%% werkdock, planned with Werkbaum (https://werkbaum.javagil.de): what exists, what comes next.
%% Status: [^] deployed on mih09 and in use, [x] merged, not yet deployed, [~] in work, [ ] planned, [?] idea, [-] dropped.
%% The block behind --- explains the nodes with an id.
%% View: https://werkbaum.javagil.de/?sourceUrl=https://git.javagil.de/mi/werkdock/raw/branch/main/docs/werkdock.werkbaum

[~] #werkdock: werkdock https://git.javagil.de/mi/werkdock
  " A docker-like sandbox CLI over bwrap, filesystem isolation only, without root on a Hostsharing Managed Webspace.
  - [^] #foundation: Go, one static binary, the standard library only (RFC 0001)
    " Grew in Werkator's werkdock/ directory; moved here in Werkator's plan step 21.
  - [^] #surface: Docker-shaped CLI (RFC 0002 level 1)
    - [^] run, image names, the image store in docker's shape (S)
      " 0.2.0, PR#1.
    - [^] pull from a registry through crane (S)
      " 0.3.0, PR#2; RFC 0002 level 2, RFC 0004.
    - [^] Exit codes 126 and 127 for a command that cannot start (XS)
      " 0.11.0, PR#13.
  - [x] #images: Image creation (RFC 0004)
    - [^] import with ENTRYPOINT and CMD, load of docker save and OCI layouts (M)
    - [^] One import per image at a time, across processes (XS)
      " 0.11.0, PR#13.
    - [x] #images.dockerfile: A Dockerfile builds on the target (L)
      " werkdock PR#14, 0.13.0.
  - [^] #services: Services and Testcontainers (RFC 0005)
    - [^] Service images as non-root, VOLUMEs as anonymous volumes (M)
      " 0.4.0, PR#3; milestone 1.
    - [^] Instance lifecycle: run -d, ps, logs, stop, rm, exec (M)
      " 0.5.0, PR#4; milestone 2.
    - [^] Docker Engine API on a unix socket; Testcontainers starts PostgreSQL (L)
      " 0.6.0, PR#5; milestones 3 and 4.
    - [^] A file into a container, PUT /containers/{id}/archive (S)
      " 0.7.0, PR#7; a copy into a directory the image fills since 0.8.1, PR#10.
    - [^] #quirks: Ports by the image's own variable, measured per image (M)
      " 0.8.0 to 0.10.0, PR#8, PR#11, PR#12: PostgreSQL, MySQL, MariaDB, Redis, NATS, RabbitMQ, Mosquitto.
  - [?] #mounts: Composable toolchain mounts (RFC 0003, candidate)
    " Comes due when more than one toolchain combination is needed.
  - [?] #prune: rmi of orphans and a prune verb for the image store
  - [~] #workflow: Shared agentic workflow, reviews by werkrevisor
    - [^] #workflow.equipment: AGENTS.md, PR documents, plan, review rules, risk analysis (S)
      " werkdock PR#15.
    - [^] #workflow.checks: Licenses in each build, vulnerabilities per branch and of main each night (S)
      " werkdock PR#15: go-licenses and govulncheck.
    - [x] #workflow.toolchain: Build with a Go toolchain without known vulnerabilities, and roll it out to mih09 (S) :#workflow.checks
      " werkdock PR#16: go1.26.10, version 0.13.1.
  - [x] #secrets: The sandbox's environment off bwrap's command line and readable by the owner only (S)
    " werkdock PR#17, version 0.13.2; werkator PR#166 keeps it off werkdock's; PR#18, 0.13.3: bwrap's own environment empty.
---

#prune
  The store keeps an unpacked tree per image; a consumer that keys images by the archive path leaves the old tree behind.
  See "Disk Footprint" in the README.

#workflow.toolchain
  govulncheck reports 7 called vulnerabilities of the standard library of go1.26.8, fixed in go1.26.9;
  older Go has more: the CI builds with go1.24.4, the binary on mih09 came from go1.22.2.
  A toolchain line in go.mod makes every build use a fixed Go.