Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

@@ -113,3 +113,3 @@
 On context close (e.g. systemd SIGTERM), a `ContextClosedEvent` listener in `BuildExecutor` terminates the process trees of all executing builds and waits (bounded) until their results are persisted as INTERRUPTED — a shutdown is never recorded as FAILED. Builds still queued stay PENDING and start no process. Both are re-enqueued by the watcher's startup recovery; INTERRUPTED therefore publishes as Gitea state `pending`, not `failure` (`GiteaStateMapping`).
 
-The runtime is selected per build behind the `BuildRunner` interface: `DispatchingBuildRunner` (`@Primary`) routes to native `ProcessBuildRunner` (the default), to `DockerBuildRunner` when `docker.enabled`, or to `WerkdockBuildRunner` when `werkdock.enabled` — docker and werkdock are mutually exclusive per build and rejected in `buildSettings`, never picked silently. The Docker runner shells out to the `docker` CLI (no SDK): it (re)builds the configured image when the Dockerfile inputs changed (tracked via the `org.werkator.build-inputs-sha256` image label), maintains a per-repo Gradle cache volume, mounts the worktree and the Docker socket into a labelled (`org.hoennig.werkator`) `--rm --init` container (with `TESTCONTAINERS_HOST_OVERRIDE` from `docker.env` if it names one, else the child address a rootless daemon's rootlesskit reports for the `slirp4netns` port driver — `RootlessKitPorts`, asked over `dockerd-rootless/api.sock` on every build, PR#86 — else `localhost` under `network: host` and `host.docker.internal` otherwise), and repairs workspace ownership in-container after each command (under a rootless daemon the container runs as root, which is the host user, and the repair degenerates to `0:0`). Git works inside the container: the primary `.git` is mounted read-only with `.git/werkator/` masked by an empty tmpfs (credential isolation) and the worktree's admin dir mounted read-write (`gitMetadataMounts`). The returned `Process` is the attached `docker run` client, so log streaming and termination work exactly like native builds.
+The runtime is selected per build behind the `BuildRunner` interface: `DispatchingBuildRunner` (`@Primary`) routes to native `ProcessBuildRunner` (the default), to `DockerBuildRunner` when `docker.enabled`, or to `WerkdockBuildRunner` when `werkdock.enabled` — docker and werkdock are mutually exclusive per build and rejected in `buildSettings`, never picked silently. The Docker runner shells out to the `docker` CLI (no SDK): it (re)builds the configured image when the Dockerfile inputs changed (tracked via the `org.werkator.build-inputs-sha256` image label) — in the build's workspace, from the real paths of the Dockerfile and the context, which must stay inside it, and under Werkator's own tag `werkator-build/<scope>:<inputs>` per repository and branch (one scope for the pull-request target builds), so a branch never replaces another build's image (PR#168) — maintains a per-repo Gradle cache volume, mounts the worktree and the Docker socket into a labelled (`org.hoennig.werkator`) `--rm --init` container (with `TESTCONTAINERS_HOST_OVERRIDE` from `docker.env` if it names one, else the child address a rootless daemon's rootlesskit reports for the `slirp4netns` port driver — `RootlessKitPorts`, asked over `dockerd-rootless/api.sock` on every build, PR#86 — else `localhost` under `network: host` and `host.docker.internal` otherwise), and repairs workspace ownership in-container after each command (under a rootless daemon the container runs as root, which is the host user, and the repair degenerates to `0:0`). Git works inside the container: the primary `.git` is mounted read-only with `.git/werkator/` masked by an empty tmpfs (credential isolation) and the worktree's admin dir mounted read-write (`gitMetadataMounts`). The returned `Process` is the attached `docker run` client, so log streaming and termination work exactly like native builds.

