docker-devkit 0.1.0__py3-none-any.whl

docker_devkit/build_docker.py

@@ -0,0 +1,302 @@
+from __future__ import annotations
+
+import json
+import os
+import platform
+import re
+from pathlib import Path
+from typing import Any, Literal
+
+import typer
+import yaml
+from bashrun import bash, bash_output
+from .detect_gpu import GPU_TYPES, Gpu, detect_gpu
+from pydantic_settings import BaseSettings
+
+from .context_sha import compute_service_shas
+from .image_refs import bake_base_image_refs, compose_service_refs, resolve_remote_digest
+
+
+class Settings(BaseSettings):
+    wsl_distro_name: str | None = None
+
+
+settings = Settings.model_validate({})
+
+LOCK_FILE = Path(".env.lock")
+ENV_SHAS_FILE = Path(".env.shas")
+COMPOSE_FILE = Path("compose.yml")
+DEFAULT_BAKE_FILE = Path("compose.bake.yml")
+METADATA_PATH = Path("metadata.json")
+
+Mode = Literal["local", "ci"]
+
+
+app = typer.Typer(add_completion=False, pretty_exceptions_show_locals=False)
+
+
+def _load_lock_file(path: Path):
+    return {
+        (p := line.split("=", 1))[0].strip(): p[1].strip()
+        for line in path.read_text(encoding="utf-8").splitlines()
+        if "=" in line and not line.startswith("#")
+    }
+
+
+def _write_lock_file(path: Path, variables: dict[str, str]):
+    path.write_text(
+        "# Generated by lock.py\n" + "\n".join(f"{k}={v}" for k, v in sorted(variables.items())) + "\n",
+        encoding="utf-8",
+    )
+
+
+# Vibe code - Gemini 3
+def _check_gc_limits(min_gb: int = 60):
+    candidates = [Path("/etc/docker/daemon.json"), Path(os.path.expanduser("~/.docker/daemon.json"))]
+    if settings.wsl_distro_name is not None:
+        try:
+            win_home = bash_output('wslpath $(cmd.exe /c "echo %UserProfile%" 2>/dev/null)').strip()
+            candidates.append(Path(win_home) / ".docker" / "daemon.json")
+        except Exception:
+            pass
+
+    config = next((p for p in candidates if p.exists() and os.access(p, os.R_OK)), None)
+    if not config:
+        print(f"    [WARN] No readable daemon.json found. Ensure defaultKeepStorage > {min_gb}GB.")
+        return
+
+    data = json.loads(config.read_text())
+    raw = data.get("builder", {}).get("gc", {}).get("defaultKeepStorage")
+    if not raw:
+        sample = json.dumps({"builder": {"gc": {"defaultKeepStorage": f"{min_gb}GB"}}}, indent=2)
+        raise RuntimeError(
+            f"Missing 'builder.gc.defaultKeepStorage' in {config}; Docker's default is too low for GPU builds "
+            f"(need >= {min_gb}GB). Add the following (merging into any existing keys) and restart Docker:\n\n{sample}"
+        )
+
+    m = re.match(r"^(\d+(?:\.\d+)?)\s*([TGMK]i?B)?$", str(raw), re.IGNORECASE)
+    if not m:
+        raise RuntimeError(f"Could not parse 'defaultKeepStorage' value: {raw}")
+
+    mult = {"T": 1024, "G": 1, "M": 1 / 1024, "K": 1 / 1024**2, "B": 1 / 1024**3}
+    unit = (m.group(2) or "B")[0].upper()
+    val = float(m.group(1)) * mult.get(unit, 1 / 1024**3)
+
+    if val < min_gb:
+        raise RuntimeError(
+            f"UNSAFE GC LIMIT: {val:.1f}GB in {config} (Required: {min_gb}GB). RESTART DOCKER AFTER FIXING."
+        )
+
+    print(f"    [OK] Docker GC Limit verified: {val:.1f}GB")
+
+
+def _load_compose(path: Path) -> dict[str, Any]:
+    data: dict[str, Any] = yaml.safe_load(path.read_text(encoding="utf-8"))
+    for include in data.pop("include", []):
+        include_path = path.parent / (include if isinstance(include, str) else include["path"])
+        included: dict[str, Any] = yaml.safe_load(include_path.read_text(encoding="utf-8"))
+        data.setdefault("services", {}).update(included.get("services", {}))
+    return data
+
+
+@app.command()
+def build(
+    upgrade: bool = typer.Option(False, "--upgrade", "-u", help="Re-resolve and rewrite base digests."),
+    lock_only: bool = typer.Option(False, "--lock-only", help="Update lock file without building images."),
+    mode: Mode = typer.Option("local", "--mode", help="local: --load images; ci: --push images + registry caches."),
