tl deploy: build function images via sandbox-image builder (drop v2/v3)

.github/workflows/integration_test.yaml

@@ -90,9 +90,7 @@ jobs:
                 --build-env PIP_EXTRA_INDEX_URL=https://pypi.org/simple/
 
               echo "--- 2. Deploy ---"
-              tl deploy /tmp/test_app.py \
-                --build-env PIP_INDEX_URL=https://test.pypi.org/simple/ \
-                --build-env PIP_EXTRA_INDEX_URL=https://pypi.org/simple/
+              tl deploy /tmp/test_app.py
 
               echo "--- All integration tests passed ---"
             '

crates/cli/src/main.rs

@@ -111,7 +111,7 @@ enum Commands {
 
     /// Deploy applications to Tensorlake Cloud
     Deploy {
-        /// Arguments passed to the deploy Python module (use --build-env KEY=VALUE to inject ENV directives into generated Dockerfiles)
+        /// Arguments passed to the deploy Python module
         #[arg(trailing_var_arg = true, allow_hyphen_values = true)]
         args: Vec<String>,
     },

src/tensorlake/applications/remote/deploy.py

@@ -1,5 +1,5 @@
 import os
-from typing import List, Set
+from typing import Dict, List, Set
 
 from ..applications import filter_applications
 from ..interface.function import Function
@@ -8,6 +8,7 @@
     ApplicationManifest,
     create_application_manifest,
 )
+from ..remote.manifests.function_manifests import ImageRef
 from .code.ignored_code_paths import ignored_code_paths
 from .code.loader import load_code
 from .code.zip import zip_code
@@ -18,6 +19,7 @@ def deploy_applications(
     upgrade_running_requests: bool = True,
     load_source_dir_modules: bool = False,
     api_client=None,
+    image_refs: Dict[str, ImageRef] | None = None,
 ) -> None:
     """Deploys all applications in the supplied .py file so they are runnable in remote mode (i.e. on Tensorlake Cloud).
 
@@ -61,7 +63,9 @@ def deploy_applications(
     try:
         for application in filter_applications(functions):
             app_manifest: ApplicationManifest = create_application_manifest(
-                application_function=application, all_functions=functions
+                application_function=application,
+                all_functions=functions,
+                image_refs=image_refs,
             )
             api_client.upsert_application(
                 manifest_json=app_manifest.model_dump_json(),

src/tensorlake/applications/remote/manifests/application.py

@@ -18,6 +18,7 @@
 )
 from ...interface.function import Function, _ApplicationConfiguration
 from .function import FunctionManifest, create_function_manifest
+from .function_manifests import ImageRef
 
 
 class EntryPointInputManifest(BaseModel):
@@ -63,18 +64,29 @@ def model_dump_json(self, **kwargs: Any) -> str:
 
 
 def create_application_manifest(
-    application_function: Function, all_functions: List[Function]
+    application_function: Function,
+    all_functions: List[Function],
+    image_refs: Dict[str, ImageRef] | None = None,
 ) -> ApplicationManifest:
     """Creates ApplicationManifest for the supplied application function.
 
+    `image_refs` maps `Image._id` to the pre-built image reference for any
+    function whose image was built up-front (e.g. through the sandbox-template
+    builder). Functions without a mapped image get `image_ref=None` and the
+    platform falls through to the legacy image lookup.
+
     Raises TensorlakeError on error.
     """
     app_config: _ApplicationConfiguration = application_function._application_config
     app_signature: inspect.Signature = function_signature(application_function)
 
+    image_refs = image_refs or {}
     function_manifests: Dict[str, FunctionManifest] = {
         fn._function_config.function_name: create_function_manifest(
-            application_function, app_config.version, fn
+            application_function,
+            app_config.version,
+            fn,
+            image_ref=image_refs.get(fn._function_config.image._id),
         )
         for fn in all_functions
     }

src/tensorlake/applications/remote/manifests/function.py

@@ -32,6 +32,7 @@
 )
 from .function_manifests import (
     FunctionResourcesManifest,
+    ImageRef,
     JSONSchema,
     ParameterManifest,
     PlacementConstraintsManifest,
@@ -60,6 +61,10 @@ class FunctionManifest(pydantic.BaseModel):
     warm_containers: int | None = None
     min_containers: int | None = None
     max_containers: int | None = None
+    # Reference to the pre-built image the platform should run this function
+    # on. When None, the platform looks the image up through its legacy
+    # Image-Builder-Service-keyed path (function namespace/app/name/version).
+    image_ref: ImageRef | None = None
 
 
 @dataclass
@@ -208,10 +213,18 @@ def _function_return_type_schema(
 
 
 def create_function_manifest(
-    application_function: Function, application_version: str, function: Function
+    application_function: Function,
+    application_version: str,
+    function: Function,
+    image_ref: ImageRef | None = None,
 ) -> FunctionManifest:
     """Creates FunctionManifest for the supplied function.
 
+    `image_ref` is the pre-built image reference the platform should use to
+    run this function. Pass it when the deploy flow built the function's
+    image through the sandbox-template path; leave None to fall through to
+    the platform's legacy image-builder-service lookup.
+
     Raises TensorlakeError on error.
     """
     app_config: _ApplicationConfiguration = application_function._application_config
@@ -286,6 +299,7 @@ def create_function_manifest(
         description=function._function_config.description,
         docstring=docstring,
         is_api=function._application_config is not None,
+        image_ref=image_ref,
         secret_names=function._function_config.secrets,
         # When a function doesn't have a class_init_timeout set it means it's not a class method.
         # In this case FE initialization timeout should be the same as function timeout.

src/tensorlake/applications/remote/manifests/function_manifests.py

@@ -2,6 +2,7 @@
     Any,
     Dict,
     List,
+    Literal,
     Union,
 )
 
@@ -108,3 +109,22 @@ class RetryPolicyManifest(BaseModel):
 
 class PlacementConstraintsManifest(BaseModel):
     filter_expressions: List[str]
+
+
+class ImageRef(BaseModel):
+    """Reference to a pre-built image for a function executor.
+
+    `kind == "sandbox_template"` points at a sandbox template registered via
+    the SDK's sandbox image builder; the dataplane resolves it to an ext4
+    filesystem snapshot and boots a Firecracker VM directly from that rootfs.
+
+    `kind == "oci"` points at an OCI image (e.g. from the Image Builder
+    Service); the dataplane imports the rootfs at runtime. This is the legacy
+    path and is the implicit shape when `image_ref` is absent on a function
+    manifest.
+    """
+
+    kind: Literal["sandbox_template", "oci"]
+    # For `sandbox_template`: the platform sandbox-template id. For `oci`:
+    # the image URI (e.g., `registry/path@digest`).
+    id: str