alchemy 2.0.0-beta.82 → 2.0.0-beta.83

package/src/Cloudflare/Containers/ContainerClient.ts

@@ -38,10 +38,6 @@ export type ContainerInfo = cf.ContainerInfo;
 export type ContainerSnapshot = cf.ContainerSnapshot;
 export type ContainerSnapshotOptions = cf.ContainerSnapshotOptions;
 
-type PreparedImages<ImageName extends string> = string extends ImageName
-  ? Readonly<Record<string, string | undefined>>
-  : Readonly<Record<ImageName, string>>;
-
 /** Errors a container `start` can fail with. */
 export type ContainerStartError =
   | ContainerError
@@ -101,16 +97,29 @@ export interface ContainerProcess {
  * returns. Binding never starts the container: call {@link start} before
  * using it. `start` is idempotent and coordinated across every handle in the
  * Durable Object, so calling it at the top of each operation is cheap.
+ *
+ * A Durable Object has one container instance. When several Durable
+ * Object-managed Containers are bound to it, each handle starts its own image,
+ * and every handle controls that same instance: start one image at a time.
  */
-export interface ContainerClient<ImageName extends string = string> {
-  /** Prepared image references. Required names retain their declaration's keys. */
-  readonly images: Effect.Effect<PreparedImages<ImageName>, ContainerError, RuntimeContext>;
+export interface ContainerClient {
+  /**
+   * This Container's prepared image reference, the key `start()` selects by
+   * default. Fails with {@link ContainerError} when the Container publishes no
+   * image to this Durable Object (fleet Containers and Containers without an
+   * image source).
+   */
+  readonly image: Effect.Effect<string, ContainerError, RuntimeContext>;
   /** Whether the container process is running; this does not imply port readiness. */
   readonly running: Effect.Effect<boolean, ContainerError, RuntimeContext>;
   /**
    * Start the container unless it is already running. Concurrent calls start
    * it once. Returns before ports are ready; {@link getTcpPort} waits for them.
    * Options apply only when this call actually starts the container.
+   *
+   * A Durable Object-managed Container starts its own {@link image} unless
+   * `options` names an `image` or a `containerSnapshot`. A no-op while any
+   * image is running: `destroy()` first to switch images.
    */
   start(
     options?: ContainerStartupOptions,
@@ -300,9 +309,11 @@ const fromProcess = (process: cf.ExecProcess): ContainerProcess => {
  * looked up on every call, never at construction: the client is also built
  * while planning a Worker, where no Durable Object state exists.
  */
-export const fromContainer = <ImageName extends string = string>(
+export const fromContainer = (
   getContainer: () => cf.Container | undefined,
-): ContainerClient<ImageName> => {
+  /** The key of this Container's image in `ctx.container.images`. */
+  imageKey?: string,
+): ContainerClient => {
   const attached = Effect.suspend(() => {
     const container = getContainer();
     return container
@@ -324,6 +335,30 @@ export const fromContainer = <ImageName extends string = string>(
 
   const running = call((container) => container.running ?? false);
 
+  const ownImage = (container: cf.Container) =>
+    imageKey === undefined ? undefined : container.images?.[imageKey];
+
+  const image = Effect.flatMap(attached, (container) => {
+    const ref = ownImage(container);
+    return ref === undefined
+      ? Effect.fail(
+          new ContainerError({
+            message: `Container '${imageKey}' publishes no image to this Durable Object.`,
+          }),
+        )
+      : Effect.succeed(ref);
+  });
+
+  /** Default `image` to this Container's own image. */
+  const withOwnImage = (
+    container: cf.Container,
+    options: ContainerStartupOptions | undefined,
+  ): ContainerStartupOptions | undefined => {
+    if (options?.image !== undefined || options?.containerSnapshot !== undefined) return options;
+    const ref = ownImage(container);
+    return ref === undefined ? options : ({ ...options, image: ref } as ContainerStartupOptions);
+  };
+
   const start = (options?: ContainerStartupOptions) =>
     Effect.gen(function* () {
       const container = yield* attached;
@@ -340,7 +375,7 @@ export const fromContainer = <ImageName extends string = string>(
           // Nothing listens on a fresh start; re-probe every port.
           readyPorts.clear();
           yield* Effect.try({
-            try: () => container.start(options),
+            try: () => container.start(withOwnImage(container, options)),
             catch: classifyStartError,
           }).pipe(
             Effect.retry({
@@ -452,8 +487,7 @@ export const fromContainer = <ImageName extends string = string>(
     ).pipe(Effect.map(fromProcess));
 
