Container Image
Properties
| Property | Description | Values | Example |
|---|---|---|---|
typestring | component type Type of component to deploy. Determines which configuration block is required (helm_chart, terraform_module, container_image, kubernetes_manifest, or job) | ✅ Required"container_image", "external_image" | - |
namestring | component name Unique identifier for the component within the app. Used for referencing in dependencies and templates | ✅ Required | "database", "api-server", "frontend" |
var_namestring | variable name for component output Optional name to use when storing component outputs as variables. If not specified, uses the component name | Optional | "db_endpoint", "api_host" |
labelsobject | Key/value labels used to organize and filter components. Metadata only; does not affect deployment | Optional | - |
dependenciesarray | component dependencies List of other components that must be deployed before this component. Automatically extracted from template references | Optional | "database", "infrastructure" |
operation_rolesarray | operation-specific IAM role assignments Map of component operations to IAM role names. Allows using different roles for different operations (provision, deprovision, update). Roles must be defined … | Optional | - |
toggleableboolean | - | Optional | - |
default_enabledboolean | - | Optional | - |
kubernetes_contextstring | kubernetes context binding Optional. Name of a kubernetes_context defined at the app level. If set, the component targets the cluster produced by that context’s source component. If omitted, the co… | Optional | "data-cluster" |
aws_ecrAWSECRConfig | AWS ECR image configuration Configuration for pulling images from AWS Elastic Container Registry. Use when deploying images from private ECR repositories | Optional | - |
gcp_garGCPGARConfig | GCP Artifact Registry image configuration Configuration for pulling images from Google Artifact Registry. Use when deploying images from private GAR repositories | Optional | - |
azure_acrAzureACRConfig | Azure Container Registry image configuration Configuration for pulling images from Azure Container Registry. Use when deploying images from private ACR repositories | Optional | - |
publicPublicImageConfig | public registry image configuration Configuration for pulling images from public container registries (Docker Hub, Quay.io, GCR, etc) | Optional | - |
build_timeoutstring | build operation timeout Duration string for build operations (e.g., “30m”, “1h”). Default: 15m. Max: 1h | Optional Default: "15m" | "30m", "1h" |
deploy_timeoutstring | deploy operation timeout Duration string for deploy operations (e.g., “30m”, “1h”). Default: 5m. Max: 1h | Optional Default: "5m" | "30m", "1h" |
operation_roles
| Property | Description | Values | Example |
|---|---|---|---|
operationstring | operation type Type of operation: provision, deprovision, update, reprovision, or trigger | ✅ Required | "provision", "deploy", "deprovision" |
rolestring | IAM role name Name of the IAM role to use for this operation (not ARN). Role must exist in install stack outputs | ✅ Required | "{{.nuon.install.id}}-maintenance", "{{.nuon.install.id}}-provision" |
aws_ecr
| Property | Description | Values | Example | ||
|---|---|---|---|---|---|
iam_role_arnstring | IAM role ARN for ECR access ARN of the IAM role with permissions to pull images from the ECR repository | ✅ Required | "arn:aws:iam::123456789012:role/ecr-pull-role" | ||
regionstring | AWS region for the ECR repository AWS region where the ECR repository is located | ✅ Required | "us-east-1", "us-west-2", "eu-west-1" | ||
image_urlstring | ECR image URL Full URL to the ECR image (without tag). Format: <account-id>.dkr.ecr.<region>.amazonaws.com/<repository-name>/<image-name> | ✅ Required | "123456789012.dkr.ecr.us-east-1.amazonaws.com/myapp/api", "123456789012.dkr.ecr.us-west-2.amazonaws.com/myapp/worker" | ||
tagstring | image tag Tag or version of the container image to deploy. Either tag or update_policy must be set. Supports templating (e.g., {{.nuon.install.id}}) | Optional | "v1.0.0", "latest", "{{.nuon.install.id}}" | ||
update_policystring | semver constraint for tag resolution Semver constraint for picking a tag at build time. When set, at each build the runner lists tags from the registry, filters to those that parse as semver and sa… | Optional | "~1.25.0", "^2.0.0", "\u003e=1.0.0,\u003c2.0.0", "1.x", `“^1.0 | ^2.0”` |
