Deployment
Building. oxl build compiles a package or a file; the profile selects the optimization and debug-information level:
dev (no optimization, full debug information, contracts and traces on), test, and prod (opt = 3, line tables instead of
full debug information, contracts and traces off). Profiles are tuned in [profile.prod] of oxl.toml (III.2).
oxl build --profile prod --image registry.local/shop:0.3.0 writes an image without Docker: the program, its shared libraries
and the root certificates in the OCI format (--image oci:<dir>[:tag] is a layer directory, --image name[:tag] an archive
build/image/name-tag.tar). Load the image with the usual skopeo copy / docker load / ctr images import.
oxl build --profile prod
oxl build --profile prod --image shop:0.3.0 # build/image/shop-0.3.0.tarRunning a node. One binary for all roles. The role, the address and the data are flags of oxl run / the binary or
environment variables (§III.6):
| Flag | Variable | Purpose |
|---|---|---|
--role r1,r2 | OXL_ROLE | roles of the node (otherwise assign by … of the cluster) |
--listen a | OXL_LISTEN | address of the inter-node protocol and gRPC |
--data-dir d | OXL_DATA_DIR | data of the node's built-in storage |
--profile p | OXL_PROFILE | configuration profile (dev by default); in production the dev modes are refused |
--set K=V | APP_* | a config value |
--log-level l | OXL_LOG | log level (info by default) |
The cluster is always protected by mTLS: certificates come from the built-in CA (oxl cluster: init,
token create, node remove) or an external one (OXL_CLUSTER_CERT/KEY/CA); oxl dev uses a throw-away dev CA. In the
production profile the dev CA and --insecure-dev are disabled (§13.1).
Kubernetes. seeds k8s(label: "app=shop") finds nodes by labels; the number of replicas of a role is replicas a..b; the
role of a node comes from the pod label oxl/role (assign by env("OXL_ROLE") else label("oxl/role") else auto). On
SIGTERM/SIGINT a node drains requests (drain in defaults, 30 s by default; §2.4).
Observability. Metrics, logs and traces are part of the language and runtime: OpenTelemetry (OTLP) is exported when
OTEL_EXPORTER_OTLP_ENDPOINT is set; @trace(sample: p), trace_sample in the cluster; the live interface is
oxl inspect, the profiler is oxl prof, recording and replaying traffic are
oxl trace --record and oxl replay (observability guide).
Upgrades. The compatibility of rpc and data schemas is checked at build time against oxl.schema.lock (SemVer: adding fields
is minor, a breaking change is major); oxl publish refuses incompatible changes. Table migrations: oxl db.