feat(demo): deliver four-Pod MVP installation and benchmark package

.github/workflows/demo-image.yml

@@ -0,0 +1,135 @@
+# Author: SqlRush <sqlrush@gmail.com>
+name: Four-Pod demo image
+
+on:
+  pull_request:
+    branches: [main]
+    paths: ['deploy/demo/**', '.github/workflows/demo-image.yml']
+  workflow_dispatch:
+    inputs:
+      publish:
+        description: 'Publish the tested image (main only, after required CI succeeds)'
+        type: boolean
+        default: false
+
+permissions:
+  contents: read
+
+jobs:
+  native:
+    name: Native demo (${{ matrix.arch }})
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - arch: amd64
+            runner: ubuntu-24.04
+          - arch: arm64
+            runner: ubuntu-24.04-arm
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@v4
+      - name: Dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y podman python3 util-linux
+          sudo modprobe loop
+      - name: Build frozen product image natively
+        run: sudo podman build --network=host -t localhost/pgrac-demo:v0.131.0-demo.1 deploy/demo
+      - name: Prove restricted socket admission before database startup
+        run: |
+          set -euo pipefail
+          sudo podman run --rm --network=host --cap-drop=ALL --user=10001:10001 \
+            localhost/pgrac-demo:v0.131.0-demo.1 runtime-check
+      - name: Four Pods, full rows, workload, normal restart, workload
+        run: deploy/demo/ci-smoke.sh localhost/pgrac-demo:v0.131.0-demo.1
+      - name: Retain summaries and runtime-only failure evidence
+        if: always()
+        run: |
+          mkdir -p demo-results
+          sudo dmesg | grep 'apparmor="DENIED"' > demo-results/apparmor-denials.txt || true
+          sudo podman ps -a > demo-results/containers.txt
+          for node in 0 1 2 3; do
+            sudo podman logs "pgrac-ci-demo-$node-db" > "demo-results/container-$node.log" 2>&1 || true
+            if sudo test -f "/var/lib/pgrac-demo/ci-demo/storage/server-log/node$node.log"; then
+              sudo cp "/var/lib/pgrac-demo/ci-demo/storage/server-log/node$node.log" "demo-results/server-$node.log"
+            fi
+          done
+          # Never export bootstrap logs, credentials, settings or entire PGDATA.
+          if sudo test -d /var/lib/pgrac-demo/ci-demo/reports; then
+            sudo find /var/lib/pgrac-demo/ci-demo/reports -name summary.json -type f \
+              -exec cp --parents '{}' "$PWD/demo-results" \;
+          fi
+          sudo chown -R "$(id -u):$(id -g)" demo-results
+      - uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: demo-results-${{ matrix.arch }}
+          path: demo-results
+          retention-days: 14
+      - name: Export the exact tested image
+        if: github.event_name == 'workflow_dispatch' && inputs.publish && github.ref == 'refs/heads/main'
+        run: |
+          sudo podman save --format oci-archive -o "$RUNNER_TEMP/demo-${{ matrix.arch }}.tar" \
+            localhost/pgrac-demo:v0.131.0-demo.1
+          sudo chmod 644 "$RUNNER_TEMP/demo-${{ matrix.arch }}.tar"
+      - uses: actions/upload-artifact@v4
+        if: github.event_name == 'workflow_dispatch' && inputs.publish && github.ref == 'refs/heads/main'
+        with:
+          name: demo-image-${{ matrix.arch }}
+          path: ${{ runner.temp }}/demo-${{ matrix.arch }}.tar
+          retention-days: 2
+
+  publish:
+    if: github.event_name == 'workflow_dispatch' && inputs.publish && github.ref == 'refs/heads/main'
+    needs: native
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      checks: read
+      packages: write
+    env:
+      GH_TOKEN: ${{ github.token }}
+      IMAGE: ghcr.io/sqlrush/pgrac-demo
+      VERSION: v0.131.0-demo.1
+    steps:
+      - uses: actions/checkout@v4
+      - name: Require all protected CI checks on this exact main commit
+        run: |
+          gh api --paginate "repos/$GITHUB_REPOSITORY/commits/$GITHUB_SHA/check-runs?per_page=100" \
+            --jq '.check_runs[] | {name,conclusion,started_at}' > checks.jsonl
+          python3 deploy/demo/release_gate.py checks.jsonl
+      - name: Tools
+        run: sudo apt-get update && sudo apt-get install -y podman
+      - uses: actions/download-artifact@v4
+        with:
+          pattern: demo-image-*
+          path: images
+          merge-multiple: true
+      - name: Publish tested native images and multi-architecture index
+        env:
+          REGISTRY_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          printf '%s' "$REGISTRY_TOKEN" | podman login ghcr.io -u "$GITHUB_ACTOR" --password-stdin
+          # Release names are never overwritten. A new delivery requires a new version.
+          if podman manifest inspect "docker://$IMAGE:$VERSION" >/dev/null 2>&1; then
+            echo 'Version already exists; refusing to overwrite it.' >&2
+            exit 1
+          fi
+          for arch in amd64 arm64; do
+            podman load -i "images/demo-$arch.tar"
+            podman tag localhost/pgrac-demo:v0.131.0-demo.1 "$IMAGE:$VERSION-$GITHUB_RUN_ID-$arch"
+            podman push "$IMAGE:$VERSION-$GITHUB_RUN_ID-$arch"
+          done
+          podman manifest create demo-release \
+            "docker://$IMAGE:$VERSION-$GITHUB_RUN_ID-amd64" \
+            "docker://$IMAGE:$VERSION-$GITHUB_RUN_ID-arm64"
+          podman manifest push --all --digestfile image-digest.txt demo-release "docker://$IMAGE:$VERSION"
+          printf 'Published %s@%s\n' "$IMAGE" "$(cat image-digest.txt)" >> "$GITHUB_STEP_SUMMARY"
+          podman logout ghcr.io
+      - uses: actions/upload-artifact@v4
+        with:
+          name: demo-release-digest
+          path: image-digest.txt