gcp_gar
| Property | Description | Values | Example | ||
|---|---|---|---|---|---|
gcp_project_idstring | GCP project ID Google Cloud project ID where the Artifact Registry repository is located | ✅ Required | "my-gcp-project" | ||
regionstring | GCP region for the GAR repository Google Cloud region where the Artifact Registry repository is located | ✅ Required | "us-central1", "us-east1", "europe-west1" | ||
image_urlstring | GAR image URL Full URL to the GAR image (without tag). Format: <region>-docker.pkg.dev/<project>/<repository>/<image> | ✅ Required | "us-central1-docker.pkg.dev/my-project/my-repo/my-image" | ||
tagstring | image tag Tag or version of the container image to deploy. Either tag or update_policy must be set. Supports templating (e.g., {{.nuon.install.id}}) | Optional | "v1.0.0", "latest", "{{.nuon.install.id}}" | ||
service_account_emailstring | GCP service account for impersonation Optional service account email to impersonate when pulling from GAR. If not set, uses application default credentials | Optional | "my-sa@my-project.iam.gserviceaccount.com" | ||
workload_identity_providerstring | - | Optional | - | ||
update_policystring | semver constraint for tag resolution Semver constraint for picking a tag at build time. When set, at each build the runner lists tags from the registry, filters to those that parse as semver and sa… | Optional | "~1.25.0", "^2.0.0", "\u003e=1.0.0,\u003c2.0.0", "1.x", `“^1.0 | ^2.0”` |
azure_acr
| Property | Description | Values | Example | ||
|---|---|---|---|---|---|
image_urlstring | ACR image URL Full URL to the ACR image (without tag). Format: <registry>.azurecr.io/<repository>/<image> | ✅ Required | "myregistry.azurecr.io/myapp/api" | ||
registry_urlstring | ACR login server Azure Container Registry login server. Format: <registry>.azurecr.io | ✅ Required | "myregistry.azurecr.io" | ||
tagstring | image tag Tag or version of the container image to deploy. Either tag or update_policy must be set. Supports templating (e.g., {{.nuon.install.id}}) | Optional | "v1.0.0", "latest", "{{.nuon.install.id}}" | ||
tenant_idstring | Azure tenant ID owning the registry Azure AD tenant that owns the registry. Required to reach a registry in a tenant Nuon holds no identity in, and must be set together with client_id and one of cl… | Optional | "00000000-0000-0000-0000-000000000000" | ||
client_idstring | Azure client ID of the app registration granted AcrPull Application (client) ID of an app registration in tenant_id that has been granted AcrPull on the registry. Must be set together with tenant_i… | Optional | "00000000-0000-0000-0000-000000000000" | ||
client_secret_namestring | name of the app secret holding the client secret Name of an app secret (nuon apps variables create) whose value is the app registration’s client secret. This is the secret’s name, not the secret it… | Optional | "azure-acr-client-secret" | ||
client_certificate_namestring | name of the app secret holding the client certificate Name of an app secret (nuon apps variables create) whose value is the app registration’s base64-encoded PEM certificate. This is the secret’s n… | Optional | "azure-acr-client-cert" | ||
update_policystring | semver constraint for tag resolution Semver constraint for picking a tag at build time. When set, at each build the runner lists tags from the registry, filters to those that parse as semver and sa… | Optional | "~1.25.0", "^2.0.0", "\u003e=1.0.0,\u003c2.0.0", "1.x", `“^1.0 | ^2.0”` |
public
| Property | Description | Values | Example | ||
|---|---|---|---|---|---|
image_urlstring | container image URL Full URL to the container image from a public registry (Docker Hub, Quay.io, etc). Format: [registry/]<repository>/<image-name> | ✅ Required | "nginx:latest", "docker.io/library/postgres", "quay.io/myorg/myapp", "gcr.io/myproject/myapp" | ||
tagstring | image tag Tag or version of the container image to deploy. Either tag or update_policy must be set. Supports templating (e.g., {{.nuon.install.id}}) | Optional | "v1.0.0", "latest", "{{.nuon.install.id}}" | ||
update_policystring | semver constraint for tag resolution Semver constraint for picking a tag at build time. When set, at each build the runner lists tags from the registry, filters to those that parse as semver and sa… | Optional | "~1.25.0", "^2.0.0", "\u003e=1.0.0,\u003c2.0.0", "1.x", `“^1.0 | ^2.0”` |