Tutorial: Deploy a production-ready container¶

export DATAROBOT_ENDPOINT=https://app.datarobot.com/api/v2
export DATAROBOT_API_TOKEN=<your-api-token>

export MODEL="datarobot-deployed-llm"
export LLM_DEPLOYMENT_ID="<your-deployment-id>"
export RECIPIENT_USER_ID=""  # Leave blank to skip sharing

curl -s -X POST "${DATAROBOT_ENDPOINT}/workloads" \
  -H "Authorization: Bearer ${DATAROBOT_API_TOKEN}" \
  -H "Content-Type: application/json" \
  -d "$(jq -n \
    --arg endpoint "$DATAROBOT_ENDPOINT" \
    --arg token "$DATAROBOT_API_TOKEN" \
    '{
      "name": "agent-service",
      "importance": "high",
      "artifact": {
        "name": "agent-service-artifact",
        "type": "service",
        "spec": {
          "containerGroups": [{
            "name": "default",
            "containers": [{
              "name": "agent",
              "imageUri": "otkachnlp/fastapi-server-example:latest",
              "port": 8080,
              "primary": true,
              "entrypoint": ["python", "server.py"],
              "environmentVars": [
                {"name": "MODEL", "value": "azure/gpt-5-nano-2025-08-07"},
                {"name": "DATAROBOT_ENDPOINT", "value": $endpoint},
                {"name": "DATAROBOT_API_TOKEN", "value": $token}
              ],
              "readinessProbe": {"path": "/readyz", "port": 8080}
            }]
          }]
        }
      },
      "runtime": {
        "containerGroups": [{
          "name": "default",
          "replicaCount": 1,
          "containers": [{
            "name": "agent",
            "resourceAllocation": {"cpu": 1, "memory": "512MB"}
          }]
        }]
      }
    }'
  )" | tee /tmp/workload.json

When following this tutorial, consider the following:

- **Artifact vs. runtime.** The artifact's `spec` defines the container topology (image, port, entrypoint, env vars, probes), which is anything that travels with the artifact across deployments. Replica count, CPU/memory, autoscaling, and resource bundles are deployment-time concerns and live in `runtime.containerGroups[]`. Entries are looked up by group `name` (default group is `"default"`), and per-container allocations by container `name`. Both objects need names when you're customizing resources.

- - **OTel logs.** The artifact image supports OTel logs. To enable them, add `OTEL_EXPORTER_OTLP_ENDPOINT` to `environmentVars`. The container validates the required environment variables at startup and exits with an explicit error if any are missing, and the `/ready`z probe surfaces startup errors rather than masking them.

- `readinessProbe.path` is the gate to `running`. The platform polls that path on the container's port and only transitions the Workload to `running` once it returns 2xx. This tutorial points the probe at `/healthz`, which returns 2xx as soon as the FastAPI process is up. The container also exposes a /readyz endpoint that exercises the LLM connection, but keep the readiness probe pointed at /healthz. Gating running on an external dependency causes the Workload's status to flap whenever that dependency has issues. Keep the deep checks reachable as explicit endpoints your monitoring and runbooks can hit; don't make them block startup.

- **API token in env vars.** The FastAPI server authenticates against the DataRobot LLM deployment on every request, so the container needs an API token at runtime. The artifact spec passes `OPENAI_API_KEY` and `DATAROBOT_API_TOKEN` (the same value, in both common names) so whichever the server reads is populated. Baking a literal token into the artifact is fine for staging exploration; for production, switch to a `dr-credential`-sourced environment variable so the token isn't stored in the artifact spec.

curl -X PATCH "${DATAROBOT_ENDPOINT}/artifacts/${ARTIFACT_ID}" \
  -H "Authorization: Bearer ${DATAROBOT_API_TOKEN}" \
  -H "Content-Type: application/json" \
  -d '{"status": "locked"}'

curl -s "${DATAROBOT_ENDPOINT}/workloads/${WORKLOAD_ID}" \
  -H "Authorization: Bearer ${DATAROBOT_API_TOKEN}" | jq -r '.status'

ENDPOINT=$(curl -s "${DATAROBOT_ENDPOINT}/workloads/${WORKLOAD_ID}" \
  -H "Authorization: Bearer ${DATAROBOT_API_TOKEN}" | jq -r '.endpoint')

curl -X POST "${ENDPOINT}/chat/completions" \
  -H "Authorization: Bearer ${DATAROBOT_API_TOKEN}" \
  -H "Content-Type: application/json" \
  -d '{"model": "'"${MODEL}"'", "messages": [{"role": "user", "content": "Hello!"}]}'

curl -X PATCH "${DATAROBOT_ENDPOINT}/workloads/${WORKLOAD_ID}" \
  -H "Authorization: Bearer ${DATAROBOT_API_TOKEN}" \
  -H "Content-Type: application/json" \
  -d '{"importance": "critical"}'

curl -X PATCH "${DATAROBOT_ENDPOINT}/workloads/${WORKLOAD_ID}/sharedRoles" \
  -H "Authorization: Bearer ${DATAROBOT_API_TOKEN}" \
  -H "Content-Type: application/json" \
  -d '{
    "operation": "updateRoles",
    "roles": [{"id": "<recipient-id>", "role": "USER", "shareRecipientType": "user"}]
  }'

curl -s "${DATAROBOT_ENDPOINT}/workloads/${WORKLOAD_ID}/events" \
  -H "Authorization: Bearer ${DATAROBOT_API_TOKEN}"

curl -s "${DATAROBOT_ENDPOINT}/workloads/${WORKLOAD_ID}/stats" \
  -H "Authorization: Bearer ${DATAROBOT_API_TOKEN}"