   return {
-    // The binding publishes every declared image under its declared name.
-    images: call((container) => container.images as PreparedImages<ImageName>),
+    image,
     running,
     start,
     destroy: (error) => callAsync((container) => container.destroy(error)),
@@ -495,7 +529,7 @@ export const makeContainerHandle = Effect.fnUntraced(function* (
 ) {
   yield* binding;
   const state = yield* DurableObjectState;
-  const client = fromContainer(() => state.container);
+  const client = fromContainer(() => state.container, id);
   const rpcPort = client.getTcpPort(3000);
   return makeFetchRpcStub<ContainerClient>({
     // RPC methods only run inside the Durable Object, where RuntimeContext is

package/src/Cloudflare/Containers/ContainerConfiguration.ts

@@ -4,13 +4,15 @@ import * as Duration from "effect/Duration";
 import * as Effect from "effect/Effect";
 import { deepEqual } from "../../Diff.ts";
 import * as Output from "../../Output.ts";
-import { sha256Object } from "../../Util/sha256.ts";
 import { normalizeNulls } from "../../Util/stable.ts";
 import type {
   AnyContainerApplicationProps,
   ContainerApplication,
+  DevContainerImage,
+  DurableObjectApplicationSettings,
   DurableObjectContainerProps,
 } from "./ContainerApplication.ts";
+import type { DurableObjectApplication } from "./DurableObjectApplication.ts";
 
 export class ContainerConfigurationError extends Data.TaggedError("ContainerConfigurationError")<{
   readonly message: string;
@@ -24,7 +26,80 @@ export class ContainerImagePreparationError extends Data.TaggedError(
   readonly message: string;
 }> {}
 
-/** Cloudflare's limits for the `images` map of a Durable Object container. */
+/**
+ * Two Containers bound to the same Durable Object class declare different
+ * values for one application-wide setting. The class has one container
+ * application, so the declarations must agree (or only one may declare it).
+ */
+export class ContainerApplicationSettingsConflict extends Data.TaggedError(
+  "ContainerApplicationSettingsConflict",
+)<{
+  readonly className: string;
+  readonly setting: keyof DurableObjectApplicationSettings;
+  readonly containers: ReadonlyArray<string>;
+  readonly message: string;
+}> {}
+
+/**
+ * The Containers bound to one Durable Object class cannot be merged into the
+ * class's single container entry: two images share a key, the class mixes a
+ * fleet Container with Durable Object-managed ones, or it exceeds Cloudflare's
+ * image limit.
+ */
+export class DurableObjectContainerConflict extends Data.TaggedError(
+  "DurableObjectContainerConflict",
+)<{
+  readonly className: string;
+  readonly message: string;
+}> {}
+
+/**
+ * A Durable Object-managed Container was bound on an async Worker outside a
+ * Durable Object binding, or a Durable Object binding lists a Container it
+ * cannot attach. Durable Object-managed Containers attach to a class through
+ * `Cloudflare.DurableObject(className, { containers })`.
+ */
+export class DurableObjectContainerBindingError extends Data.TaggedError(
+  "DurableObjectContainerBindingError",
+)<{
+  readonly bindingName: string;
+  readonly message: string;
+}> {}
+
+/**
+ * An async `Cloudflare.DurableObject(className, { containers })` binding
+ * attaches Containers to a class the same Worker implements as an
+ * Effect-native Durable Object. Effect-native classes `yield*` their
+ * Containers instead.
+ */
+export class DurableObjectContainersOnEffectNativeClass extends Data.TaggedError(
+  "DurableObjectContainersOnEffectNativeClass",
+)<{
+  readonly className: string;
+  readonly message: string;
+}> {}
+
+/**
+ * Fail when an async binding's `containers` target a class the Worker
+ * implements as an Effect-native Durable Object.
+ */
+export const assertBindingContainersOnAsyncClasses = (
+  rows: ReadonlyArray<{ readonly className: string; readonly attachedBy?: "binding" }>,
+  effectNativeClasses: Iterable<string>,
+) => {
+  const effectNative = new Set(effectNativeClasses);
+  const row = rows.find((row) => row.attachedBy === "binding" && effectNative.has(row.className));
+  return row === undefined
+    ? Effect.void
+    : Effect.fail(
+        new DurableObjectContainersOnEffectNativeClass({
+          className: row.className,
+          message: `Durable Object class '${row.className}' is an Effect-native Durable Object, so it cannot take containers from Cloudflare.DurableObject("${row.className}", { containers }). Bind each Container inside the Durable Object with \`yield*\` instead, and remove the containers prop.`,
+        }),
+      );
+};
+
+/** Cloudflare's limits for the `images` map of a Durable Object class. */
 const MAX_NAMED_IMAGES = 100;
 const MAX_IMAGE_NAME_LENGTH = 128;
 