+    gpu: Gpu = typer.Option("auto", "--gpu", help="auto|cuda|rocm|none"),
+    gpu_only: bool = typer.Option(
+        False, "--gpu-only", help="Build only the services suffixed for this gpu (requires a concrete --gpu)."
+    ),
+    no_cache: bool = typer.Option(False, "--no-cache", help="Force rebuild by disabling cache usage."),
+    targets_opt: list[str] | None = typer.Option(
+        None, "--targets", "-t", help="Build only these services (from the selected bake file)."
+    ),
+    bake_file: Path = typer.Option(
+        DEFAULT_BAKE_FILE, "--bake-file", help="Bake file to load (e.g. compose.bake.yml or compose.zed.bake.yml)."
+    ),
+) -> None:
+    run_build(
+        upgrade=upgrade,
+        lock_only=lock_only,
+        mode=mode,
+        gpu=gpu,
+        gpu_only=gpu_only,
+        no_cache=no_cache,
+        targets_opt=targets_opt,
+        bake_file=bake_file,
+    )
+
+
+def run_build(
+    *,
+    upgrade: bool = False,
+    lock_only: bool = False,
+    mode: Mode = "local",
+    gpu: Gpu = "auto",
+    gpu_only: bool = False,
+    no_cache: bool = False,
+    targets_opt: list[str] | None = None,
+    bake_file: Path = DEFAULT_BAKE_FILE,
+) -> None:
+    service_shas = compute_service_shas(Path.cwd(), bake_file)
+    os.environ.update(service_shas)
+
+    # Tags of the images built this run — the local analog of .env.lock's pulled
+    # digests — so raw `docker compose` can resolve the compose graph's ${*_SHA} holes.
+    ENV_SHAS_FILE.write_text(
+        "".join(f"{key}={value}\n" for key, value in sorted(service_shas.items())), encoding="utf-8"
+    )
+
+    # Read bake, compose, and lock files
+    bake_data: dict[str, Any] = yaml.safe_load(bake_file.read_text(encoding="utf-8"))
+    compose_data: dict[str, Any] = _load_compose(COMPOSE_FILE)
+    lock_data = _load_lock_file(LOCK_FILE) if LOCK_FILE.exists() else {}
+
+    # TOOD: Create separate commands for ci and local modes so typer can do this validation instead of us
+    if mode == "ci" and gpu == "auto":
+        raise typer.BadParameter("In CI mode, --gpu cannot be 'auto'; specify 'cuda' or 'rocm'.")
+
+    if gpu_only and gpu not in GPU_TYPES:
+        raise typer.BadParameter("--gpu-only requires a concrete gpu (cuda or rocm), not 'auto' or 'none'.")
+
+    # For local builds, ensure Docker GC limits are high enough that GPU builds don't cause cache evictions
+    if mode == "local" and not lock_only and not targets_opt:
+        _check_gc_limits(min_gb=60)
+
+    # Resolve gpu
+    if gpu == "auto" and not lock_only:
+        gpu = detect_gpu()
+
+    # Resolve base image external dependencies
+    for occurrence in [ref for ref in bake_base_image_refs(bake_data) if upgrade or ref.name not in lock_data]:
+        lock_data[occurrence.name] = (
+            f"@{'' if '$' in occurrence.reference else resolve_remote_digest(occurrence.reference)}"
+        )
+
+    # Resolve third-party image external dependencies. x-image-ref marks services whose image
+    # is sourced externally (vs. built from a bake file), so it's the right discriminator
+    # regardless of how many bake files exist.
+    third_party_images: dict[str, str] = {
+        occurrence.name.upper().replace("-", "_") + "_IMAGE": occurrence.reference
+        for occurrence in compose_service_refs(compose_data)
+    }
+
+    def _needs_resolve(image: str, ref: str) -> bool:
+        if upgrade or image not in lock_data:
+            return True
+        # Re-resolve if the image name in compose.yml changed from what's in the lock file
+        # (e.g. postgres:16-alpine → postgis/postgis:16-3.4-alpine)
+        return not lock_data[image].startswith(ref + "@")
+
+    for image, ref in {image: ref for image, ref in third_party_images.items() if _needs_resolve(image, ref)}.items():
+        lock_data[image] = f"{ref}@{'' if '$' in ref else resolve_remote_digest(ref)}"
+
+    # Update main lock file
+    _write_lock_file(LOCK_FILE, lock_data)
+
+    if lock_only:
+        return
+
+    # Update environment with external dependency image digests
+    os.environ.update(lock_data)
+
