ci: publish switchyard-server container from main

.dockerignore

@@ -8,3 +8,4 @@ benchmark/datasets
 benchmark/tb_runs
 dist
 site
+target

.github/workflows/server-container.yml

@@ -0,0 +1,88 @@
+name: Publish switchyard-server container
+
+on:
+  push:
+    branches: [main]
+  schedule:
+    - cron: "17 * * * *"
+
+permissions:
+  contents: read
+  packages: write
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name }}
+  cancel-in-progress: ${{ github.event_name == 'push' }}
+
+env:
+  PACKAGE_NAME: switchyard-server
+
+jobs:
+  publish:
+    name: Publish container
+    if: github.event_name == 'push'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Set image coordinates
+        id: image
+        shell: bash
+        run: |
+          echo "name=ghcr.io/${GITHUB_REPOSITORY_OWNER,,}/${PACKAGE_NAME}" >> "$GITHUB_OUTPUT"
+          echo "short_sha=${GITHUB_SHA::7}" >> "$GITHUB_OUTPUT"
+      - uses: docker/setup-buildx-action@v3
+      - uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Publish commit image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: crates/switchyard-server/Dockerfile
+          push: true
+          tags: ${{ steps.image.outputs.name }}:${{ steps.image.outputs.short_sha }}
+          build-args: |
+            IMAGE_VERSION=${{ steps.image.outputs.short_sha }}
+            VCS_REF=${{ github.sha }}
+          cache-from: type=gha,scope=switchyard-server
+          cache-to: type=gha,mode=max,scope=switchyard-server
+      - name: Publish main image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: crates/switchyard-server/Dockerfile
+          push: true
+          tags: ${{ steps.image.outputs.name }}:main
+          build-args: |
+            IMAGE_VERSION=main
+            VCS_REF=${{ github.sha }}
+          cache-from: type=gha,scope=switchyard-server
+
+  cleanup:
+    name: Delete expired commit images
+    if: github.event_name == 'schedule'
+    runs-on: ubuntu-latest
+    env:
+      GH_TOKEN: ${{ github.token }}
+    steps:
+      - name: Delete commit images older than 23 hours
+        shell: bash
+        run: |
+          set -euo pipefail
+          package_path="/orgs/${GITHUB_REPOSITORY_OWNER}/packages/container/${PACKAGE_NAME}/versions"
+          versions_file="${RUNNER_TEMP}/switchyard-server-versions.tsv"
+          cutoff="$(date -u -d '23 hours ago' +%s)"
+
+          gh api --paginate "${package_path}?per_page=100" \
+            --jq '.[] | [.id, .created_at, (.metadata.container.tags | join(","))] | @tsv' \
+            > "${versions_file}"
+
+          while IFS=$'\t' read -r version_id created_at tags; do
+            if [[ "${tags}" =~ ^[0-9a-f]{7}$ ]] \
+              && (( $(date -u -d "${created_at}" +%s) < cutoff )); then
+              echo "Deleting expired container tag ${tags}"
+              gh api --method DELETE "${package_path}/${version_id}"
+            fi
+          done < "${versions_file}"

crates/switchyard-server/Dockerfile

@@ -0,0 +1,30 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+ARG RUST_VERSION=1.96.1
+FROM rust:${RUST_VERSION}-bookworm AS builder
+
+WORKDIR /src
+COPY Cargo.toml Cargo.lock rust-toolchain.toml ./
+COPY crates ./crates
+RUN cargo build --locked --release -p switchyard-server
+
+FROM debian:bookworm-slim
+
+RUN apt-get update \
+    && apt-get install --yes --no-install-recommends ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY --from=builder /src/target/release/switchyard-server /usr/local/bin/switchyard-server
+
+ARG IMAGE_VERSION=local
+ARG VCS_REF=unknown
+LABEL org.opencontainers.image.source="https://github.com/NVIDIA-NeMo/Switchyard" \
+      org.opencontainers.image.description="Switchyard's libsy-based HTTP server" \
+      org.opencontainers.image.licenses="Apache-2.0" \
+      org.opencontainers.image.version="${IMAGE_VERSION}" \
+      org.opencontainers.image.revision="${VCS_REF}"
+
+USER 65532:65532
+EXPOSE 4000
+ENTRYPOINT ["/usr/local/bin/switchyard-server"]

crates/switchyard-server/README.md

@@ -40,6 +40,16 @@ export API_KEY="..."
 cargo run -p switchyard-server -- --config routes.toml
 ```
 
+The same server can run from the repository's Docker image:
+
+```bash
+docker run --rm -p 4000:4000 \
+  --env API_KEY \
+  --mount type=bind,src="$PWD/routes.toml",dst=/etc/switchyard/routes.toml,readonly \
+  ghcr.io/nvidia-nemo/switchyard-server:main \
+  --config /etc/switchyard/routes.toml
+```
+
 Target and route table names are local references. A target's `id` is the exact model ID sent
 upstream, and a route's `id` is the model clients send to select that algorithm.