On Snowflake with Snowpark Container Services

It is possible to run TabMove Lite on Snowflake’s Snowpark Container Services if you already have a Snowflake environment that is hosted on an AWS commercial region. We recommend you follow the Snowpark tutorials for the Common Setup and for Creating a Service, but we also provide the instructions below as an example.

Common setup

1. Prerequisites:

   1. A Snowflake account: Note that trial accounts are not supported.

   2. SnowSQL, the command-line client for executing SQL commands (optional): You can use any Snowflake client that supports executing SQL commands and uploading files to a Snowflake stage. The tutorials are tested using the SnowSQL and the Snowsight web interface. For instructions to install this command-line client, see Installing SnowSQL.

   3. Docker Desktop: These tutorials provide instructions for using Docker Desktop. For installation instructions, see https://docs.docker.com/get-docker/ . Note that you can use any OCI-compliant clients to create images, such as Docker, Podman, or Nerdctl.

2. Creating the required Snowflake objects. Make sure you have ACCOUNTADMIN access to perform these actions. Replace <user_name> with the name of your Snowflake user who will run the service.

   USE ROLE ACCOUNTADMIN;
   
   CREATE ROLE tabmove_container_role;
   
   CREATE DATABASE IF NOT EXISTS tabmove_container;
   GRANT OWNERSHIP ON DATABASE tabmove_container TO ROLE tabmove_container_role COPY CURRENT GRANTS;
   
   CREATE OR REPLACE WAREHOUSE tabmove_container_warehouse WITH
     WAREHOUSE_SIZE='X-SMALL';
   GRANT USAGE ON WAREHOUSE tabmove_container_warehouse TO ROLE tabmove_container_role;
   
   GRANT BIND SERVICE ENDPOINT ON ACCOUNT TO ROLE tabmove_container_role;
   
   CREATE COMPUTE POOL tabmove_container_compute_pool
     MIN_NODES = 1
     MAX_NODES = 1
     INSTANCE_FAMILY = CPU_X64_S;
   GRANT USAGE, MONITOR ON COMPUTE POOL tabmove_container_compute_pool TO ROLE tabmove_container_role;
   
   GRANT ROLE tabmove_container_role TO USER <user_name>;
   
   USE ROLE tabmove_container_role;
   USE DATABASE tabmove_container;
   USE WAREHOUSE tabmove_container_warehouse;
   
   CREATE SCHEMA IF NOT EXISTS tabmove_container_schema;
   CREATE IMAGE REPOSITORY IF NOT EXISTS tabmove_container_repository;
   CREATE STAGE IF NOT EXISTS tabmove_container_stage
     DIRECTORY = ( ENABLE = true );
   
   USE SCHEMA tabmove_container_schema;

3. Verify the objects were created correctly:

   SHOW COMPUTE POOLS;
   SHOW WAREHOUSES;
   SHOW IMAGE REPOSITORIES;
   SHOW STAGES;

Define the container service

We can define the TabMove container service (and its postgres dependency) in a way that is very similar to a Docker compose file:

CREATE SERVICE tabmove_service
  IN COMPUTE POOL tabmove_container_compute_pool
  FROM SPECIFICATION $$
spec:
  containers:
  - name: tabmove-lite
    image: fmniqai-biztory-partner.registry.snowflakecomputing.com/sbx_timothyvermeiren/tabmove_container_schema/tabmove_container_repository/tabmove-lite:latest
    env:
      POSTGRES_HOST: "localhost"
      POSTGRES_PORT: "5432"
      POSTGRES_DB: "tabmove_self_service"
      POSTGRES_USER: "tabmove_self_service"
      POSTGRES_PASSWORD: "EXwyWyafsHbRLDy2MUj8sCCKoNasdfgpN"
      POSTGRES_SSL_MODE: "disable"
      CRYPTOLENS_BIZTORY_ACCESS_TOKEN: "WyI4NzcyMTU2MCIsIk1BVk9VNTd4MTluRklFb29LMVhud3lDeWhjUm50L2w3N0tmdVB6cUQiXQ=="
      CRYPTOLENS_BIZTORY_RSA_PUBLIC_KEY: "<RSAKeyValue><Modulus>yjnQ01qKzfwGx11KImlT/a8nQyyKmxIzoPX2e+LN88GWkxz3QKR8/YQZrKWwVzn7mkFhX1QKq29SOiHMk/nE9kmdz/ibuumnqLVJYpaYaw0GRjCeYYl80keXMDzILd2lPZLq3tDtrbdKb42YZ8XlvoR/pdpNDMCBXEkUErdtMZyKV2pPIYUjxR96/Cza8xutVUMYEDTNPqJAJxZbw4S1kdS0tkWgcBRqNSmtVj/BpazpPw38CiwtyTRAmPMLdEXzBUIZkVQ1+aSiQLn++AJqd92wR+Yp1P340/JmohjokwODbnl/uQll8fIDQ3xlX3JHdrgY1QWTgOexCb9zmdgvhw==</Modulus><Exponent>AQAB</Exponent></RSAKeyValue>"
      CRYPTOLENS_PRODUCT_CODE: "25970"
      CRYPTOLENS_MAX_OVERDRAFT: "1"
      CRYPTOLENS_FLOATINGTIME_INTERVAL_SECONDS: "600"
  - name: tabmove-db
    image: fmniqai-biztory-partner.registry.snowflakecomputing.com/sbx_timothyvermeiren/tabmove_container_schema/tabmove_container_repository/postgres:16
    env:
      PGDATA: /var/lib/postgresql/data/pgdata/
      POSTGRES_HOST: "localhost"
      POSTGRES_PORT: "5432"
      POSTGRES_DB: "tabmove_self_service"
      POSTGRES_USER: "tabmove_self_service"
      POSTGRES_PASSWORD: "EXwyWyafsHbRLDy2MUj8sCCKoNasdfgpN"
      POSTGRES_SSL_MODE: "disable"
    volumeMounts:
      - name: postgres-data
        mountPath: /var/lib/postgresql/data/pgdata
  endpoints:
  - name: tabmove-lite
    port: 8501
    public: true
    protocol: HTTP
  - name: tabmove-db
    port: 5432
    public: false
    protocol: TCP
  volumes:
  - name: postgres-data
    source: local
$$
  MIN_INSTANCES=1
  MAX_INSTANCES=1
;

GRANT USAGE ON SERVICE tabmove_service TO ROLE tabmove_container_role;

Access the service

We can first list the services in our account to verify it was created correctly:

SHOW SERVICES;

Then, what we need to access the service is its endpoint:

SHOW ENDPOINTS IN SERVICE tabmove_service;

The ingress_url is the URL we can use to access the TabMove service.

If necessary, we can access the service’s logs (instance ID 0, container name tabmove_lite, tail 10 lines):

SELECT SYSTEM$GET_SERVICE_LOGS('tabmove_service', '0', 'tabmove-lite', 10);