DIAL App Controller configuration

This reference covers App Controller 0.5.1 settings for platform engineers deploying Code Apps or interpreter sessions. It assumes the dependencies in the overview are available. Controller settings and Core's connection settings belong to different processes.

Version scope and configuration sources

Defaults come from the released application.yaml, configuration model, and service property reads. Scalar settings are exposed through Spring environment variables. Structured Kubernetes templates are app.* YAML properties.

The release README lists APP_TEMPLATE_CONTAINER and APP_BUILDER_CONTAINER as scalar names. In code, these properties are container objects, with default names template-container and builder-container. Their YAML structure below is authoritative.

Kubernetes and DIAL access

Variable	Default	Description
APP_KUBE_CONFIG	${user.home}/.kube/config	Kubeconfig file. It must be readable by the controller user.
APP_BUILD_CONTEXT	—	Build-client context. Unset or blank keeps the kubeconfig's selected context.
APP_DEPLOY_CONTEXT	—	Deployment-client context. Unset or blank keeps the kubeconfig's selected context.
APP_BUILD_NAMESPACE	default	Namespace for build Jobs and their Secrets.
APP_DEPLOY_NAMESPACE	default	Namespace for Knative services and interpreter session pods.
APP_DIAL_BASE_URL	—	Required DIAL Core URL passed to the source preparation container.

The two clients are constructed at startup from the kubeconfig; see WebFluxConfig. Permissions must cover the resources each client manages in its namespace.

Registry and image names

Variable	Default	Description
APP_DOCKER_REGISTRY	—	Required registry host and optional repository prefix used to name application images.
APP_DOCKER_REGISTRY_PROTOCOL	https	Protocol used by the controller's registry API calls.
APP_DOCKER_REGISTRY_AUTH	NONE	Registry authentication: NONE or BASIC.
APP_DOCKER_REGISTRY_USER	—	Required with BASIC.
APP_DOCKER_REGISTRY_PASS	—	Required with BASIC.
APP_DOCKER_CONFIG_PATH	/kaniko/.docker/config.json	Mount path of the Docker authentication file in the image-builder container.
APP_IMAGE_NAME_FORMAT	app-%s	Image name format; %s is replaced with the operation's name.
APP_IMAGE_LABEL	latest	Tag of generated application images. This is independent of the controller image's release tag.

For BASIC, the controller validates that both credentials exist and creates a Docker configuration in the build Secret. Image cleanup reads the manifest digest and requests registry deletion; see RegistryService.

Build and runtime selection

Variable	Default	Description
APP_TEMPLATE_IMAGE	${app.docker-registry}/builder-template:latest	Source preparation image. Point this at the published App Builder Python image or a compatible image.
APP_BUILDER_IMAGE	gcr.io/kaniko-project/executor:latest	Image-building container. The default arguments use Kaniko's interface.
APP_DEFAULT_RUNTIME	python3.11	Runtime selected when an image request omits runtime.
APP_IMAGE_BUILD_TIMEOUT_SEC	300	Maximum wait for the build Job, in seconds.
APP_ALLOWED_PYTHON_PACKAGES	Bundled list below	Whitespace-separated package names accepted in requirements.txt.
APP_ADDITIONAL_ALLOWED_PYTHON_PACKAGES	Empty string	Extra package names appended to the bundled allowlist.

The bundled allowlist is:

aidial-sdk aidial-client aiohttp anthropic beautifulsoup4 chromadb colorama
fastapi faiss-cpu flake8 flask httpx inquirer langchain langchain-community
langchain-openai langchain-text-splitters numpy openai pandas pyright
python-dotenv python-multipart prompt-toolkit pypdf requests tiktoken uvicorn

app.runtimes maps runtime names to image and profile. The bundled map contains python3.8, python3.9, python3.10, python3.11, and python3.12. Each uses the matching python:<VERSION>-slim image and the python-pip profile. An unknown runtime fails the build request. Source: runtime defaults and runtime lookup.

Allowlisting a package does not guarantee its compatibility with every runtime. The builder's validation contract controls accepted requirements; dependency installation occurs later in the image build.