@@ -33,10 +108,9 @@ const MAX_IMAGE_NAME_LENGTH = 128;
  * the image and instance size at `start()` time.
  */
 const FLEET_ONLY_PROPS = [
+  "name",
+  "className",
   "main",
-  "image",
-  "context",
-  "dockerfile",
   "instanceType",
   "instances",
   "maxInstances",
@@ -58,7 +132,6 @@ const FLEET_ONLY_PROPS = [
   "affinities",
   "rollout",
   "registryId",
-  "publish",
   "sshPublicKeyIds",
 ] as const satisfies ReadonlyArray<keyof AnyContainerApplicationProps>;
 
@@ -100,26 +173,23 @@ export const validateContainerConfiguration = Effect.fn(function* (
     );
   }
 
-  if (!isDurableObjectContainer(props)) {
-    if (props.images !== undefined) {
-      return yield* invalid("Named images require schedulingPolicy: 'durable_object'.");
-    }
-    return;
-  }
-
-  yield* imagePreparationTimeoutMillis(props.imagePreparationTimeout);
-  const imageNames = Object.keys(props.images ?? {});
-  if (imageNames.length > MAX_NAMED_IMAGES) {
+  // `images` was removed: one Container is one image. Untyped or
+  // Effect-produced props can still carry it.
+  if ((props as { images?: unknown }).images !== undefined) {
     return yield* invalid(
-      `A Durable Object-managed container supports at most ${MAX_NAMED_IMAGES} named images.`,
+      "Container property 'images' was removed. Declare one Cloudflare.Container per image with schedulingPolicy: 'durable_object' and bind each one to the Durable Object; the image key is the Container's id.",
     );
   }
-  const badName = imageNames.find(
-    (name) => name.length === 0 || name.length > MAX_IMAGE_NAME_LENGTH,
-  );
-  if (badName !== undefined) {
+
+  if (!isDurableObjectContainer(props)) return;
+
+  yield* imagePreparationTimeoutMillis(props.imagePreparationTimeout);
+  if (
+    props.image !== undefined &&
+    (props.context !== undefined || props.dockerfile !== undefined)
+  ) {
     return yield* invalid(
-      `Container image name '${badName}' must contain between 1 and ${MAX_IMAGE_NAME_LENGTH} characters.`,
+      "A Durable Object-managed container declares one image source: `image`, or `context`/`dockerfile`.",
     );
   }
 
@@ -129,52 +199,257 @@ export const validateContainerConfiguration = Effect.fn(function* (
   const unsupported = FLEET_ONLY_PROPS.find((key) => loose[key] !== undefined);
   if (unsupported !== undefined) {
     return yield* invalid(
-      `Container property '${unsupported}' is not supported with schedulingPolicy: 'durable_object'. Declare image sources under 'images' and pass per-instance settings to start().`,
+      `Container property '${unsupported}' is not supported with schedulingPolicy: 'durable_object'. The application is named and owned by the Durable Object class: attach the Container with Cloudflare.DurableObject(className, { containers }) on an async Worker, or yield it inside an Effect-native Durable Object. Pass per-instance settings to start().`,
     );
   }
 });
 
