hud/integrations/harbor/) translates between Harbor
task directories and HUD’s native Environment, Task, and Taskset
contracts. adapt() packages Harbor tasks without publishing
images. export() materializes HUD tasks as self-contained Harbor folders.
hud harbor import brings Harbor tasks and the runs Harbor recorded into a HUD
taskset, to browse and compare them on the platform without running them again.
Adapt Harbor tasks
A Harbor source is either one task directory or a dataset directory containing task directories. Each task containstask.toml and instruction.md, plus an
environment image or build recipe and a tests/ verifier.
Multi-container sources use Harbor’s environment/docker-compose.yaml recipe
name; other Compose-like filenames remain ordinary environment files.
args,
Harbor metadata in columns, resource requirements in runtime_config, and,
when declared, a Task.verifier.
The row’s Compose path points into a generated project under .hud-adapt/.
Tasks that cannot be adapted appear in result.failures, with every detectable
finding classified by a stable code. Other tasks in the dataset are still
packaged.
AdaptResult.taskset contains the successfully adapted rows. AdaptResult.failures is a tuple of
AdaptFailure(task, path, findings) records, where each finding is an
AdaptFinding(code, kind, message) and kind is contract or invalid. adapt() raises
ValueError when the source contains no Harbor task directories.
linux/amd64 often pin dependencies that publish no wheels elsewhere, so adapt
them with DOCKER_DEFAULT_PLATFORM=linux/amd64 on an arm64 host.
The artifact is self-contained. Authored build contexts and Compose-relative
paths are rebased beneath compose-project/; task instructions remain in
tasks.json; inline tests remain outside the environment image and are mounted
read-only for the selected task. Build-only base and verifier services stay in
the Compose model with scale: 0 and feed the main build through named
service: contexts. The full recipe is covered in
Compose environments.
Tasks with identical environment and phase configuration share one generated
environment. A task with a verifier environment forms its own group because its
verifier image and artifact contract are task-specific. Pass name to name the
environment of a single task folder.
Run locally
DockerRuntime() reads the Compose project from each task row, starts the
main service and its sidecars, and applies the workspace security profile
automatically.
The generated task data is independent from the environment build. Editing an
instruction, verifier timeout, or inline tests/ content updates tasks.json
or the mounted test tree without changing the environment image identity.
Deploy and sync
Save the Compose configuration asruntime.json in the generated project root:
docker compose build and published on owned
infrastructure; see
Build on owned infrastructure.
Verifier environments
Harbor’senvironment_mode = "separate" and [verifier.environment]
declarations map to an authoritative verifier task. The adapter requires
tests/Dockerfile, builds its filesystem as a build-only service, and preserves
the agent/verifier phase boundary. Artifact collection, phase ordering, and
runtime isolation are described in
Verifier environments.
Supported Harbor surface
The adapter handles:- an
environment/Dockerfile, anenvironment.docker_image, or a Compose project; when authored Compose omitsmain, the environment recipe supplies that agent service; - the Compose variables Harbor defines (
CONTEXT_DIR,MAIN_IMAGE_NAME,CPUS,MEMORY,PREBUILT_IMAGE_NAME) and literal[environment.env]values, which take precedence over the project.env; - Compose sidecars, including ones that expose no TCP ports;
- HTTP MCP servers (
sseandstreamable-http), healthchecks, network modes, allowlists, phase users, environment variables, and placement requirements; - inline verifier scripts and separate verifier Dockerfiles;
- verifier collect hooks and declared artifact paths from
mainor a sidecar, including directory exclusions and host-side destinations.
contract: multi-step tasks (harbor.unsupported.multi_step), Compose
variables only the host environment could supply
(harbor.unsupported.host_compose_variable), and Compose include and
extends (harbor.unsupported.compose_include_extends). Malformed tasks fail
with findings of kind invalid, such as a project whose main service has
neither an image nor a valid build recipe.
Import into HUD
hud harbor import copies Harbor task folders and job runs into a taskset, the way
harbor publish and harbor upload send them to Harbor Hub:
One import can take both:
--no-wait returns once the
import starts; hud harbor imports lists imports, hud harbor report <import-id> prints
a report later, and hud harbor cancel <import-id> stops a running import. The
hud harbor reference covers taskset selection and
every option.
hud harbor import exits 1 when the import did not complete (stopped, failed, or
cancelled). Skipped and failed items are listed in the report and do not fail the
command; --json returns the import and the full report for scripts.
Harbor import describes the zip layout, what an import
creates, the report, reruns, and limits. The web app’s Import from Harbor takes the
same zip, and the taskset’s Imports tab lists the same imports.
Imported tasks are for browsing and comparing runs; HUD cannot run them. To run Harbor
tasks on HUD, adapt and deploy them.
Export HUD tasks to Harbor
export(source, out_dir) accepts a Python task source or a JSON/JSONL taskset
beside its environment source and Dockerfile:
tests/test.sh reconnects
to grade the parked task and writes the reward. This mapping requires Harbor’s
same-container verifier; exported task.toml files do not declare
[verifier.environment].
Only environments exposing ssh or mcp capabilities are exportable. The
task’s setup executes once while exporting instruction.md and once when the
container starts the graded task, so setup must be deterministic for its
arguments. Randomized state belongs in task arguments.
Validate the mapping
Run each Harbor task’ssolution/solve.sh against the adapted artifact before
evaluating a model. The reference solution should exercise the same environment
and verifier path and produce the expected reward. The generated prompt,
artifact declarations, and verifier should also be reviewed for answer leakage
and reward-hacking paths; Designing tasks for signal
covers that review.