deploy/demo/.containerignore

@@ -0,0 +1,6 @@
+__pycache__
+tests
+*.pyc
+*.tar
+*.tar.gz
+reports

deploy/demo/.gitignore

@@ -0,0 +1,3 @@
+__pycache__/
+tests/__pycache__/
+*.pyc

deploy/demo/Containerfile

@@ -0,0 +1,42 @@
+# Single-host customer demo. Author: SqlRush <sqlrush@gmail.com>
+FROM docker.io/library/ubuntu:24.04@sha256:008173c23f95b170204355c12626cb5a965d779a7e1283b09e9cffbb1bf33ca3 AS build
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    build-essential bison flex pkg-config curl ca-certificates libreadline-dev \
+    zlib1g-dev libssl-dev libicu-dev liblz4-dev libzstd-dev perl libipc-run-perl
+WORKDIR /build
+RUN curl --fail --location --retry 3 --output source.tar.gz \
+    https://codeload.github.com/sqlrush/pgrac/tar.gz/83d8c5a002643581f153058b7a766afe1ffa1eb0 \
+    && echo 'c5b37e5413db30d3a882da4eac9b52208e9dafeb7b5175d1d6c5caff3201d1f2  source.tar.gz' | sha256sum -c - \
+    && tar -xzf source.tar.gz --strip-components=1
+RUN ./configure --prefix=/opt/pgrac --enable-cluster --enable-tap-tests \
+    --with-openssl --with-icu --with-lz4 --with-zstd \
+    && make -j4 && make install && make -C src/test/regress pg_regress \
+    && mkdir -p /opt/pgrac/test /opt/pgrac/licenses \
+    && cp -a src/test/perl /opt/pgrac/test/ \
+    && cp src/test/regress/pg_regress /opt/pgrac/test/ \
+    && cp COPYRIGHT /opt/pgrac/licenses/PostgreSQL-COPYRIGHT \
+    && sha256sum /opt/pgrac/bin/postgres > /opt/pgrac/postgres.sha256
+
+FROM docker.io/library/ubuntu:24.04@sha256:008173c23f95b170204355c12626cb5a965d779a7e1283b09e9cffbb1bf33ca3
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    ca-certificates libreadline8t64 zlib1g libssl3t64 libicu74 liblz4-1 libzstd1 \
+    python3 perl libipc-run-perl procps util-linux \
+    && groupadd --gid 10001 pgrac && useradd --uid 10001 --gid 10001 --create-home pgrac
+COPY --from=build /opt/pgrac /opt/pgrac
+COPY bootstrap.pl entrypoint.py demo_lib.py /opt/pgrac/demo/
+COPY sql /opt/pgrac/demo/sql
+LABEL org.opencontainers.image.title="PGRAC single-host four-Pod demo" \
+      org.opencontainers.image.source="https://github.com/sqlrush/pgrac" \
+      org.opencontainers.image.version="v0.131.0-demo.1" \
+      org.opencontainers.image.revision="83d8c5a002643581f153058b7a766afe1ffa1eb0" \
+      org.opencontainers.image.licenses="PostgreSQL"
+ENV PATH="/opt/pgrac/bin:$PATH" LANG=C.UTF-8 \
+    PERL5LIB=/opt/pgrac/test/perl PG_REGRESS=/opt/pgrac/test/pg_regress \
+    PG_TEST_NOCLEAN=1 PG_TEST_TIMEOUT_DEFAULT=180 PGRAC_STAGE8_HAPPY_PATH_ONLY=1 \
+    TESTDATADIR=/demo/tap TESTLOGDIR=/demo/setup-log TEMP_CONFIG=/demo/seed.conf \
+    PGPASSFILE=/demo/client.pgpass PGCONNECT_TIMEOUT=5
+USER 10001:10001
+WORKDIR /demo
+STOPSIGNAL SIGTERM
+# Set NNP after the container's AppArmor transition, before any database code.
+ENTRYPOINT ["setpriv", "--no-new-privs", "python3", "/opt/pgrac/demo/entrypoint.py"]