+/** Whether a Durable Object-managed Container declares an image to publish. */
+export const hasImageSource = (props: DurableObjectContainerProps) =>
+  props.image !== undefined || props.context !== undefined || props.dockerfile !== undefined;
+
+/** Read the scheduling policy off a declared Container resource's props. */
+export const isDurableObjectContainerResource = (container: ContainerApplication) => {
+  const props = container.Props as { schedulingPolicy?: unknown } | undefined;
+  return props?.schedulingPolicy === "durable_object";
+};
+
+/** The application-wide settings a Container contributes to its Durable Object class. */
+export const containerApplicationSettings = (container: ContainerApplication) => {
+  const props = container.Props as DurableObjectApplicationSettings | undefined;
+  return {
+    ssh: props?.ssh,
+    authorizedKeys: props?.authorizedKeys,
+    observability: props?.observability,
+  };
+};
+
+const SETTING_KEYS = ["ssh", "authorizedKeys", "observability"] as const;
+
 /**
- * The `containers` entry a Durable Object class contributes to its Worker.
- * Durable Object-managed applications also send their application name and
- * prepared images so the Worker upload can expose `ctx.container.images`.
+ * Merge the application-wide settings every bound Container declares. A
+ * setting declared by several Containers must have the same value.
+ */
+export const mergeApplicationSettings = (
+  className: string,
+  contributions: ReadonlyArray<{
+    readonly id: string;
+    readonly settings: DurableObjectApplicationSettings | undefined;
+  }>,
+) =>
+  Effect.gen(function* () {
+    const merged: DurableObjectApplicationSettings = {};
+    for (const setting of SETTING_KEYS) {
+      const declared = contributions.flatMap(({ id, settings }) => {
+        const value = normalizeNulls(settings?.[setting]);
+        return value === undefined ? [] : [{ id, value }];
+      });
+      const [first] = declared;
+      if (first === undefined) continue;
+      const conflicting = declared.find(({ value }) => !deepEqual(value, first.value));
+      if (conflicting !== undefined) {
+        return yield* new ContainerApplicationSettingsConflict({
+          className,
+          setting,
+          containers: declared.map(({ id }) => id),
+          message: `Containers '${first.id}' and '${conflicting.id}' declare different '${setting}' for Durable Object class '${className}'. A class has one container application, so its Containers must agree on application-wide settings; declare '${setting}' on one Container or give them the same value.`,
+        });
+      }
+      Object.assign(merged, { [setting]: first.value });
+    }
+    return merged;
+  });
+
+/**
+ * One row of a Worker's `containers` binding data: the container a Durable
+ * Object class is backed by.
+ */
+export interface WorkerContainerRow {
+  readonly className: string;
+  /** Set when an async `Cloudflare.DurableObject(name, { containers })` binding contributed the row. */
+  readonly attachedBy?: "binding";
+  /** Application name, set for a Durable Object-managed class. */
+  readonly name?: string;
+  /** Prepared images keyed by Container id (Durable Object-managed). */
+  readonly images?: Record<string, string>;
+  /** Local image sources keyed by Container id (Durable Object-managed). */
+  readonly devImages?: Record<string, DevContainerImage>;
+  /** The fleet container's local image. */
+  readonly dev: DevContainerImage | undefined;
+  readonly hash: string | undefined;
+}
+
+const isDurableObjectRow = (row: Pick<WorkerContainerRow, "name" | "images" | "devImages">) =>
+  row.name !== undefined || row.images !== undefined || row.devImages !== undefined;
+
+const mergeImageMaps = <V>(
+  className: string,
+  label: string,
+  maps: ReadonlyArray<Record<string, V> | undefined>,
+) =>
+  Effect.gen(function* () {
+    if (maps.every((map) => map === undefined)) return undefined;
+    const merged: Record<string, V> = {};
+    for (const map of maps) {
+      for (const [key, value] of Object.entries(map ?? {})) {
+        if (key in merged && !deepEqual(merged[key], value)) {
+          return yield* new DurableObjectContainerConflict({
+            className,
+            message: `Two Containers bound to Durable Object class '${className}' publish different ${label} under the key '${key}'. The image key is the Container's id, so give each Container a distinct id.`,
+          });
+        }
+        merged[key] = value;
+      }
+    }
+    return merged;
+  });
+
+/**
+ * Merge a Worker's `containers` rows into one entry per Durable Object class.
+ * A Durable Object-managed class unions the images of every bound Container;
+ * a fleet class is backed by exactly one Container.
+ */
+export const mergeWorkerContainers = <
+  Row extends Partial<WorkerContainerRow> & { className: string },
+>(
+  rows: ReadonlyArray<Row>,
+) =>
+  Effect.gen(function* () {
+    const byClass = new Map<string, Row[]>();
+    for (const row of rows) {
+      const existing = byClass.get(row.className);
+      if (existing) existing.push(row);
+      else byClass.set(row.className, [row]);
+    }
+    const merged: Row[] = [];
+    for (const [className, classRows] of byClass) {
+      const [first, ...rest] = classRows as [Row, ...Row[]];
+      const managed = classRows.filter(isDurableObjectRow);
+      if (managed.length === 0) {
+        // Fleet: rows for the same Container collapse; distinct ones conflict.
+        if (rest.some((row) => !deepEqual(row, first))) {
+          return yield* new DurableObjectContainerConflict({
+            className,
+            message: `Durable Object class '${className}' is bound to more than one fleet Container. Only Durable Object-managed Containers (schedulingPolicy: 'durable_object') can share a class.`,
+          });
+        }
+        merged.push(first);
+        continue;
+      }
+      if (managed.length !== classRows.length) {
+        return yield* new DurableObjectContainerConflict({
+          className,
+          message: `Durable Object class '${className}' mixes a fleet Container with Durable Object-managed Containers. Every Container bound to one class must use schedulingPolicy: 'durable_object'.`,
+        });
+      }
+      const names = [
+        ...new Set(managed.flatMap((row) => (row.name === undefined ? [] : [row.name]))),
+      ];
+      if (names.length > 1) {
+        return yield* new DurableObjectContainerConflict({
+          className,
+          message: `Durable Object class '${className}' resolves to more than one container application (${names.join(", ")}).`,
+        });
+      }
+      const images = yield* mergeImageMaps(
+        className,
+        "images",
+        managed.map((row) => row.images),
+      );
+      const devImages = yield* mergeImageMaps(
+        className,
+        "local images",
+        managed.map((row) => row.devImages),
+      );
+      const keys = Object.keys(images ?? devImages ?? {});
+      if (keys.length > MAX_NAMED_IMAGES) {
+        return yield* new DurableObjectContainerConflict({
+          className,
+          message: `Durable Object class '${className}' is bound to ${keys.length} container images; Cloudflare allows at most ${MAX_NAMED_IMAGES}.`,
+        });
+      }
+      const badKey = keys.find((key) => key.length === 0 || key.length > MAX_IMAGE_NAME_LENGTH);
+      if (badKey !== undefined) {
+        return yield* new DurableObjectContainerConflict({
+          className,
+          message: `Container id '${badKey}' is used as an image key and must contain between 1 and ${MAX_IMAGE_NAME_LENGTH} characters.`,
+        });
+      }
+      const hashes = managed.flatMap((row) => (row.hash === undefined ? [] : [row.hash])).sort();
+      merged.push({
+        ...first,
+        name: names[0],
+        images,
+        devImages,
+        dev: undefined,
+        hash: hashes.length === 0 ? undefined : hashes.join(","),
+      });
+    }
+    return merged;
+  });
+
+/**
+ * The `containers` entry a fleet Container contributes to the Durable Object
+ * class it backs.
  */
 export const workerContainerBinding = (className: string, application: ContainerApplication) => ({
   className,
-  name: Output.all(application.schedulingPolicy, application.applicationName).pipe(
-    Output.map(([policy, name]) => (policy === "durable_object" ? name : undefined)),
-  ),
-  images: application.images,
-  devImages: application.devImages,
   dev: application.dev,
   hash: application.hash.pipe(Output.map((hash) => hash?.image)),
 });
 
