Image build provider and image provider binding

Included from Basic tier

An image build provider is one catalog record for a build backend — where an image build runs (BuildKit, Packer, EC2 Image Builder, Azure Image Builder; GCP Cloud Build reserved). Actions reference it as image-build://<code> and dispatch resolves the reference into the backend's environment contract plus a short-lived credential. Custody is reference-first: the record stores a secret-vault:// address, or holds an inline credential encrypted at rest; reads serve credential_set. A record is usable only under the estate subtrees it is bound to. Served by the v2 ImageBuildProviderService: ListImageBuildProviders, GetImageBuildProvider, CreateImageBuildProvider, UpdateImageBuildProvider, DeleteImageBuildProvider, TestImageBuildProvider, BindImageBuildProvider and UnbindImageBuildProvider (admin-only; every write is audited).

ImageBuildProvider

ImageBuildProvider is one registered build backend. The credential is never a field: reads carry credential_set and credential_ref only.

Field	Type	Meaning
bound_paths	array of string	The estate subtrees the provider is bound to, sorted; empty means the provider is usable nowhere until bound.
code	string	The estate code actions reference as image-build://<code>.
created_at	timestamp	When the record was created.
credential_kind	string	What the reference holds, per kind: client_cert (BuildKit mTLS), service_principal_cert / service_principal (Azure), assume_role / access_key (AWS), service_account_key / workload_identity (GCP). Validated against the kind at write.
credential_ref	string	The secret-vault:// reference the credential lives at — an address, never a value. Empty when the credential is held encrypted at rest on the record.
credential_set	boolean	Whether a credential is held — a pinned reference or an inline value encrypted at rest (the value is write-only).
defaults	map of string	Kind-specific defaults (registry, gallery, distribution, project…), injected into the step as IMAGE_BUILD_DEFAULT_<KEY>.
description	string	Free-text description.
display_name	string	Human-readable display name.
enabled	boolean	Disabled providers refuse at dispatch by name.
endpoint	string	Backend address where one applies (a BuildKit daemon address: tcp://, unix://, docker-container://); empty for the cloud kinds, where the region decides.
id	string	The record's identity.
kind	string	buildkit, packer, aws_image_builder, azure_image_builder or the reserved gcp_cloud_build. The kind picks the dispatch contract and the pack verbs that accept the reference.
last_test_at	timestamp	When the probe last ran; unset until the first test.
last_test_error	string	Why the last probe failed; empty on success. Never credential material.
last_test_success	boolean	Whether the last probe succeeded.
region	string	Cloud region for the cloud kinds.
ssl_ca_cert	string	A CA trust anchor for the endpoint: a PEM block inline or a certificate file path on the server host; empty uses the system roots.
ssl_verify	boolean	Whether the endpoint's TLS certificate is verified (default true).
updated_at	timestamp	When the record was last updated.

ImageProviderBinding

ImageProviderBinding is one record → estate-subtree mapping, shared by build providers and image registries.

Field	Type	Meaning
created_at	timestamp	When the binding was declared.
family	string	build or registry.
id	string	The binding's identity.
provider_code	string	The bound record's code.
provider_id	string	The bound record's identity.
scope_path	string	/ (estate-wide) or a node path such as /projects/web or /projects/web/environments/dev/assets/api.

ImageBuildProviderDefaults

ImageBuildProviderDefaults wraps the defaults map on an update so "not supplied" and "cleared" are distinct.

Field	Type	Meaning
values	map of string	The replacement defaults map.

Write fields

CreateImageBuildProviderRequest and UpdateImageBuildProviderRequest carry the record's fields plus:

Field	Type	Meaning
bind_path	string	On create: the first binding, declared in the same call — / or a node path.
credential	string	The credential value, write-only: held encrypted at rest on the record (clearing any reference) and never echoed. Exactly one of credential or credential_ref carries it, except for credential_kind workload_identity, which holds no secret.
scope_path	string	On bind and unbind: the subtree the binding covers.

TestImageBuildProviderResponse carries success and failure_reason (empty on success; never credential material).

Related pages

• opschain docs image-builds — the component page: registering, binding, the resolution order and the dispatch contract.
• opschain docs resources/image_registry — the registry record.
• opschain docs cli/admin-image-build-providers — the CLI manual.