+    # Build command arguments
+    command_arguments: list[str] = []
+
+    # Determine bake targets
+    if targets_opt:
+        unknown = set(targets_opt) - set(bake_data["services"])
+        if unknown:
+            raise typer.BadParameter(f"Unknown targets: {unknown}. Available: {sorted(bake_data['services'])}")
+        targets = [t for t in bake_data["services"] if t in set(targets_opt)]
+    else:
+        targets = compute_default_targets(bake_data, gpu, gpu_only)
+
+    # Configure registry caches in CI mode
+    if mode == "ci":
+        for target in targets:
+            target_cache = f"{bake_data['x-registry-cache']}:{target}"
+            command_arguments.append(
+                f"--set {target}.cache-to+=type=registry,ref={target_cache},mode=max,image-manifest=true,oci-mediatypes=true"
+            )
+            command_arguments.append(f"--set {target}.cache-from+=type=registry,ref={target_cache}")
+
+    # `docker buildx --load` only writes a single arch to the host image store,
+    # so bake targets declared multi-platform get overridden to host arch in
+    # local builds. CI uses `--push` and produces the full manifest list.
+    # Override key is `platform` (singular) even though the bake field is plural.
+    if mode == "local":
+        machine = platform.machine().lower()
+        if machine in ("x86_64", "amd64"):
+            host_platform = "linux/amd64"
+        elif machine in ("aarch64", "arm64"):
+            host_platform = "linux/arm64"
+        else:
+            raise RuntimeError(f"Unsupported host architecture: {machine}")
+        for target in targets:
+            target_platforms = bake_data["services"][target].get("build", {}).get("platforms", [])
+            if len(target_platforms) > 1:
+                command_arguments.append(f"--set {target}.platform={host_platform}")
+
+    # Load or push images based on mode
+    command_arguments.append("--load" if mode == "local" else "--push")
+
+    # Handle no-cache option
+    if no_cache:
+        command_arguments.append("--no-cache")
+
+    # Append targets
+    command_arguments.extend(targets)
+
+    # Clean up any existing metadata file
+    METADATA_PATH.unlink(missing_ok=True)
+
+    # Bake images
+    command = [
+        "docker buildx bake",
+        f"-f {bake_file}",
+        f"--metadata-file {METADATA_PATH}",
+        "--progress auto",
+        "--provenance=false",
+        "--sbom=false",
+    ] + command_arguments
+    bash(" ".join(command))
+
+    # Sanity check
+    baked_images: dict[str, Any] = json.loads(METADATA_PATH.read_text()) if METADATA_PATH.exists() else {}
+    if not set(targets) <= baked_images.keys():
+        raise RuntimeError("Baked images do not match target images; something went wrong during the bake.")
+
+
+# x-cross-compile-targets: services declared here are excluded from the default
+# target list because they need special (usually per-arch) treatment; an operator
+# can still opt them in explicitly via --targets. The field is a top-level bake key.
+# Services without build.tags (e.g. neural-networks-base-*) stay out too: they are
+# build-only dependencies pulled in via additional_contexts, and bake rejects a
+# tagless target under --push.
+def compute_default_targets(bake_data: dict[str, Any], gpu: Gpu, gpu_only: bool = False) -> list[str]:
+    cross_compile_targets: set[str] = set(bake_data.get("x-cross-compile-targets", []))
+    tagged_services = [
+        service for service, config in bake_data["services"].items() if config.get("build", {}).get("tags")
+    ]
+    if gpu_only:
+        return [
+            service
+            for service in tagged_services
+            if service.endswith(f"-{gpu}") and service not in cross_compile_targets
+        ]
+    return [
+        service
+        for service in tagged_services
+        if (not any(service.endswith(f"-{g}") for g in GPU_TYPES) or service.endswith(f"-{gpu}"))
+        and service not in cross_compile_targets
+    ]
+
+
+def main() -> None:
+    app()
+
+
+if __name__ == "__main__":
+    main()