Deployment, session, and operation timing

Variable	Default	Description
APP_SERVICE_SETUP_TIMEOUT_SEC	300	Maximum wait for a Knative service URL, in seconds.
APP_SESSION_SETUP_TIMEOUT_SEC	60	Maximum wait for an interpreter session pod, in seconds. This is not the session's idle lifetime.
APP_HEARTBEAT_PERIOD_SEC	30	Interval between SSE heartbeat comments during lifecycle operations, in seconds.
APP_MAX_ERROR_LOG_LINES	20	Maximum log lines included in a generic image-build failure.
APP_MAX_ERROR_LOG_CHARS	1000	Maximum characters included in the same log excerpt.

The bundled spring.mvc.async.request-timeout is 600000 milliseconds. Core's controller timeouts are configured separately; see Connect DIAL Core.

Kubernetes templates

The following properties are objects, not scalar image or container-name variables. Their fields follow the corresponding Kubernetes resource or container structure.

YAML property	Bundled configuration
app.template-container	Init container named template-container; imagePullPolicy: Always; source and template mounts at /sources and /templates; DIAL URL and package allowlist environment variables. Runs as non-root UID 1001 with privilege escalation disabled.
app.builder-container	Container named builder-container; arguments --context=/sources and --dockerfile=/templates/Dockerfile; read-only mounts of the prepared directories. The controller adds destination and BASE_IMAGE build arguments.
app.service-container	Container named app-container; requests CPU 500m, memory 1G, and ephemeral storage 500M; limits CPU 1000m, memory 4G, and ephemeral storage 1G.
app.service-config	Knative serving.knative.dev/v1 Service; initial scale 0, maximum scale 3, scaling window 300s, idle timeout 300 seconds, concurrency 50, and service account token automount disabled.
app.job-config	Kubernetes Job; backoffLimit: 0, restartPolicy: Never, service account token automount disabled, and an emptyDir volume named volume with sizeLimit: 10Mi.
app.secret-config	Kubernetes v1 Secret template for build credentials.
app.session-pod	Kubernetes v1 Pod template for interpreter sessions.
app.session-container	Container named session; port 8080; TCP startup probe on that port, initial delay 0, period 1 second, failure threshold 15. Requests CPU 500m, memory 1G, and ephemeral storage 500M; limits CPU 1000m, memory 1G, and ephemeral storage 1G.

Defaults are in application.yaml. The controller merges request-specific environment variables, images, and scaling values into these templates in ConfigService.

Connect DIAL Core

Core 0.49.4 reads these static settings from its applications object:

Setting	Default	Description
applications.controllerEndpoint	—	App Controller URL reachable by Core. Without it, controller-backed operations are unavailable.
applications.controllerTimeout	240000	Controller operation timeout, in milliseconds.
applications.controllerConnectTimeout	10000	Controller connection timeout, in milliseconds.

Source: ApplicationOperatorService. Interpreter image and session lifetime settings remain in Core's Code Interpreter configuration.

Example Core settings fragment:

{
  "applications": {
    "controllerEndpoint": "http://dial-app-controller:8080",
    "controllerTimeout": 360000,
    "controllerConnectTimeout": 10000
  },
  "codeInterpreter": {
    "sessionImage": "epam/ai-dial-code-interpreter:0.2.0",
    "sessionTtl": 600000
  }
}

This example gives a controller operation longer than the default five-minute build wait. Core's role controls still govern who can create Code Apps and execute Python; see Access.

Image environment

The controller image sets OTEL_TRACES_EXPORTER, OTEL_METRICS_EXPORTER, and OTEL_LOGS_EXPORTER to none. These defaults come from the Dockerfile, not from application.yaml.

Troubleshooting

Symptom	What to check
Startup fails while loading Kubernetes clients	Kubeconfig path, file permissions, and selected contexts. A missing file is not replaced by in-cluster credentials.
Unsupported runtime	The request's runtime must exist in app.runtimes.
Missing app.py or forbidden package	Builder source validation and the allowlist supplied to the init container.
Build or deployment times out	Kubernetes events, registry access, workload readiness, controller wait settings, and Core's independent timeout.
/health succeeds but operations fail	The health handler does not check Kubernetes, registry, or DIAL connectivity.

Further reading

• App Builder Python configuration — source format, build directories, and package validation
• Controller API — requests and streamed operation results
• Code Interpreter configuration — session image, lifetime, and Quick Apps integration
• Applications and Code Interpreter — how Core reaches Code App and interpreter services
• Access — admin rules, API-key IP checks, and sharing lifetimes