Run the Docker image through the unified `auto-review` binary #119

New issue

Closed

opened 2026-05-06 11:57:45 -07:00 by jwilger · 1 comment

jwilger commented

2026-05-06 11:57:45 -07:00

Owner

Follow-up implementation slice from #115.

Decision context

The single-binary release must continue publishing the Docker image for recommended production deployment. The image should contain and run the same auto-review binary so operators can attach to the container and execute other grouped auto-review commands.

Scope

Update the Nix image/package path so the Docker image includes the public auto-review binary.
Change the image default command to run auto-review gateway.
Keep publishing the Docker image with each release.
Ensure the image remains usable for docker exec / podman exec operator commands such as auto-review ops doctor or equivalent accepted grouped commands.
Preserve current non-root image behavior, CA certificates, git, state directory, and default bind address.

Acceptance criteria

The published image runs the gateway via auto-review gateway.
The image contains no stale ar-gateway entrypoint expectation.
Operators can exec the same auto-review binary inside the image for non-gateway commands.
Release notes continue to include the Docker image reference.

Required tests

Image config/contract test for command and binary path.
Smoke test or Nix check that the image contains auto-review and git.
Release workflow contract updates if image names or release-note text change.

Follow-up implementation slice from #115. ## Decision context The single-binary release must continue publishing the Docker image for recommended production deployment. The image should contain and run the same `auto-review` binary so operators can attach to the container and execute other grouped `auto-review` commands. ## Scope - Update the Nix image/package path so the Docker image includes the public `auto-review` binary. - Change the image default command to run `auto-review gateway`. - Keep publishing the Docker image with each release. - Ensure the image remains usable for `docker exec` / `podman exec` operator commands such as `auto-review ops doctor` or equivalent accepted grouped commands. - Preserve current non-root image behavior, CA certificates, `git`, state directory, and default bind address. ## Acceptance criteria - The published image runs the gateway via `auto-review gateway`. - The image contains no stale `ar-gateway` entrypoint expectation. - Operators can exec the same `auto-review` binary inside the image for non-gateway commands. - Release notes continue to include the Docker image reference. ## Required tests - Image config/contract test for command and binary path. - Smoke test or Nix check that the image contains `auto-review` and `git`. - Release workflow contract updates if image names or release-note text change.

jwilger added a new dependency

2026-05-06 12:14:07 -07:00

#122 Report runtime isolation posture in gateway and CLI diagnostics

jwilger added a new dependency

2026-05-06 12:14:08 -07:00

#120 Update docs, threat model, and red-team tests for single-binary OCI rollout

jwilger added this to the 1.0 milestone

2026-05-06 12:17:50 -07:00

jwilger referenced this issue from a pull request that will close it,

2026-05-07 06:32:07 -07:00

Run Docker image through unified auto-review binary #131

jwilger referenced this issue from a commit