feat(image): PostgreSQL 17, SQLite and Redis in the session image

[jiashuoz]

What this is

A newly created session could not run an integration test: no PostgreSQL, no
SQLite, no Redis, and no way to get one after the fact — sudo is not
installed, the rootfs is read-only, and no package archive is on the egress
allowlist. This adds the client and the server halves of all three at build
time, with auditable versions.

Nothing starts. There is no service in the entrypoint, no cluster in any layer,
and no port bound until a developer runs a documented command. Both servers
bind loopback inside the session's own network namespace.

rainier-pg up                                    # initdb + pg_ctl start
createdb myapp_test
export RAINIER_TEST_DATABASE_URL="$(rainier-pg url myapp_test)"
rainier-redis start && rainier-redis ping        # PONG
sqlite3 app.db "select sqlite_version()"

initdb and pg_ctl are on PATH and the raw commands are documented; the
helpers are ergonomics, not a requirement.

Ownership

The image a hosted Dedicated session actually runs is this repository's root
Dockerfile — what rainier-cloud's runner-artifacts publishes as the plane's
session_image. So the change is here, at the source. rainier-cloud's
environments/default/ is the separate nine-harness local preview and is
untouched; no coding-agent integration is added or expanded. The matching
rainier-cloud PR (readiness check + runbooks) is
tokencanopy/rainier-cloud#66
and is only what this one makes mechanically necessary.

The decisions worth reviewing

PGDG, and what the pin covers. Debian bookworm ships PostgreSQL 15; the
cell is 17 and its store tests are written against it. No 17 for bookworm
avoids PGDG directly or transitively. A second apt archive is a real trust
decision, so it is pinned the strongest way an apt archive admits: the signing
key's full 40-hex fingerprint is an ARG a reviewer can read, and the
primary-key count is asserted first and separately — gpg --dearmor
converts every key in the file and signed-by= then trusts the whole keyring,
so a check that read only the first fingerprint would accept the genuine key
with somebody else's appended. Package versions resolve against a moving
archive exactly as Debian's do; rainier-apt-sources.txt records both
archives. The alternative — copying /usr/lib/postgresql/17 out of a
digest-pinned postgres:17-bookworm stage — pins harder but hand-carries
libpq5, ICU and the JIT libraries, with a missing one surfacing as a runtime
failure in somebody's test instead of a failed build.

Nothing runs, and nothing is baked in. create_main_cluster = false stops
postgresql-common running initdb at install time into a directory the
read-only rootfs could never use; a policy-rc.d refuses every
maintainer-script service start for the duration of the install. libpq5 and
libpq-dev are named explicitly with their major floored at the server's —
apt is as free to resolve the 15→17 upgrade by removing the -dev package as
by upgrading it, and PGDG ships one libpq for every major it carries, so an
archive that has released an 18 correctly hands this image an 18.x libpq beside
the 17 server.

Durable state on the volume, sockets off it. PGDATA and the Redis data
directory are under /workspace/.services, because that is the only writable
path that survives a suspend. The sockets and pidfiles are under
/tmp/rainier-services, because protocol/workspace.TarGz refuses a socket
rather than skipping it — one under /workspace fails rainier push/pull of
any tree containing it, and an unclean exit leaves it there to keep failing.

Three things about this runtime are not the defaults, and each is why the
helpers exist: PostgreSQL's compiled-in socket directory is on the read-only
rootfs; the image generates no locales, so an initdb inheriting an unset
LANG builds an SQL_ASCII database that mangles the first non-ASCII row a
test inserts; and pg_ctl -w stop polls kill(pid, 0), which cannot tell a
shut-down postmaster from an unreaped zombie — and postmaster.pid outlives
the container it was written in, so it is never taken as proof a server is
running.

TMPDIR is still not set. /tmp is a per-container noexec tmpfs and that
is where agent scratch belongs — not in a checkpoint, an archive, or rainier pull. Exactly one build temp moves off it, GOTMPDIR, because go test
executes what it builds. Setting TMPDIR globally would move Claude Code's and
Codex's scratch onto the volume that leaves the runner and quietly change the
sandbox each believes it has; a contract test now fails if it appears.

Size

Measured, not estimated, and it is the number the rollout gate approves:

Whole image	≈2.42 GB, 22 layers, linux/amd64
Services layer	14 packages, 244,512 KiB (≈239 MiB)

libllvm19 (126 MiB) and libz3-4 (23 MiB) are 61% of that, and they are
there because postgresql-17 hard-depends on LLVM for query JIT. The build
writes the full per-package breakdown to
/usr/local/share/rainier-services-size.txt, and the smoke reports it as a
workflow notice so the figure is on the run being approved. Removing the
149 MiB means building PostgreSQL from source without LLVM; docs/session-image.md
argues against that and this change does not do it.

Verification

Native linux/amd64, this PR's Session image qualification: build, the
deployed initializer against the candidate, and the whole functional smoke —
which now checks that a fresh session has nothing listening and no cluster in
the image, initdbs a cluster on the volume, starts it with pg_ctl, commits
one transaction and rolls another back, reconnects over the DSN rainier-pg url prints, asserts the listener is loopback and not 0.0.0.0, asserts no
socket appears anywhere under /workspace while both servers run, stops and
restarts with the data intact, round-trips SQLite from shell and Python, and
starts, PINGs, round-trips a key in and stops Redis. All as uid 1000,
read-only rootfs, noexec /tmp, no network at all.

make verify passes locally.

Ten new Go tests run the two helpers against stub binaries with no docker:
the locale and auth flags initdb gets, init refusing to overwrite and
start refusing without a cluster, stop asking for a non-blocking fast
shutdown and then waiting on the server's own pidfile, stop surviving a stale
pidfile and not signalling a pid that may have been reused, stop not
mistaking a server that is still rejecting connections for a stale one, the
start deadline, the exact DSN, and the durable/runtime split for both servers.
They are named TestSessionImage* so the qualification workflow's -run
selector actually runs them.

Two independent review passes were run and every finding fixed: the
single-key fingerprint hole, stop on a stale pidfile, unescaped annotation
titles, hardcoded 17 where POSTGRES_MAJOR is an ARG, an unused timeout
knob, sockets on the volume, helpers ignoring their documented roots, and a
services-size figure that undercounted by a factor of three.

The change was authored in a session with no Docker daemon; no local
container evidence exists and none is claimed. The Actions log host is also not
on that session's egress allowlist, which is why the smoke now emits failures
as workflow annotations — that turned out to be the only way to see why the
first build failed, and it is worth keeping.

Not in scope

No deployment, publication or merge. No MySQL, MongoDB, Kafka, Elasticsearch,
object-store stand-in or message broker; no PostgreSQL extension beyond
postgresql-17's own contrib set; no Docker-in-Docker, docker socket or
testcontainers substrate; no privileged container, added capability, broadened
sudo or weakened egress. docs/session-image.md lists what is deliberately
absent, including the 64 MiB /dev/shm a parallel query can exhaust, so
"not supported" and "nobody thought about it" stop looking identical from
inside a session.

🤖 Generated with Claude Code