From Docker image to the portal: publishing a Compute-to-Data algorithm

Unlike docker build, buildx builds and pushes in a single step with --push, and supports several platforms at once with --platform.

• Create a builder once: docker buildx create --use.
• --platform defines the architecture(s).
• --push pushes the result straight to the registry.
• The tag rules: registry/namespace/name:tag.

# One-time: create and activate a buildx builder
docker buildx create --name agrospai --use
docker buildx inspect --bootstrap

# --- Option A · single architecture (the node's) ---
docker buildx build \
  --platform linux/amd64 \
  -t registry.agrospai.udl.cat/library/clip-raster:latest \
  --push .

# --- Option B · multi-architecture (portable) ---
docker buildx build \
  --platform linux/amd64,linux/arm64 \
  -t registry.agrospai.udl.cat/library/clip-raster:latest \
  --push .

The trailing . is the build context (the repo root, where the Dockerfile is).

C2D doesn't trust the tag (:latest can change). Pin the image by its sha256 digest — an immutable hash of the content. That digest is the checksum in the publishing script.

• The --push already prints the digest when it finishes.
• Or retrieve it with buildx imagetools inspect.
• For multi-arch, use the manifest index digest (the top-level one).

# Get the digest of the already-pushed image
docker buildx imagetools inspect \
  registry.agrospai.udl.cat/library/clip-raster:latest

# Output (abridged):
# Name:      registry.agrospai.udl.cat/library/clip-raster:latest
# MediaType: application/vnd.oci.image.index.v1+json
# Digest:    sha256:b6ba37cc7a77c936bc03a58b0bbaf9debb55b2
#            5f4b04a097181ee442ea5e50f2
#   Manifests:
#     linux/amd64  sha256:...
#     linux/arm64  sha256:...

Copy the top-level Digest (the index one). That goes, as-is with its sha256: prefix, into the checksum field.

Each asset is a folder inside scripts/ with two files. pontus-x_cli publish takes the path to index.ts, imports it and runs its publish function.

• index.ts — builds the asset with Nautilus.
• description.md — the text users will see on the portal.
• The signature is fixed: publish(folder, connection, provider, dryRun).

tu-repo-configs/         # private, yours (same structure)
└── scripts/
    └── clip-raster/
        ├── index.ts          # describes and publishes the asset
        └── description.md     # public description (Markdown)

import { readFileSync } from 'fs';
import {
  AssetBuilder, ConsumerParameterBuilder,
  FileTypes, ServiceTypes, ServiceBuilder
} from '@deltadao/nautilus'
import { ServiceFileType } from '@deltadao/nautilus'

const publish = async (
  folder: string, connection: any,
  provider: string, dryRun: boolean
) => {
  // 1) metadata  2) algoMetadata  3) service  4) publish
}

The algoMetadata block is the bridge between the portal and your image: it declares which image to run, with which entrypoint, and pinned to which checksum.

• image + tag — exactly what you pushed to the registry.
• checksum — the sha256 digest from step 3.
• entrypoint — ocean-execute --base-dir /data.
• consumerParameters — the parameters the user fills in when launching the job.

const cpb = new ConsumerParameterBuilder();
const refcat = cpb
  .setType('text').setName('refcat')
  .setLabel('Cadastral Reference')
  .setDescription('Cadastral reference code')
  .setRequired(true)
  .setDefault('25168A010000060000IZ')
  .build();

const algoMetadata = {
  language: 'python',
  version: '0.1',
  container: {
    entrypoint: 'ocean-execute --base-dir /data',
    image: 'registry.agrospai.udl.cat/library/clip-raster',
    tag: 'latest',
    checksum: 'sha256:b6ba37cc7a77c936bc03a58b0bb...'
  },
  consumerParameters: [ refcat ]
};
assetBuilder.setAlgorithm(algoMetadata);

The ServiceBuilder defines how the asset is consumed. For a C2D algorithm it's a COMPUTE-type service, with a backing file and a pricing policy.

• serviceEndpoint — the provider that controls the asset.
• addFile — the URL of the algorithm resource (e.g. the runner's entrypoint.py)…
• …or a URL to a MinIO / object storage with protected variables (username, password, tokens).
• setTimeout(0) — non-expiring access after purchase.
• setPricing — free or fixed rate (EUROe).

const sb = new ServiceBuilder({
  serviceType: ServiceTypes.COMPUTE,
  fileType: FileTypes.URL });

const urlFile: ServiceFileType<FileTypes> = {
  type: 'url',
  // the algorithm resource… or a private bucket with
  // the auth secrets (mounted at /data/transformations)
  url: 'https://minio.agrospai.udl.cat/secrets/<id>/algorithm',
  method: 'GET' };

const service = sb
  .setServiceEndpoint(provider)
  .setTimeout(0)
  .addFile(urlFile)
  .setPricing(connection.pricingConfig.fixedRateEUROe(1))
  .setDatatokenNameAndSymbol(
      'AgrospAI Clip Raster', 'AgrospAI-ClipRaster')
  .build();
assetBuilder.addService(service);

const asset = assetBuilder.build();
if (!dryRun) await connection.nautilus.publish(asset);