mhoennigandClaude Fable 5
de79210a7b
Level 1: docker-compatible CLI (verbs, flags, loud refusal of isolation flags the filesystem-only contract cannot honor) — built in session B. Level 2: OCI image pull, flattened to a rootfs — deferred, stdlib-doable. Level 3: a daemon speaking the Docker Engine API subset Testcontainers actually uses (Testcontainers never calls the CLI) — deferred, but the CLI is built as a thin frontend over the same internal service from the start. Records the port-mapping crux of host networking and the unprivileged-netns escape hatch as a future RFC. Step 21 session B and the werkdock README follow the docker-shaped semantics: run takes an image, instances correspond to containers. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Werkdock
A docker-like sandbox CLI over bwrap — filesystem isolation only.
A dock is the enclosed basin in which ships are built: the dock gate controls what passes, the water outside is shared with the whole harbor.
Accordingly, network, uid, /proc, /dev, and /tmp come from the host by contract; that is what makes Werkdock work without root on a Hostsharing Managed Webspace.
Semantics — docker-compatible as far as the filesystem-only contract allows (see RFC 0002):
- An image is a rootfs archive; an instance is an unpacked, writable directory tree and corresponds to a docker container.
werkdock run [flags] IMAGE [CMD...]creates an instance and executes in the sandbox with uid 0 mapped to the calling user; verbs and flags follow docker, unsupported docker flags fail loudly.werkdock doctorchecks the host: user-namespace capability, disk and quota headroom.- A daemon speaking the Docker Engine API subset (for Testcontainers) is designed for but deferred.
Status: bootstrap. The implementation language is Go, decided in RFC 0001. Werkdock grows in this subdirectory of the Werkator repository and moves to its own repository once it stands on its own. It must stay self-contained: no imports from Werkator code, no Gradle coupling to the Werkator build. The roadmap is session B of docs/plan/21-werkdock-extraction-and-webspace-install.md.