CAPSTONE  ·  DAY 2

Ship the Acme AI Support Platform

Every module snapped together into one deployable product — end-to-end

M1 · M2 M3 · M4 M5 · M6 M7 · M8 Acme AI ships on any OCI runtime

Gourav Shah  ·  School of DevOps & AI  ·  Capstone · Day 2

CAP·01

What you'll assemble — the whole platform

One dispatch centre: a native brain, containerized teams, a sealed supply chain.

Host — native Ollama :11434 shared brain Containers Docs Assistant M5 Support Agent M6 Incident Crew M7 ChromaDB ToolHive Supply chain ModelKit M4 SBOM · sign M8 CI ship M8

The container boundary is the rule: the model stays native, everything else is a container.

CAP·02

How the modules connect

Each rung you built maps to exactly one capability of the shipped platform.

M1 · container-native + host wiring M2 · OpenAI-compatible serving M3 · vLLM CPU serving path M4 · ModelKit — versioned artifact M5 · Docs Assistant — naive RAG M6 · declarative agent + MCP M7 · Incident Crew — multi-agent M8 · SBOM · scan · sign · CI Acme AI Support Platform

Nothing was thrown away — the capstone is the sum of eight modules, wired together.

CAP·03

Move 1 — Serve the model

One brain, two homes: Ollama native on Mac, or vLLM in a container on CPU / GPU.

Ollama — native Metal · unified memory vLLM — container CPU (SmolLM2) or GPU /v1 OpenAI API Every consumer app · agent · crew

Swap the engine behind the wall socket — no downstream container changes a single line.

CAP·04

Move 2 — Run the Incident Crew

Four specialists in sequence — MCP tools via ToolHive, Docs Assistant as shared knowledge.

Triage Investigate Fix Review ToolHive · MCP ChromaDB · docs one native model serves all four agents

Specialisation with an approval gate — a traceable, auditable incident-response report.

CAP·05

Move 3 — Package as a ModelKit

Weights, system prompt, and quantization config sealed into one OCI artifact.

model weights system prompt quant config ModelKit one OCI artifact kit push Registry GHCR · versioned

One command pulls exactly that version — no shared drives, no stray prompt files.

CAP·06

Move 4 — Secure the image

Inventory it, scan it, sign it — and sandbox every tool the agents run.

SBOM Scan Sign Verify Syft Trivy · Grype Cosign any consumer fail threshold → rejected Sandboxed tool execution ToolHive isolates every MCP tool call

An image that fails the scan never reaches the registry; a passing one is signed and attested.

CAP·07

Move 5 — Ship via CI

Push to main and the pipeline builds, scans, signs, and publishes on its own.

push build scan sign to main image gate cosign GHCR signed failed scan blocks the push — nothing ships

A passing build produces a signed, attested image any host can pull and verify.

CAP·08

Move 6 — The portability proof

Swap the runtime, re-run platform-check.sh — the output is identical.

Colima Rancher OrbStack Same platform OCI images · Compose Spec host.docker.internal ModelKit · Cosign referrers Identical output

The spec, not the vendor, defines the contract — steps 1–7 run unchanged on every runtime.

CAP·09

The arc you shipped

Naive RAG → Agentic RAG → Crew — each pattern earning its keep in turn.

Naive RAG Agentic RAG Crew always retrieves routes, then acts decomposes the task simple & predictable ————————→ capable & auditable

You learned not just how each pattern works, but when it is the right one to reach for.

CAP·10

YOU SHIPPED IT

You can now ship AI on any runtime

serve · run · package · secure · ship Acme AI Any runtime

Same architecture, new domain — swap the runbooks, keep the wiring.

Build it once. Run it anywhere.  ·  Gourav Shah · School of DevOps & AI

CAP·11