Jobs
Run a container image once, until it exits — a migration, an import, a report — and read its output.
A job runs a container image once, until the container exits. You give it the image, a tag,
environment variables and a compute plan; the platform runs it as a Kubernetes Job in a resource
group, and you read its output and see whether it succeeded. Jobs are used with the stsh CLI
and the API — the portal has no page for them.
When to use a job
| You need | Use |
|---|---|
| A task that runs to completion when you start it: a database migration, an import, a one-off report | A job |
| A container that keeps running: a service, a worker, a queue consumer | A container instance — see Container Instances |
| Code that runs on a schedule | A function with a timer trigger — see Timer triggers |
What a job does not do
- No schedule. A job runs once, when you create it.
- No retries. When the container exits with an error, the job fails; it is not started again.
- No rerun. To run the same job again, delete it and create it anew, or create one with a new name.
- No secrets or registry credentials. A job's environment variables are plain text; see the caution below. There is no field for a private registry's credentials either.
- No arguments. The container runs the image's own entrypoint and command.
Caution
A job's environment variables are stored in plain text on the job and on its pod. Everyone who can read the job (
jobs/read, which Platform Reader holds in every boundary) sees them, and so does anyone whose Kubernetes access lets them read pods in the resource group's namespace. When the platform refuses a job, the whole job, variables included, is also written to the platform's logs. Do not put passwords, tokens or keys in a job's environment variables.
A job's life
- The job is created in the resource group's namespace on the cluster you name, and its pod starts with the CPU and memory of its compute plan.
- It runs until the container exits. Exit code 0 means Succeeded; anything else, or running out of memory, means Failed.
- A job still running when its deadline passes — one hour unless you set another — is stopped and Failed.
- One hour after it finished — or after the time you set — Kubernetes removes the job, together with its pod and its output. After that the job no longer appears and its name is free again.
The fields, defaults and compute plans are listed in Job settings.
In a boundary's network view, Build job stands for the platform's own builds of apps, functions and static web apps, not for jobs you run.