Private Docker Publishing Destination and SAS Container Runtime Example – Part 2: The Implementation

[#1]

With the architecture and prerequisites in place, let’s move on to the implementation and create the objects required to publish and run our SAS decision as a SAS Container Runtime image.

Creating the domain

We are now ready to create the domain that will hold the credentials for our publishing destination.

Since SAS Viya 2026.03, both the domain and the publishing destination can be created directly from SAS Environment Manager.

In SAS Environment Manager, go to Domains and create a new domain of type Publishing destination (Base64).

Select any image to see a larger version.
Mobile users: To view the images, select the "Full" version at the bottom of the page.

Check Add a credential for this domain. This allows you to specify the identities that are authorized to use the domain, as well as the type of publishing destination.

For the identities, I recommend using a pre-existing custom group that an administrator can use to manage all users who are allowed to publish models and decisions. For example, you could create a group called Private Docker Publishers rather than restricting publishing to administrators only.

For the Destination type, select Private Docker.

You will then be asked to provide the credentials and settings we gathered earlier:

• Docker registry user ID
• Docker registry password
• Kubernetes key
• Kubernetes certificate

You'll notice that you can also specify a Git user ID and Git access token. These can be used if you want to push SAS Container Runtime artifacts to the associated Git repository when publishing objects to container destinations.

Creating the publishing destination

Once the domain has been created, we can create the publishing destination.

Still in SAS Environment Manager, go to Publishing Destinations and create a new publishing destination of type Private Docker.

Specify the Base repository URL, which is the location of the container registry, and the Kubernetes URL, which identifies the Kubernetes cluster where the published model or decision can be validated.

Don't forget to attach the publishing destination to the authentication domain we created previously.

That's it. The Private Docker publishing destination is ready to use.

Using the SAS Viya CLI to create the publishing destination

If needed—for example, if you are using an older version of SAS Viya, or if you want to automate the configuration—you can use the SAS Viya CLI instead of SAS Environment Manager.

The CLI allows you to create the domain and publishing destination at the same time.

Here is an example:

sas-viya models destination createPD \
  --name "MyPrivateDockerCLI" \
  --description "Destination for creating ready-to-use SAS scoring container images (SAS Container Runtime)" \
  --baseRepoURL "server.demo.sas.com:5000/scr" \
  --kubeURL "https://server.demo.sas.com:6443" \
  --credDomainID "MyPrivateDockerDomainCLI" \
  --credDescription "Domain for creating ready-to-use SAS scoring container images (SAS Container Runtime)" \
  --registryId "<user-id>" \
  --registryPassword "<user-pw>" \
  --identityId prvdockpublish \
  --identityType group \
  --kuberneteKey "<my-kubernetes-key>" \
  --kuberneteCertificate "<my-kuberneteCertificate>"

In this example, prvdockpublish is the ID of the group authorized to publish to this destination.

Publishing the SAS decision or model

The publishing destination is ready. It's now time to publish a model or decision.

In SAS Intelligent Decisioning, open a validated decision and click Publish.

You will see the publishing destinations available in your environment, including the Private Docker destinations we created earlier.

You can then customize the name of the published object. This name will be used for the container image and for the HTTP request endpoint. By default, the decision or model name is suffixed with its version.

For this example, I chose to remove the version from the published name before clicking Publish.

If the publishing operation is successful, you should see the following confirmation:

If you have a registry UI connected to your container registry, you will also be able to see the newly created container image.

Validating the publishing destination (optional)

Immediately after publishing, you can optionally validate the publishing destination. This validation uses the Kubernetes URL, Kubernetes key, and Kubernetes certificate configured earlier.

Assuming you have an input CAS table available for testing your decision or model, with all the required input columns, you can run a publishing validation.

Go to the Scoring tab, then select the Publishing Validation tab and click the publishing operation you want to validate.

In the test settings, specify an optional Location for the results, the Input table, and the Output data library. When everything is configured, click Run.

If the validation is successful, you should see the following:

You can then inspect the results. The output shows how the decision or model was executed against the test data.

The generated code and log may look a little obscure at first, as they involve Python code interacting with Kubernetes behind the scenes. Essentially, the validation process pulls the SAS Container Runtime image from the registry and runs it in a Kubernetes cluster.