@@ -166,0 +204,4 @@
+        repoKey: String,
+        branch: String?,
+        pullRequestTarget: Boolean,
+    ): String = if (pullRequestTarget) "$repoKey\npull-request target" else "$repoKey\nbranch ${branch.orEmpty()}"

@@ -166,0 +200,4 @@
+     * has a scope of its own — it runs the base commit with the host's configuration, which no branch
+     * writes, while its head branch's builds run whatever that branch says.
+     */
+    private fun imageScope(

@@ -285,3 +285,3 @@
                   image: ""             # image for the build container; required when enabled
                   dockerfile: ""        # Dockerfile to (re)build the image from when missing or stale; empty pulls the image as-is
-                  context: "."          # Docker build context used with dockerfile
+                  context: "."          # Docker build context used with dockerfile; both relative to the workspace, never '..'

@@ -69,3 +70,3 @@
         val repoKey = ArtifactKeys.repoKey(repoDir)
         cleanupStaleContainersOnce(repoKey, repoDir)
-        ensureImage(docker, repoDir, onAuxProcess)
+        val image = ensureImage(docker, workingDir, imageScope(repoKey, environment["branch"], pullRequestTarget), onAuxProcess)

@@ -133,1 +144,4 @@
+        val context = containedPath(root, "docker.context", docker.context)
+        val dockerfileHash = DockerImageInputs.dockerfileSha256(dockerfile)
         val inputsHash = DockerImageInputs.inputsSha256(dockerfileHash, docker.dockerfile, docker.context)
+        val image = DockerImageInputs.builtImage(scope, inputsHash)

@@ -69,3 +70,3 @@
         val repoKey = ArtifactKeys.repoKey(repoDir)
         cleanupStaleContainersOnce(repoKey, repoDir)
-        ensureImage(docker, repoDir, onAuxProcess)
+        val image = ensureImage(docker, workingDir, imageScope(repoDir, environment, pullRequestTarget), onAuxProcess)

@@ -133,0 +142,4 @@
+        val root = workspace.toRealPath()
+        val dockerfile = containedPath(root, "docker.dockerfile", docker.dockerfile)
+        val context = containedPath(root, "docker.context", docker.context)
+        val dockerfileHash = DockerImageInputs.dockerfileSha256(dockerfile)

@@ -164,0 +203,4 @@
+     * the host's configuration, which no branch writes, while its head branch's builds run whatever that
+     * branch says, and the inputs hash does not cover the context's files, which differ between bases.
+     */
+    private fun imageScope(

@@ -133,1 +148,4 @@
+        val context = containedPath(root, "docker.context", docker.context)
+        val dockerfileHash = DockerImageInputs.dockerfileSha256(dockerfile)
         val inputsHash = DockerImageInputs.inputsSha256(dockerfileHash, docker.dockerfile, docker.context)
+        // with the name of the image, so two definitions of one branch keep an image each

@@ -133,1 +150,4 @@
         val inputsHash = DockerImageInputs.inputsSha256(dockerfileHash, docker.dockerfile, docker.context)
+        // with what the definition builds from, so two definitions of one branch keep an image each
+        // unless they build the same; a changed file under the same path still replaces the image
+        val image =

@@ -203,9 +203,37 @@ class ConfigLoader(
                 yaml.convertValue(resolveBuildSections(dropNonDefinitionBuilds(raw), missingPredecessor), WerkatorConfig::class.java)
             }
         checkArtifactDirs(config)

@@ -134,0 +152,4 @@
+        // unless they build the same; a changed file under the same path still replaces the image
+        val image =
+            DockerImageInputs.builtImage(
+                "$scope\nimage ${docker.image}\ndockerfile ${docker.dockerfile}\ncontext ${docker.context}",

@@ -133,0 +146,4 @@
+        val root = workspace.toRealPath()
+        val dockerfile = containedPath(root, "docker.dockerfile", docker.dockerfile)
+        val context = containedPath(root, "docker.context", docker.context)
+        val dockerfileHash = DockerImageInputs.dockerfileSha256(dockerfile)

@@ -113,3 +113,3 @@
 On context close (e.g. systemd SIGTERM), a `ContextClosedEvent` listener in `BuildExecutor` terminates the process trees of all executing builds and waits (bounded) until their results are persisted as INTERRUPTED — a shutdown is never recorded as FAILED. Builds still queued stay PENDING and start no process. Both are re-enqueued by the watcher's startup recovery; INTERRUPTED therefore publishes as Gitea state `pending`, not `failure` (`GiteaStateMapping`).
 
