opschain admin image-build-providers
Included from Basic tier
Manage the image build provider catalog: the backends an action's build step runs against
(opschain docs image-builds). A record carries a kind (buildkit | packer | aws_image_builder | azure_image_builder (gcp_cloud_build is reserved and refused by name until a content pack serves it)), an endpoint or region,
a write-only credential declared by its form (credential_kind) and held as a secret-vault:// reference,
an enabled flag and its bindings — the estate subtrees it may be used under. Actions reference a record
as image-build://<code>; at dispatch the platform resolves the reference within the bindings covering the run's
target, mints or materialises a short-lived credential into the step and masks it. An unbound record is
usable nowhere: create offers the first binding (--bind), bind and unbind manage the rest, and
delete is refused while a binding references the record.
| Subcommand | Purpose |
|---|---|
list | Every record: kind, endpoint (or region for the cloud kinds), credential form and presence, the bound paths (UNBOUND when none — the record is then usable nowhere), enabled state, the last probe outcome and row id. |
show <code-or-id> | One record. |
create <code> | Register a record (credential via reference, env or prompt — never argv); --bind declares the first binding. |
update <code-or-id> | Change fields; a supplied credential rotates the stored reference. |
delete <code-or-id> | Remove a record (refused while bound). |
test <code-or-id> | Probe the record: the credential resolves and parses as its declared form and the endpoint or cloud API answers; nothing is built. |
bind <code-or-id> <path> | Bind the record to / (estate-wide) or a node path. |
unbind <code-or-id> <path> | Remove one binding. |
Every verb rides the v2 ImageBuildProviderService, which authenticates user
tokens only: the caller's own opschain login session is the primary credential. An explicit
--auth-token wins, and OPSCHAIN_ADMIN_TOKEN / the opschain admin login token remain the
fallback for automation; the server still requires the /admin updatable determination.
Exit codes: 0 on success, 1 when a call fails or the token is rejected, 2 for usage errors.
See also
opschain docs cli/admin-image-build-providers-create— registering one.opschain docs image-builds— the component page: bindings, the resolution order and the dispatch contract.