+/**
+ * The `containers` entry a Durable Object-managed Container contributes to
+ * its class: the class's application name plus this Container's one image,
+ * keyed by the Container's id. The Worker merges every entry of the class.
+ */
+export const durableObjectContainerBinding = (
+  className: string,
+  application: DurableObjectApplication,
+  container: ContainerApplication,
+) => {
+  const key = container.LogicalId;
+  return {
+    className,
+    name: application.applicationName,
+    images: container.image.pipe(
+      Output.map((image): Record<string, string> => (image === undefined ? {} : { [key]: image })),
+    ),
+    devImages: container.dev.pipe(
+      Output.map((dev): Record<string, DevContainerImage> =>
+        dev === undefined ? {} : { [key]: dev },
+      ),
+    ),
+    dev: undefined,
+    hash: container.hash.pipe(Output.map((hash) => hash?.image)),
+  };
+};
+
 /**
  * Converge declared settings and reset settings removed from a prior declaration.
  * Omitted settings on new or adopted applications remain unmanaged.
  */
 export const durableObjectSettingsPatch = (
-  news: DurableObjectContainerProps,
-  olds: AnyContainerApplicationProps | undefined,
+  desired: DurableObjectApplicationSettings,
+  previous: DurableObjectApplicationSettings | undefined,
   observed: Pick<Containers.GetContainerApplicationResponse, "configuration" | "observability">,
 ): Pick<Containers.UpdateContainerApplicationRequest, "configuration" | "observability"> => {
   const configuration: Containers.DurableObjectContainerConfiguration = {
     // Cloudflare names the SSH setting after the CLI that connects to it.
-    ...(news.ssh !== undefined
-      ? { wranglerSsh: news.ssh }
-      : olds?.ssh !== undefined
+    ...(desired.ssh !== undefined
+      ? { wranglerSsh: desired.ssh }
+      : previous?.ssh !== undefined
         ? { wranglerSsh: { enabled: false } }
         : {}),
-    ...(news.authorizedKeys !== undefined
-      ? { authorizedKeys: news.authorizedKeys }
-      : olds?.authorizedKeys !== undefined
+    ...(desired.authorizedKeys !== undefined
+      ? { authorizedKeys: desired.authorizedKeys }
+      : previous?.authorizedKeys !== undefined
         ? { authorizedKeys: [] }
         : {}),
   };
   const observability =
-    news.observability ??
-    (olds?.observability !== undefined ? { logs: { enabled: false } } : undefined);
+    desired.observability ??
+    (previous?.observability !== undefined ? { logs: { enabled: false } } : undefined);
   const configurationChanged = Object.entries(configuration).some(
     ([key, value]) =>
       !deepEqual(value, normalizeNulls(observed.configuration[key as keyof typeof configuration])),
@@ -206,6 +481,3 @@ export const durableObjectPlaceholder = (
   version: undefined,
   dev: undefined,
 });
-
-export const namedImageHash = (images: Record<string, string>) =>
-  Effect.map(sha256Object(images), (image) => ({ image, images }));