-The runtime is selected per build behind the `BuildRunner` interface: `DispatchingBuildRunner` (`@Primary`) routes to native `ProcessBuildRunner` (the default), to `DockerBuildRunner` when `docker.enabled`, or to `WerkdockBuildRunner` when `werkdock.enabled` — docker and werkdock are mutually exclusive per build and rejected in `buildSettings`, never picked silently. The Docker runner shells out to the `docker` CLI (no SDK): it (re)builds the configured image when the Dockerfile inputs changed (tracked via the `org.werkator.build-inputs-sha256` image label), maintains a per-repo Gradle cache volume, mounts the worktree and the Docker socket into a labelled (`org.hoennig.werkator`) `--rm --init` container (with `TESTCONTAINERS_HOST_OVERRIDE` from `docker.env` if it names one, else the child address a rootless daemon's rootlesskit reports for the `slirp4netns` port driver — `RootlessKitPorts`, asked over `dockerd-rootless/api.sock` on every build, PR#86 — else `localhost` under `network: host` and `host.docker.internal` otherwise), and repairs workspace ownership in-container after each command (under a rootless daemon the container runs as root, which is the host user, and the repair degenerates to `0:0`). Git works inside the container: the primary `.git` is mounted read-only with `.git/werkator/` masked by an empty tmpfs (credential isolation) and the worktree's admin dir mounted read-write (`gitMetadataMounts`). The returned `Process` is the attached `docker run` client, so log streaming and termination work exactly like native builds.
+The runtime is selected per build behind the `BuildRunner` interface: `DispatchingBuildRunner` (`@Primary`) routes to native `ProcessBuildRunner` (the default), to `DockerBuildRunner` when `docker.enabled`, or to `WerkdockBuildRunner` when `werkdock.enabled` — docker and werkdock are mutually exclusive per build and rejected in `buildSettings`, never picked silently. The Docker runner shells out to the `docker` CLI (no SDK): it builds the configured image before every command (the `org.werkator.build-inputs-sha256` image label records its inputs), maintains a per-repo Gradle cache volume, mounts the worktree and the Docker socket into a labelled (`org.hoennig.werkator`) `--rm --init` container (with `TESTCONTAINERS_HOST_OVERRIDE` from `docker.env` if it names one, else the child address a rootless daemon's rootlesskit reports for the `slirp4netns` port driver — `RootlessKitPorts`, asked over `dockerd-rootless/api.sock` on every build, PR#86 — else `localhost` under `network: host` and `host.docker.internal` otherwise), and repairs workspace ownership in-container after each command (under a rootless daemon the container runs as root, which is the host user, and the repair degenerates to `0:0`). Git works inside the container: the primary `.git` is mounted read-only with `.git/werkator/` masked by an empty tmpfs (credential isolation) and the worktree's admin dir mounted read-write (`gitMetadataMounts`). The returned `Process` is the attached `docker run` client, so log streaming and termination work exactly like native builds.

@@ -283,3 +283,3 @@
                 docker:
                   enabled: false        # run clean/build in a container instead of natively (pinned)
-                  image: ""             # image for the build container; required when enabled
+                  image: ""             # image for the build container, required when enabled; with dockerfile only a label of the image Werkator builds

@@ -209,0 +213,4 @@
+     * branch's behalf. Checked on the bound configuration, so every layer and definition is covered:
+     * a branch's path fails that branch's builds, a host's the start.
+     */
+    private fun checkDockerBuildPaths(config: WerkatorConfig) {