Rename prod containers to *-prod rather than *-latest

Author: luhenry

.github/workflows/deploy-runner.yml

@@ -272,19 +272,19 @@ jobs:
       - name: Tag ubuntu-24.04 image for prod
         run: >-
           docker buildx imagetools create \
-            -t ${{ needs.setup.outputs.docker-registry }}/riscv-runner:ubuntu-24.04-latest \
+            -t ${{ needs.setup.outputs.docker-registry }}/riscv-runner:ubuntu-24.04-prod \
             ${{ needs.setup.outputs.docker-registry }}/riscv-runner:ubuntu-24.04-sha-${{ github.sha }}
 
       - name: Tag ubuntu-26.04 image for prod
         run: >-
           docker buildx imagetools create \
-            -t ${{ needs.setup.outputs.docker-registry }}/riscv-runner:ubuntu-26.04-latest \
+            -t ${{ needs.setup.outputs.docker-registry }}/riscv-runner:ubuntu-26.04-prod \
             ${{ needs.setup.outputs.docker-registry }}/riscv-runner:ubuntu-26.04-sha-${{ github.sha }}
 
       - name: Tag device-plugin image for prod
         run: >-
           docker buildx imagetools create \
-            -t ${{ needs.setup.outputs.docker-registry }}/riscv-runner:device-plugin-latest \
+            -t ${{ needs.setup.outputs.docker-registry }}/riscv-runner:device-plugin-prod \
             ${{ needs.setup.outputs.docker-registry }}/riscv-runner:device-plugin-sha-${{ github.sha }}
 
       - name: Set up kubeconfig
@@ -295,7 +295,7 @@ jobs:
 
       - name: Apply device-plugin DaemonSet
         env:
-          TAG: latest
+          TAG: prod
         run: |
           envsubst < runner/device-plugin/k8s-ds-device-plugin.yaml | kubectl apply -f -
           kubectl rollout restart daemonset/rise-riscv-runner-device-plugin -n kube-system

control-plane/README.md

@@ -65,7 +65,7 @@ The `Dockerfile` produces two binaries on top of `gcr.io/distroless/base-debian1
 
 | Variable | Required | Purpose |
 |---|:-:|---|
-| `PROD` | yes | `true` selects the `prod` schema and `*-latest` image tags; otherwise `staging`/`*-staging` |
+| `PROD` | yes | `true` selects the `prod` schema and `*-prod` image tags; otherwise `staging`/`*-staging` |
 | `PROD_URL`, `STAGING_URL` | yes (ghfe) | URLs of the prod/staging ghfe; used by the staging proxy |
 | `POSTGRES_URL` | yes | `postgresql://...?sslmode=require` |
 | `K8S_KUBECONFIG` | yes (scheduler) | Kubeconfig as a string |

control-plane/internal/constants.go

@@ -129,8 +129,8 @@ func LoadConfig(getenv func(string) string) (Config, error) {
 		cfg.PostgresSchema = "prod"
 		cfg.RunnerGroup = "RISE RISC-V Runners"
 		cfg.RunnerPrefix = "rise-riscv-runner-"
-		cfg.ImageUbuntu24 = fmt.Sprintf("%s/%s:ubuntu-24.04-latest", RunnerRegistry, RunnerImage)
-		cfg.ImageUbuntu26 = fmt.Sprintf("%s/%s:ubuntu-26.04-latest", RunnerRegistry, RunnerImage)
+		cfg.ImageUbuntu24 = fmt.Sprintf("%s/%s:ubuntu-24.04-prod", RunnerRegistry, RunnerImage)
+		cfg.ImageUbuntu26 = fmt.Sprintf("%s/%s:ubuntu-26.04-prod", RunnerRegistry, RunnerImage)
 	} else {
 		cfg.PostgresSchema = "staging"
 		cfg.RunnerGroup = "RISE RISC-V Runners (staging)"

control-plane/internal/constants_test.go

@@ -39,10 +39,10 @@ func TestLoadConfig_AllRequiredPresentProd(t *testing.T) {
 	if cfg.RunnerPrefix != "rise-riscv-runner-" {
 		t.Errorf("runner prefix: %q", cfg.RunnerPrefix)
 	}
-	if !strings.Contains(cfg.ImageUbuntu24, "ubuntu-24.04-latest") {
+	if !strings.Contains(cfg.ImageUbuntu24, "ubuntu-24.04-prod") {
 		t.Errorf("image24: %q", cfg.ImageUbuntu24)
 	}
-	if !strings.Contains(cfg.ImageUbuntu26, "ubuntu-26.04-latest") {
+	if !strings.Contains(cfg.ImageUbuntu26, "ubuntu-26.04-prod") {
 		t.Errorf("image26: %q", cfg.ImageUbuntu26)
 	}
 	if cfg.LogLevel != "DEBUG" {

website/docs/architecture/ghfe.md

@@ -56,8 +56,8 @@ Unhandled `X-GitHub-Event` headers are recorded with `outcome=unhandled_event` a
 
 | Scope | Label | Pool | Image |
 |---|---|---|---|
-| Default | `ubuntu-24.04-riscv` | `scw-em-rv1` | `riscv-runner:ubuntu-24.04-latest` (or `-staging`) |
-| GGML scope: `ggml-org/*`, `riseproject-dev/llama.cpp`, `riseproject-dev/llama.cpp-validation` | `ubuntu-24.04-riscv` | `cloudv10x-jupiter` | `riscv-runner:ubuntu-24.04-latest` (or `-staging`) |
+| Default | `ubuntu-24.04-riscv` | `scw-em-rv1` | `riscv-runner:ubuntu-24.04-prod` (or `-staging`) |
+| GGML scope: `ggml-org/*`, `riseproject-dev/llama.cpp`, `riseproject-dev/llama.cpp-validation` | `ubuntu-24.04-riscv` | `cloudv10x-jupiter` | `riscv-runner:ubuntu-24.04-prod` (or `-staging`) |
 
 The handler only matches single-label arrays containing `ubuntu-24.04-riscv` today. Anything else returns `(_, _, false)` and is ignored with `outcome=IGNORED_NO_LABEL`. New labels are added by extending `matchLabelsToK8s`.
 
