Implement the Unified /v1/workload/ignite

[t0gun]

We are unifying the developer experience around a single deployment primitive and purging all legacy "app" terminology from the API layer. SpaceScale will act as a infrastructure that derives the workload architecture implicitly from the OCI image. This provides zero-config deployments for standard web/HTTP workloads while retaining the flexibility to support raw TCP/UDP.

The Target API Design (POST /api/v1/workloads/ignite)

{
  "image": {
    "url": "ghcr.io/org/browser-agent:v4",
    "auth": {
      "type": "basic", 
      "username": "ci-bot",
      "secret_ref": "sec_live_9988xyz"
    }
  },
  "compute": {
    "vcpu": 2,
    "memory_mb": 2048,
    "dedicated": true 
  },
  "network": {
    "visibility": "auto",
    "primary_port": 9222,
    "protocol": "http"
  },
  "env": {
    "API_KEY": "secret_ref://sec_live_abc123"
  }
}

Zero-Config Ports (OCI Parsing)

scaleD must use go-containerregistry to fetch the image manifest (without downloading the heavy rootfs layers) and parse Config.ExposedPorts

Polymorphic Auth:

• The image.auth block is optional. If omitted, default to anonymous pull.
• Support type: "basic" and type: "aws_ecr", etc for now we are supporting basic since it covers docker hub and ghcr
• Crucial Rate-Limit Protection: If a user attempts an anonymous pull from Docker Hub (e.g., ubuntu:latest), scaleD must silently inject a SpaceScale platform default token to prevent the OVH host node from being IP-banned by Docker Hub limits.

The Heuristic Router & Edge Cases

• The Web Default: If the parsed OCI port is a known web/HTTP port (80, 443, 3000, 8080, 9222, etc.), auto-route to proxy (Path A) and return an https:// or wss:// URL depending on port workload type uses.we might need to make a research on all popular ports so we can catch this edge case.

• Multi-Port Tie-Breaker: If an image exposes multiple ports (3000 and 9222), we must check for network.primary_port. if the OCI image exposes exactly ONE port, do the zero-config magic.
  If the OCI image exposes MULTIPLE ports, and the user did not provide primary_port in the JSON, your API must instantly return an HTTP 400 error:
  {"error": "Multiple exposed ports detected in image [3000, 8080]. You must specify network.primary_port in your request."}

• Protocol Override: If a user runs a web app on a non-standard port (e.g., 1337), they can pass "protocol": "http" to override the heuristic engine and force it through the standard http router.

• If visibility: "auto", known web/HTTP workloads default to public NAT (exposed to the internet).i think visbility can be omitted entirely too heursitics shuld still catch it .

Bare-Metal Pinning

If compute.dedicated is true, use the cpuset cgroup to pin the Firecracker PID to specific unshared physical host cores.

Optional Fields & Engine Defaults

• image.auth (Object): Optional. * Default: Engine attempts an anonymous pull.

• compute.dedicated (Boolean): Optional. * Default: false. Workload is placed in the standard SMT-disabled shared pool.

• network (Object): Entire block is Optional. If completely omitted, the engine derives all routing from the OCI manifest

• network.visibility (String): Optional. * Default: "auto". (Engine exposes known web ports to public NAT, and keeps unknown/database ports on private internal IPs)

• network.primary_port (Integer): Optional/Conditional. * Behavior: If the OCI image exposes 1 port, ignore this field.

  • Edge Case Override: If the OCI image exposes >1 port, this field becomes REQUIRED. If omitted on a multi-port image, the API must fail fast with a 400 Bad Request requiring the user to specify the target port. Do not default to the lowest port to prevent accidental internal metrics exposure.

• network.protocol (String): Optional. * Default: Derived via Heuristic Engine (checks if port matches known web ports)

  • Override: Allows user to pass "http" or "tcp" to forcefully bypass the heuristic engine for custom port numbers (e.g., forcing port 1337 L4

• env (Map/Object): Optional. Key-value pairs injected into the Firecracker MMDS.

so for return exmaple

{
  "workload_id": "wkld_01h9x2",
  "status": "running",
  "network": {
    "visibility": "public",
    "url": "https://wkld-01h9x2.spacescale.run",
    "internal_port_mapped": 9222
  }
}

so we are dropping compute plans as well the full catalog area would be dtopped we dont need it so we cant figure otu pricing yet and stuff