name: Container Step
description: Workflows demonstrating container build, push, and run steps.

workflows:
  workflow-container:
    description: Run multiple shell steps in one workflow-level container sandbox
    working_directory: .
    container:
      image: alpine:latest
      workspace: /workspace
      cleanup: always
      env:
        CONTAINER_MESSAGE: "hello from container env"
      mounts:
        - source: .
          target: /repo-readonly
          read_only: true
    env:
      WORKFLOW_MESSAGE: "hello from workflow env"
    steps:
      - name: first
        type: shell
        command: |
          echo "$CONTAINER_MESSAGE"
          echo "$WORKFLOW_MESSAGE"
          pwd

      - name: step-env
        type: shell
        env:
          WORKFLOW_MESSAGE: "hello from step env"
        command: echo "$WORKFLOW_MESSAGE"

      - name: host
        type: shell
        container: false
        command: echo "this step runs on the host"

  hello:
    description: Run a simple command in a container
    steps:
      - name: hello
        type: container
        action: run
        with:
          image: alpine:latest
          command: echo "hello from a workflow container"

  build-run:
    description: Build a local image and run it in a later step
    steps:
      - name: build
        type: container
        action: build
        with:
          context: .
          dockerfile: Dockerfile
          tags:
            - atmos-container-step:local
        outputs:
          image: "{{ .metadata.image }}"

      - name: run
        type: container
        action: run
        with:
          image: "{{ .steps.build.outputs.image }}"
          command: |
            /usr/local/bin/example
            uname -a

  bake-build-run:
    description: Build a local image with Docker Buildx Bake and run it in a later step
    steps:
      - name: build
        type: container
        action: build
        provider: docker
        with:
          engine: buildx
          tags:
            - atmos-container-step:bake
          bake:
            file: docker-bake.hcl
            target: app
            vars:
              TAG: atmos-container-step:bake
            load: true
        outputs:
          image: "{{ .metadata.image }}"

      - name: run
        type: container
        action: run
        with:
          image: "{{ .steps.build.outputs.image }}"
          command: /usr/local/bin/example

  push-local-registry:
    description: Build, push to localhost:5000, then run the pushed reference
    steps:
      - name: build
        type: container
        action: build
        with:
          context: .
          dockerfile: Dockerfile
          tags:
            - atmos-container-step:local
        outputs:
          image: "{{ .metadata.image }}"

      - name: push
        type: container
        action: push
        with:
          image: "{{ .steps.build.outputs.image }}"
          tags:
            - localhost:5000/atmos-container-step:local
        outputs:
          image: "{{ .metadata.image }}"
          digest: "{{ .metadata.digest }}"

      - name: run
        type: container
        action: run
        with:
          image: "{{ .steps.push.outputs.image }}"
          command: |
            /usr/local/bin/example
            uname -a

  # Requires AWS access and the `auth:` block in atmos.yaml (a real provider,
  # account, and ECR registry). `identity:` authenticates the step, which
  # auto-provisions the linked `aws/ecr` integration (Docker login). The push
  # then uses those credentials — no explicit `docker login` step needed.
  push-ecr:
    description: Build and push to a private ECR registry using an Atmos identity
    steps:
      - name: build
        type: container
        action: build
        identity: dev-admin
        with:
          context: .
          dockerfile: Dockerfile
          tags:
            - 123456789012.dkr.ecr.us-east-2.amazonaws.com/atmos-container-step:local
        outputs:
          image: "{{ .metadata.image }}"

      - name: push
        type: container
        action: push
        identity: dev-admin
        with:
          image: "{{ .steps.build.outputs.image }}"
        outputs:
          image: "{{ .metadata.image }}"
          digest: "{{ .metadata.digest }}"

  workspace:
    description: Show the default workspace mount
    steps:
      - name: workspace
        type: container
        action: run
        with:
          image: alpine:latest
          command: |
            uname -a
            echo "container workspace:"
            pwd
            echo "workspace files:"
            ls -la

  env:
    description: Pass workflow and step env into the container
    env:
      WORKFLOW_MESSAGE: "hello from workflow env"
    steps:
      - name: env
        type: container
        env:
          STEP_MESSAGE: "hello from step env"
        action: run
        with:
          image: alpine:latest
          command: |
            echo "$WORKFLOW_MESSAGE"
            echo "$STEP_MESSAGE"

  failing-check:
    description: Simulate a scanner or linter failure
    steps:
      - name: check
        type: container
        action: run
        with:
          image: alpine:latest
          command: |
            echo "simulated check failed" >&2
            exit 1

  shell:
    description: Open an optional interactive container shell
    steps:
      - name: shell
        type: container
        tty: true
        interactive: true
        action: run
        with:
          image: alpine:latest
          command: /bin/sh