This validation therefore confirms that the model or decision was successfully published as a SAS Container Runtime image and that the resulting image can be executed successfully.

Running the container image to score data

This is ultimately what we wanted to achieve: running a SAS model or SAS decision against input data in the most lightweight way possible, independently of SAS Viya.

We have now published our SAS decision as a SAS Container Runtime image and stored it in a container registry. From a machine that has access to the registry, we can first pull the image locally:

docker pull server.demo.sas.com:5000/scr/evaluate_loans:latest

The image is now available locally and can be started using Docker, or another compatible container runtime:

docker run --rm -d --name evaluate_loans -p 8080:8080 server.demo.sas.com:5000/scr/evaluate_loans:latest

The parameters are:

 

In other words, this command starts the evaluate_loans SAS Container Runtime image and exposes its HTTP endpoint on port 8080 of the host.

The container is now running in the background, so we can send data to it for scoring.

The following command sends a request containing the input data to the SAS Container Runtime endpoint and returns the scoring result:

curl --location --request POST 'http://localhost:8080/evaluate_loans' \
     --header 'Content-Type: application/json' \
     --header 'Accept: application/json' \
     --data ' {
    "inputs": [
        { "name": "CLAGE", "value": 94 },
        { "name": "DEBTINC", "value": 30 },
        { "name": "DELINQ", "value": 3 },
        { "name": "REASON", "value": "HomeImp"},
        { "name": "DEROG", "value": 3 },
        { "name": "CLNO", "value": 3 },
        { "name": "VALUE", "value": 130000 }
    ]
} ' | jq

The main parameters are:

The result is the SAS decision's scoring response, returned directly by SAS Container Runtime without requiring SAS Viya to be involved at runtime:

{
  "metadata": {
    "module_id": "evaluate_loans",
    "elapsed_nanos": 4978678,
    "step_id": "execute",
    "timestamp": "2026-09-10T15:56:47.591002413Z"
  },
  "version": 1,
  "outputs": [
    {
      "name": "REJECT",
      "value": 0.0
    },
    {
      "name": "DEBTINC",
      "value": 30.0
    },
    {
      "name": "BAD",
      "value": null
    },
    {
      "name": "CLAGE",
      "value": 94.0
    },
    {
      "name": "MORTDUE",
      "value": null
    },
    {
      "name": "VALUE",
      "value": 130000.0
    },
    {
      "name": "LOAN",
      "value": null
    },
    {
      "name": "REASON_LABEL",
      "value": "Home Improvement"
    },
    {
      "name": "CLNO",
      "value": 3.0
    },
    {
      "name": "YOJ",
      "value": null
    },
    {
      "name": "DEROG",
      "value": 3.0
    },
    {
      "name": "DELINQ",
      "value": 3.0
    },
    {
      "name": "RECORD_PK",
      "value": null
    },
    {
      "name": "REVIEW",
      "value": null
    },
    {
      "name": "NINQ",
      "value": null
    },
    {
      "name": "JOB",
      "value": null
    },
    {
      "name": "REASON",
      "value": "HomeImp"
    }
  ]
}

For our example, the decision returns REJECT = 0.0. Based on the decision logic used in this example, this means that the loan is not rejected following the evaluation of the input parameters.

And this is the key point: the decision is now running in the SAS Container Runtime container. SAS Viya was required to develop and publish the decision, but it is no longer required to execute the decision or return the score.

We have therefore taken a SAS decision developed in SAS Viya, packaged it as a container image, stored that image in a private registry, and executed it using a standard container runtime.

When you're done with the container, you can stop it gracefully:

docker stop evaluate_loans

Deployment requirements

One final point: to enable the Private Docker publishing destination and build SAS Container Runtime images on your SAS Viya platform, you need to configure BuildKit.

For more information, see the Configure BuildKit for SAS Model Publish Service section of the SAS deployment documentation.

A big thank you to Adam Bullock for his help and insights on this topic.

Thanks for reading.

Find more articles from SAS Global Enablement and Learning here.

[EyalGonen]

Hi @NicolasRobert 

Thanks for the blog!

I have a question - when you validate a published decision how do you setup the namespace in which the validation run will execute with the K8S cluster?

[NicolasRobert]

Hi @EyalGonen , good question. I'm not aware of an option to control that for the publishing validation. Currently, it goes to the default namespace.