package/src/Cloudflare/Containers/ContainerPlatform.ts

@@ -14,7 +14,13 @@ import type {
   ContainerServices,
   ContainerShape,
 } from "./ContainerApplication.ts";
-import { workerContainerBinding } from "./ContainerConfiguration.ts";
+import {
+  containerApplicationSettings,
+  durableObjectContainerBinding,
+  isDurableObjectContainerResource,
+  workerContainerBinding,
+} from "./ContainerConfiguration.ts";
+import { declareDurableObjectApplication } from "./DurableObjectApplication.ts";
 
 const toHttpUrl = (url: string) =>
   url.startsWith("https:") ? `http:${url.slice("https:".length)}` : url;
@@ -50,17 +56,35 @@ const bindContainer = Effect.fn(function* <Shape, Req = never>(
     | Effect.Effect<ContainerApplication<Shape>, never, Req>,
 ) {
   const namespace = yield* DurableObject;
+  const worker = yield* Worker;
 
   const container = Effect.isEffect(containerEff) ? yield* containerEff : containerEff;
 
+  if (isDurableObjectContainerResource(container)) {
+    // The class has one container application. Every Container bound to it
+    // declares the same resource (deduped by id), attaches it to the
+    // namespace, and adds its application-wide settings; the Worker merges
+    // each Container's image into the class's `containers` entry.
+    const application = yield* declareDurableObjectApplication(worker, namespace.name);
+    yield* application.bind`${container.LogicalId}`({
+      durableObjects: { namespaceId: namespace.namespaceId },
+      container: {
+        id: container.LogicalId,
+        settings: containerApplicationSettings(container),
+      },
+    });
+    yield* worker.bind`${namespace.name}:${container.LogicalId}`({
+      containers: [durableObjectContainerBinding(namespace.name, application, container)],
+    });
+    return;
+  }
+
   yield* container.bind`${namespace}`({
     durableObjects: {
       namespaceId: namespace.namespaceId,
     },
   });
 
-  const worker = yield* Worker;
-
   yield* worker.bind`${container.LogicalId}`({
     containers: [workerContainerBinding(namespace.name, container)],
   });