# Containerize a model service and verify its boundary
Phase 15: Deployment, interoperability & edge AI · about 110 minutes · CPU
## What you will be able to do
- Separate training from inference
- Understand the build context
- Keep runtime inputs explicit
- Prove the same request survives the boundary
## The problem
Your model works in a notebook, but another machine has a different interpreter, library set and working directory. Let’s export a small prediction artifact, verify it in a fresh process, then run the same boundary in a real Docker container.
## The idea
Containerization packages a runtime environment; a running container executes a process; a model artifact supplies versioned numerical content. Keeping these identities separate makes deployment and debugging reproducible.
## An image, a process and an artifact have different identities
A container image can start successfully while loading the wrong model path or configuration. Conversely, a valid model artifact can fail because the runtime lacks a compatible dependency. Record the image identity and model/configuration identities together.
Trace the build context into the image, then configuration and artifact mounts into the running process. Mark the request boundary where decoding, validation, inference and response encoding happen. A readiness signal should reflect the actual service contract, not merely process existence.
The current subprocess experiment demonstrates a process boundary. It is not evidence that a Docker build or container benchmark ran. Use that distinction when extending the lesson to your own container execution and keep the resulting receipt.
$$
\text{Gate}(\mathcal{B}) = \mathbb{I}\!\left[\epsilon_{\text{parity}} \le \tau \;\wedge\; L_{p95} \le L_{\text{SLO}} \;\wedge\; \text{hash}(\mathcal{B}) = h_{\text{manifest}}\right]
$$
### What each deployment receipt proves
**Predict:** Which evidence would still be missing after the Python subprocess tests pass?
*Architecture and dataflow mechanism diagram.*
Each row identifies an object and the evidence needed to make a claim about it. The current companion supplies artifact checks and fresh-process predictions. An actual container run must add image, user and runtime evidence; device qualification adds hardware and workload measurements. Do not fill later rows with results from an earlier boundary.
### Pause and reason
Does pinning a container image automatically pin a model loaded from a mutable path?
Compare your reasoning
No. The external artifact can change independently. Pin and verify its identity as part of the release configuration.
Compare your reasoning
The hash proves byte identity, while finite-value and schema checks establish whether the service can interpret the artifact under its contract. Hash verification cannot replace these semantic checks.
Reference solution
```python
# Exercise solution: Reject an artifact whose bytes changed after its expected digest was...
original=json.dumps(MODEL,sort_keys=True).encode()
mutated=json.dumps(dict(MODEL,bias=2.),sort_keys=True).encode()
assert hashlib.sha256(original).hexdigest()!=hashlib.sha256(mutated).hexdigest()
print('Changed artifact requires a new recorded digest.')
```
Hint
The validation boundary should reject before producing JSON predictions.
Reference solution and reasoning
```python
# Reject a nonfinite request (transfer): A request can parse as JSON in Python while still violating...
# Create an isolated temporary directory to run and inspect artifacts safely:
with tempfile.TemporaryDirectory() as tmp:
p=Path(tmp)
(p/'model').write_text(json.dumps(MODEL))
(p/'service.py').write_text(SERVICE)
# Configure environment variable before initializing the runtime.
env=dict(os.environ,MODEL_PATH=str(p/'model'),MODEL_SHA256=hashlib.sha256((p/'model').read_bytes()).hexdigest())
bad=subprocess.run([sys.executable,str(p/'service.py')],input=json.dumps({'inputs':[float('inf')]}),text=True,capture_output=True,env=env)
assert bad.returncode != 0
print('Nonfinite input rejected before output.')
```
A request can parse as JSON in Python while still violating the numerical service contract.
Hint
A legitimate new digest permits loading. Independent expected predictions decide whether the changed behavior is acceptable.
Reference solution and reasoning
```python
# Check changed behavior after a legitimate artifact replacement (Transfer / diagnosis): The old model produced 5; the new one produces 7.
# Create an isolated temporary directory to run and inspect artifacts safely:
with tempfile.TemporaryDirectory() as directory:
model_path=Path(directory)/'model.json'
runner_path=Path(directory)/'service.py'
model_path.write_text(json.dumps(dict(MODEL,weight=3.)))
runner_path.write_text(SERVICE)
# Compute deterministic cryptographic digest `digest` for provenance verification.
digest=hashlib.sha256(model_path.read_bytes()).hexdigest()
# Configure environment variable before initializing the runtime.
changed=subprocess.run([sys.executable,str(runner_path)],input=json.dumps({'inputs':[2.]}),text=True,capture_output=True,check=True,env=dict(os.environ,MODEL_PATH=str(model_path),MODEL_SHA256=digest),timeout=30)
values=json.loads(changed.stdout)['predictions']
assert values==[7.] and values!=[5.]
print('New artifact loads, but the old behavioral expectation no longer passes.')
```
The old model produced $5$; the new one produces $7$. Neither a successful build nor a matching digest decides whether that change is desirable. Retain both identities and compare the release against the intended task criteria.
Answer and explanation
Load the expected artifact, verify its digest and complete a prediction through the target runtime.
A container image packages the service runtime and code. The model artifact, runtime configuration and release identity are separate inputs. A reproducible service verifies all of them instead of assuming that an image tag names the same bytes forever.