@@ -99,7 +99,7 @@ On `workflow_job.in_progress`, the handler updates `status` to `running` and set
 
 | Variable | Purpose |
 |---|---|
-| `PROD` | `true` to use the `prod` schema and `*-latest` image tags, otherwise `staging` schema and `*-staging` tags |
+| `PROD` | `true` to use the `prod` schema and `*-prod` image tags, otherwise `staging` schema and `*-staging` tags |
 | `PROD_URL`, `STAGING_URL` | URL of the prod/staging ghfe; used by the staging proxy |
 | `POSTGRES_URL` | PostgreSQL connection string |
 | `GHAPP_WEBHOOK_SECRET` | Shared HMAC secret used by both apps |

website/docs/architecture/images.md

@@ -59,7 +59,7 @@ A single `build-runner` matrix job builds the runner image. Currently only `ubun
 - **Platform:** `linux/riscv64`, built natively on self-hosted `ubuntu-24.04-riscv` runners. No QEMU emulation in the build path.
 - **Caching:** GitHub Actions Cache (`type=gha`) for Docker layer reuse. A concurrency group ensures only one build runs per scope.
 - **Registry choice:** Scaleway for `riseproject-dev/main`, `ghcr.io` for other internal branches, a tar artifact for external PRs.
-- **Deploy:** after `main` builds, `deploy-staging` retags `:ubuntu-24.04-staging`, then `deploy-prod` retags `:ubuntu-24.04-latest` after an environment-gated approval. Both deploys `kubectl rollout restart daemonset/rise-riscv-runner-device-plugin` so each node pre-pulls the new image via the init container in the daemonset.
+- **Deploy:** after `main` builds, `deploy-staging` retags `:ubuntu-24.04-staging`, then `deploy-prod` retags `:ubuntu-24.04-prod` after an environment-gated approval. Both deploys `kubectl rollout restart daemonset/rise-riscv-runner-device-plugin` so each node pre-pulls the new image via the init container in the daemonset.
 
 ### Version sync
 
@@ -79,8 +79,8 @@ rg.fr-par.scw.cloud/funcscwriseriscvrunnerappqdvknz9s/riscv-runner
 
 | Tag | Image | Source branch |
 |-----|-------|---------------|
-| `ubuntu-24.04-latest` | Runner image, Ubuntu 24.04 | `main` (deploy-prod) |
-| `ubuntu-26.04-latest` | Runner image, Ubuntu 26.04 | `main` (deploy-prod) |
+| `ubuntu-24.04-prod` | Runner image, Ubuntu 24.04 | `main` (deploy-prod) |
+| `ubuntu-26.04-prod` | Runner image, Ubuntu 26.04 | `main` (deploy-prod) |
 | `ubuntu-24.04-staging` | Runner image, Ubuntu 24.04 | `main` (deploy-staging) |
 | `ubuntu-26.04-staging` | Runner image, Ubuntu 26.04 | `main` (deploy-staging) |
 | `ubuntu-24.04-sha-<sha>` | Per-commit build | every build |

website/docs/architecture/kubernetes.md

@@ -87,7 +87,7 @@ The device plugin detects the SoC on each RISC-V node at startup and applies a `
 - **Environment:** `NODE_NAME` from downward API (`spec.nodeName`)
 - **Volume mounts:** `/var/lib/kubelet/device-plugins` (host path), `/sys` (read-only host path)
 - **Privileged:** Yes (required for device tree access)
-- **Image:** `rg.fr-par.scw.cloud/funcscwriseriscvrunnerappqdvknz9s/riscv-runner:device-plugin-latest`
+- **Image:** `rg.fr-par.scw.cloud/funcscwriseriscvrunnerappqdvknz9s/riscv-runner:device-plugin-prod`
 
 ## Source files
 

website/docs/operations/runbooks.md

@@ -146,6 +146,6 @@ Best run on a RISC-V host so no emulation is involved. On x86_64, `binfmt_misc`
 
 1. Merge a PR that changes `images/**`. CI builds `:ubuntu-24.04-sha-<sha>` and pushes it.
 2. `deploy-staging` retags as `:ubuntu-24.04-staging`, then `kubectl rollout restart daemonset/rise-riscv-runner-device-plugin -n kube-system`. The init container in the daemonset pre-pulls the new image to every node.
-3. The `deploy-prod` job waits for an environment-gated approval before retagging as `:ubuntu-24.04-latest`. New runner pods provisioned after that point pull the new image.
+3. The `deploy-prod` job waits for an environment-gated approval before retagging as `:ubuntu-24.04-prod`. New runner pods provisioned after that point pull the new image.
 
 A runner pod that is currently running an old image will keep that image for the duration of its job. Image updates are not retroactive.