The agent as a container image (M1.5)

- Dockerfile: built with uv into /opt/nisse (installed, not editable),
  run on python:3.12-slim with openssh-client as user nisse; stateless,
  with state in a /var/lib/nisse-dev volume, config mounted at
  /etc/nisse-dev/nisse-dev.yaml, secrets as environment variables, keys
  mounted read-only. 202 MB. Its `test` stage adds the tests and their
  tools over the installed package (UV_NO_SYNC, so `uv run` never swaps
  in the source tree); the default target is the agent.
- scripts/e2e.sh --image REF runs the suite inside an image's test stage,
  on its own sshd.
- CI builds both images on every PR (nothing pushed); release.yml pushes
  gitea.dongar.net/dongar/nisse-dev:<tag> and :latest on a v* tag, with
  the REGISTRY_TOKEN secret.
- scripts/bringup.sh builds the code under test into an image and runs it
  in the systemd unit (root, $E2E mounted at its own path); `plan` prints
  what it would run; the build-VM set-aside reads the projects: config.

Checked: the image refuses to start without a config, runs as uid 10001;
one e2e test passed from the test stage (2m45s, $0).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPQ14L3LikyefCMFBqEbKE

Dockerfile

@@ -0,0 +1,66 @@
+# The nisse-dev agent as a container image (Development Plan M1.5, X4).
+#
+# Stateless: the state store and SSH known-hosts live in a volume
+# (/var/lib/nisse-dev); configuration is mounted read-only
+# (/etc/nisse-dev/nisse-dev.yaml); secrets come as environment variables
+# (docker --env-file); SSH and deploy keys are mounted read-only wherever the
+# configuration says. The agent runs no model-chosen command here (L13):
+# those go to build VMs over SSH.
+#
+#   docker build -t nisse-dev .                  the agent
+#   docker build --target test -t nisse-dev:test .   plus the tests, for
+#                                                   scripts/e2e.sh --image
+
+FROM python:3.12-slim AS build
+COPY --from=ghcr.io/astral-sh/uv:0.12.10 /uv /usr/local/bin/uv
+ENV UV_PROJECT_ENVIRONMENT=/opt/nisse UV_COMPILE_BYTECODE=1 UV_LINK_MODE=copy
+WORKDIR /src
+COPY pyproject.toml uv.lock ./
+COPY nisse-core nisse-core
+COPY nisse-dev nisse-dev
+COPY nisse-ops nisse-ops
+# The agent and what it needs, installed (not editable): the source tree
+# isn't part of the image.
+RUN uv sync --frozen --no-dev --package nisse-dev --no-editable
+
+FROM python:3.12-slim AS runtime
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends openssh-client \
+    && rm -rf /var/lib/apt/lists/* \
+    && useradd --create-home --uid 10001 nisse \
+    && mkdir -p /var/lib/nisse-dev /etc/nisse-dev \
+    && chown nisse /var/lib/nisse-dev
+COPY --from=build /opt/nisse /opt/nisse
+ENV PATH=/opt/nisse/bin:$PATH \
+    NISSE_CONFIG=/etc/nisse-dev/nisse-dev.yaml \
+    NISSE_ENV=/run/nisse-dev/.env
+VOLUME /var/lib/nisse-dev
+USER nisse
+ENTRYPOINT ["nisse-dev"]
+
+# The image's own package plus the tests, so the end-to-end suite runs
+# against what was built, not the source tree.
+FROM runtime AS test
+USER root
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends git openssh-server \
+    && rm -rf /var/lib/apt/lists/* \
+    && mkdir -p /run/sshd
+COPY --from=build /usr/local/bin/uv /usr/local/bin/uv
+WORKDIR /src
+COPY pyproject.toml uv.lock ./
+COPY nisse-core nisse-core
+COPY nisse-dev nisse-dev
+COPY nisse-ops nisse-ops
+COPY tests tests
+COPY scripts scripts
+COPY conftest.py ./
+ENV UV_PROJECT_ENVIRONMENT=/opt/nisse
+# Test tools too, all installed (not editable), and `uv run` never re-syncs:
+# the tests import the package as built, not the source tree beside them.
+RUN uv sync --frozen --all-packages --no-editable --inexact
+ENV UV_NO_SYNC=1
+ENTRYPOINT []
+
+# The default target: the agent itself.
+FROM runtime AS agent