Repository navigation
feat(deploy): container image, compose, unraid template and release lanes - #13
Merged
Merged
Conversation
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014ZMFrDSSDjqfAujiA29t2g
…anes Spec 0014: multi-stage Dockerfile on python:3.13-slim (digest-pinned, nonroot, healthcheck), docker-compose, Unraid template, GHCR release and main lanes, README rewrite. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014ZMFrDSSDjqfAujiA29t2g
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Spec 0014 (deployment) — cabin is shippable: multi-stage Dockerfile on a digest-pinned python:3.13-slim (nonroot 65532, read-only venv, stdlib healthcheck, VERSION build arg stamped into the wheel), docker-compose with no-new-privileges + cap_drop ALL, Unraid template, GHCR release and main lanes, README rewrite.
Verified by actually building and running: amd64 216.5 MB / arm64 243.1 MB flattened (arm64 built and run under QEMU), uid 65532, no uv/compilers/source in the image, empty-/data first run creates the DB and a 0600 secret.key, restart persists,
--user 99:100against a chowned dir works, compose comes up healthy with CapEff 0,make docker-smokepasses.Reviewed and fixed: writable venv, missing runtime hardening in the shipped configs,
:mainpublishing without a green CI gate (now workflow_run-gated on the tested commit), and an unwritable /data producing a 40-line traceback instead of a message naming the path, uid and chown. 460 tests green.🤖 Generated with Claude Code
https://claude.ai/code/session_014ZMFrDSSDjqfAujiA29t2g