| name | build-and-push-image |
| description | Use when building, tagging, validating, or pushing NPA workbench container images for Nebius registry-backed workflows. |
Build And Push Image
When To Use
Use this skill when a task changes Dockerfiles, image manifests, registry tags,
or workflow image references for NPA workbench tools.
Procedure
- Resolve runtime registry settings with
npa configure or
npa.clients.config.resolve_container_registry or npa configure.
- Build from the checked-in Dockerfile for the tool; do not invent a detached
image source outside the repo.
- Tag images with the configured registry prefix and a version that matches the
tool manifest or release plan.
- Inspect the image or manifest before pushing.
- Update image manifests, workflow YAML, and skill guidance together when a
command starts depending on the new image.
Three-Tier Contract
- CLI: use
docker buildx build, tool-specific deploy --container-image, and
command help from the affected workbench tool.
- SDK: resolve registry and project settings through
npa.clients.config instead of
hardcoded env reads.
- YAML: workflow
image_id values should come from variables or manifests,
especially SONIC's npa/src/npa/deploy/sonic_image_manifest.json.
Packaging Contract
Before changing Dockerfiles, read docs/workbench/container-packaging.md and
update npa/docker/workbench/packaging-contract.yaml when adding an image or
changing its tier (service / job / interactive).
Security baseline: non-root final USER, no secrets in layers, digest-pinned
bases where possible, Trivy scan coverage. Service images should expose ports
and prefer a HEALTHCHECK or K8s probe on /health.
Gotchas
- Do not commit concrete registry IDs or private image digests from a live
account unless the repo already treats that value as public.
- Nebius registry auth expires; a push or pull failure may require a refreshed
token rather than an image change.
- For GPU-specific images, verify the target GPU family before changing defaults.
Verify
npa/.venv/bin/python -m pytest npa/tests/guardrails/test_skills_index.py -q
The smoke test verifies current deploy command help and the image-manifest file
paths used by the skill.
