Job manifest

Minimal example

apiVersion: odysseus/v1
kind: Job
metadata:
  name: api-migrate
spec:
  image: registry.delta-telematics.ca/acme/api:1.4.2
  command: ["/app/migrate", "up"]
  networks: [acme-network]
  restartPolicy: "no"          # quoted — bare no is YAML false
  backoffLimit: 2
  activeDeadlineSeconds: 600
  ttlAfterFinished: 1h
  secrets:
    - name: DB
      vaultPath: deployments/api/db

Validated against JobManifest · testdata/docs-examples/migration-job.yaml

Job spec

Generated from JobSpec. Hand edits to this table are overwritten on the next build — change the Go doc comment, or the generator.

Field	Type	Required	Default	Mutability	Since
activeDeadlineSeconds	integer	no	—	in-place	0.7.6
backoffLimit	integer	no	—	in-place	0.7.6
command	string[]	no	—	recreate	0.7.6
entrypoint	string[]	no	—	recreate	0.7.6
environment	object	no	—	recreate	0.7.6
healthCheck	HealthCheckSpec	no	—	recreate	0.7.6
image	string	no	—	recreate	0.7.6
init	boolean	no	—	recreate	0.21.1
networks	string[]	no	—	recreate	0.7.6
placement	PlacementSpec	no	—	recreate	0.7.6
resources	ResourceSpec	no	—	recreate	0.7.6
restartPolicy	string	no	—	recreate	0.7.6
secrets	SecretSpec[]	no	—	recreate	0.7.6
ttlAfterFinished	string	no	—	in-place	0.7.6
ulimits	Ulimit[]	no	—	recreate	0.21.1
volumes	VolumeSpec[]	no	—	recreate	0.7.6
workingDir	string	no	—	recreate	0.7.6

activeDeadlineSeconds: 0 = no deadline

backoffLimit: nil → 3 (JD6)

command: what to run (empty = image default)

entrypoint: override ENTRYPOINT

environment: Environment are plain environment variables set on every container. Never put a credential here — use secrets:, which resolves from Vault at dispatch and never stores the value.

healthCheck: HealthCheck is the container probe. Only type: exec produces a real healthcheck; an http or tcp declaration is refused rather than left inert.

image: Image is the fully-qualified container image reference, including an explicit tag. Never “:latest” in production: an unpinned tag makes a rollback impossible to describe.

init: Init runs Docker’s tiny init as PID 1 so orphaned processes are reaped. Omit it to take the platform default, which is on; set false only for an image that already runs its own init.

networks: Networks are the Docker networks the container joins. Names are tenant-prefixed for you; a backend should stay off traefik-public.

placement: SP-4; shared: Jobs place too

resources: Resources are the CPU and memory limits and requests, written as limits/requests rather than as four flat keys.

restartPolicy: law: must be “no”

secrets: Secrets are references to material in Vault, injected as environment variables at dispatch. The value never appears in this document.

ttlAfterFinished: duration; “” = keep

ulimits: Ulimits are the container’s POSIX resource limits. A per-container ulimit overrides the daemon’s defaults, which is the supported way to raise a file-descriptor ceiling — never a hand-edited daemon.json.

volumes: Volumes are the named volumes and bind mounts attached to each container.

workingDir: working directory