Skip to main content
By default, actions run on the install runner. Setting image executes the action inside a container image you provide.

​
Configure it

Add image to the action and configure a step with inline_contents:
actions/db_migrate.toml
Sync it the same way as any other action:
Everything else about the action is unchanged: triggers, timeout (30 minutes maximum), role, enable_kube_config, env_vars, and templating all behave exactly as they do when the action runs on the runner. See Configure actions.

​
Choosing an image

You can use publically hosted images or component images from your Nuon app config.

​
A public reference

actions/db_migrate.toml

​
A private image

Publish the image as a container image component and point image at its image.ref output:
actions/db_migrate.toml
Registry access is configured once on the component, and every action referencing it inherits that. Referencing the component also registers it as a dependency of the action, so you do not need to list it under dependencies. Because it is a dependency, the run keeps it current. Before the action is planned, Nuon compares the component’s latest build — for the app config version this install is pinned to — against the image the install has already synced, and syncs the new one first if they differ. A new build of the component is therefore in the install’s own registry before the next run of the action, with no deploy in between; the sync shows up on the install timeline as a sync deploy for that component. The sync needs a build to pick up. A component whose latest build for that app config version never finished successfully is left alone, and the action runs against the image the install already has — the run log says which component was skipped and why.
Use the component’s image.ref output, not image.repository and image.tag. A bare repository:tag is rejected with not digest-pinned.

​
Building the image

Nuon does not modify the image. It must include every tool and dependency the action needs.

​
Images without a shell

For a binary in a distroless or scratch image, use an absolute executable path in a command step without a repository source:
Nuon executes this command directly and overrides the image entrypoint. Literal arguments, including quoted strings and empty arguments, are supported. The working directory is the mounted action workspace. The image’s configured user is preserved, and the output file is writable by nonroot users. Commands with shell expressions, variable expansion, redirects, or pipelines still use /bin/sh. So do inline_contents and repository-backed steps. Pass dynamic values through env_vars when the image has no shell. The binary must write outputs to NUON_ACTIONS_OUTPUT_FILEPATH itself; the shell helper nuon_output is unavailable during direct execution.