DevOps · Cluster
Build Pipelines
Artifacts, caching, and reproducibility.
- 01 Content-Addressed Artifact Identity and the Cost of Mutable Tags Why a digest derived from bytes is the only stable name for a build output, how Merkle chunking makes large artifacts hashable, and what a mutable tag hides between resolution and pull.
- 02 What a Build Cache Key Must Cover Under-keying produces wrong artifacts that look valid; over-keying destroys the hit rate. How to enumerate the true inputs of a build action, and where the environment leaks in.
- 03 Sources of Nondeterminism in Build Output Timestamps, absolute paths, directory iteration order, and parallelism leak into object files and archives. How each is detected by repeated builds and removed at the source.
- 04 Layer Cache Invalidation in Container Image Builds Why an instruction invalidates every layer after it, how the builder decides an instruction changed, and the ordering tricks that keep the expensive steps cached.
- 05 Passing Build State Between Jobs Without a Shared Workspace Artifacts move through object storage, not a shared directory. How upload, transfer, and extraction fail, and how a digest manifest makes a consumer verify what it received.
- 06 Trust Boundaries in Shared Build Caches A cache entry written by an untrusted build is an input to a trusted one. How key collisions become code execution, why content addressing does not help, and how namespaces separate the two.
- 07 Scheduling a Job Graph Around Its Critical Path The longest path through the dependency graph bounds pipeline latency regardless of machine count, and the cost of fan-out decides whether widening the graph helps at all.
- 08 Shared Build Cache Design: Action Keys, Content Store, and Eviction Why a build cache is two stores with different lifetimes, how write-once content addressing enables deduplication, and which eviction and failure policies keep a cache outage harmless.
- 09 Artifact Provenance from Commit to Deployed Digest Signed attestations bind an artifact digest to the materials and builder that produced it. What the statement must contain, how it is verified, and which attacks it does not stop.
- 10 Rebuilding a Pinned Artifact Without Its Original Environment Keeping the recipe instead of the bytes only works if the toolchain, dependencies, and clock can be reconstructed. What a pinned environment has to name and what cannot be rebuilt at all.