mhoennigandClaude Fable 5
de79210a7b
Level 1: docker-compatible CLI (verbs, flags, loud refusal of isolation flags the filesystem-only contract cannot honor) — built in session B. Level 2: OCI image pull, flattened to a rootfs — deferred, stdlib-doable. Level 3: a daemon speaking the Docker Engine API subset Testcontainers actually uses (Testcontainers never calls the CLI) — deferred, but the CLI is built as a thin frontend over the same internal service from the start. Records the port-mapping crux of host networking and the unprivileged-netns escape hatch as a future RFC. Step 21 session B and the werkdock README follow the docker-shaped semantics: run takes an image, instances correspond to containers. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
19 lines
1.5 KiB
Markdown
19 lines
1.5 KiB
Markdown
# Werkdock
|
|
|
|
A docker-like sandbox CLI over `bwrap` — filesystem isolation only.
|
|
A dock is the enclosed basin in which ships are built: the dock gate controls what passes, the water outside is shared with the whole harbor.
|
|
Accordingly, network, uid, `/proc`, `/dev`, and `/tmp` come from the host by contract; that is what makes Werkdock work without root on a Hostsharing Managed Webspace.
|
|
|
|
Semantics — docker-compatible as far as the filesystem-only contract allows (see [RFC 0002](docs/rfcs/0002-docker-compatible-surface.md)):
|
|
|
|
- An *image* is a rootfs archive; an *instance* is an unpacked, writable directory tree and corresponds to a docker container.
|
|
- `werkdock run [flags] IMAGE [CMD...]` creates an instance and executes in the sandbox with uid 0 mapped to the calling user; verbs and flags follow docker, unsupported docker flags fail loudly.
|
|
- `werkdock doctor` checks the host: user-namespace capability, disk and quota headroom.
|
|
- A daemon speaking the Docker Engine API subset (for Testcontainers) is designed for but deferred.
|
|
|
|
Status: bootstrap.
|
|
The implementation language is Go, decided in [RFC 0001](docs/rfcs/0001-implementation-language.md).
|
|
Werkdock grows in this subdirectory of the Werkator repository and moves to its own repository once it stands on its own.
|
|
It must stay self-contained: no imports from Werkator code, no Gradle coupling to the Werkator build.
|
|
The roadmap is session B of [docs/plan/21-werkdock-extraction-and-webspace-install.md](../docs/plan/21-werkdock-extraction-and-webspace-install.md).
|