. A context_snapshot_id builds over that workspace snapshot. shared_cache dedupes identical specs across namespaces. Unimplemented without a build backend. **Access:** namespace OPERATOR or above (write)
postDelete Environment
Deletes an Environment record. **Access:** namespace OPERATOR or above (write)
postGet Environment
Returns one Environment. NotFound for an unknown id. **Access:** namespace VIEWER or above (read)
postList Environments
Lists Environments, newest first. page_size defaults to 100 and is clamped to 1000. **Access:** namespace VIEWER or above (read). `namespace` is required unless the caller is a platform admin, for whom empty covers every namespace.
postPin Environment
Sets or clears an Environment's pinned flag, which protects it from garbage collection. **Access:** namespace OPERATOR or above (write)
postRegister Static Environment
Registers an already-built image as a new Environment (every call mints a new id, even for the same image). A tagged image is resolved to its digest once, here; InvalidArgument when it cannot be resolved or tag resolution is not configured. runtime UNSPECIFIED is stored as GVISOR; run_as_root on RUNC is rejected. The image's own entrypoint is recorded best-effort. **Access:** namespace OPERATOR or above (write)
Update Egress Policy POST
Renames and/or replaces a named policy. An empty name or unset policy leaves that part unchanged. **Access:** namespace OPERATOR or above (write)
Build Environment POST
Builds a content-addressed image from an install spec on the shared BuildKit and registers it, streaming build log frames and ending with either the new Environment or a build failure. install.base_image or stages is required, every stage needs a base_image, and apt package names must be plain tokens (InvalidArgument). Base images given as tags are pinned to digests first. A context_snapshot_id builds over that workspace snapshot. shared_cache dedupes identical specs across namespaces. Unimplemented without a build backend. **Access:** namespace OPERATOR or above (write)