docker_devkit/context_sha.py

@@ -0,0 +1,86 @@
+from __future__ import annotations
+
+import os
+import subprocess
+from pathlib import Path, PurePosixPath
+from tempfile import TemporaryDirectory
+
+from typing import Any
+
+import pathspec
+import yaml
+
+
+def _env_var_name(dockerfile_dir: str) -> str:
+    return PurePosixPath(dockerfile_dir).name.upper().replace("-", "_") + "_SHA"
+
+
+def _extract_service_dirs(bake_data: dict[str, Any]) -> set[str]:
+    service_dirs: set[str] = set()
+    services: dict[str, Any] = bake_data["services"]
+    for config in services.values():
+        build: dict[str, Any] = config.get("build", {})
+        if not build.get("tags"):
+            continue
+        dockerfile: str = build.get("dockerfile", "")
+        service_dirs.add(str(PurePosixPath(dockerfile).parent))
+    return service_dirs
+
+
+def compute_service_shas(repo_root: Path, bake_file: Path) -> dict[str, str]:
+    repo_root = repo_root.resolve()
+
+    bake_data: dict[str, Any] = yaml.safe_load(bake_file.read_text(encoding="utf-8"))
+    service_dirs = _extract_service_dirs(bake_data)
+
+    tree_entries = subprocess.run(
+        ["git", "ls-tree", "-r", "HEAD"], cwd=str(repo_root), capture_output=True, text=True, check=True
+    ).stdout.splitlines()
+
+    dockerignore = repo_root / ".dockerignore"
+    spec = pathspec.PathSpec.from_lines("gitignore", dockerignore.read_text().splitlines())
+
+    allowed_entries: list[tuple[str, str, str]] = []
+    for entry in tree_entries:
+        meta, path = entry.split("\t", 1)
+        if spec.match_file(path):
+            continue
+        mode, _type, obj_hash = meta.split()
+        allowed_entries.append((mode, obj_hash, path))
+
+    docker_prefix = "docker/"
+    shared_entries: list[tuple[str, str, str]] = []
+    per_service: dict[str, list[tuple[str, str, str]]] = {d: [] for d in service_dirs}
+
+    for mode, obj_hash, path in allowed_entries:
+        if path.startswith(docker_prefix):
+            for service_dir in service_dirs:
+                if path.startswith(service_dir + "/"):
+                    per_service[service_dir].append((mode, obj_hash, path))
+                    break
+        else:
+            shared_entries.append((mode, obj_hash, path))
+
+    result: dict[str, str] = {}
+    for service_dir in sorted(service_dirs):
+        entries = shared_entries + per_service[service_dir]
+        index_input = "\n".join(f"{mode} {obj_hash}\t{path}" for mode, obj_hash, path in entries) + "\n"
+
+        with TemporaryDirectory() as tmpdir:
+            env = {**os.environ, "GIT_INDEX_FILE": str(Path(tmpdir) / "index")}
+            subprocess.run(
+                ["git", "update-index", "--index-info"],
+                cwd=str(repo_root),
+                env=env,
+                input=index_input.encode(),
+                capture_output=True,
+                check=True,
+            )
+            tree_hash = subprocess.run(
+                ["git", "write-tree"], cwd=str(repo_root), env=env, capture_output=True, text=True, check=True
+            ).stdout.strip()
+
+        var_name = _env_var_name(service_dir)
+        result[var_name] = f"tree-{tree_hash}"
+
+    return result

docker_devkit/detect_gpu.py

@@ -0,0 +1,15 @@
+import shutil
+from typing import Literal, get_args
+
+from bashrun import bash_check
+
+Gpu = Literal["auto", "cuda", "rocm", "none"]
+GPU_TYPES = tuple(g for g in get_args(Gpu) if g not in ("auto", "none"))
+
+
+def detect_gpu() -> Gpu:
+    if shutil.which("nvidia-smi") and bash_check("nvidia-smi"):
+        return "cuda"
+    if shutil.which("rocminfo") and bash_check("rocminfo"):
+        return "rocm"
+    raise RuntimeError("Could not detect GPU type.")

docker_devkit/down.py

@@ -0,0 +1,88 @@
+import os
+from pathlib import Path
+
+import typer
+from bashrun import bash_handoff
+from .detect_gpu import Gpu, detect_gpu
+
+from .context_sha import compute_service_shas
+from .modes import resolve_auth_mode
+
+ENV_FILE = Path(".env")
+LOCK_FILE = Path(".env.lock")
+BAKE_FILE = Path("compose.bake.yml")
+
+
+def _resolve_service_shas() -> None:
+    os.environ.update(compute_service_shas(Path.cwd(), BAKE_FILE))
+
+
+app = typer.Typer(add_completion=False)
+
+
+@app.command()
+def down(
+    volumes: bool = typer.Option(False, "--volumes", "-v", help="Remove named volumes."),
+    gpu: Gpu = typer.Option("auto", "--gpu", help="auto|cuda|rocm|none"),
+    compose_file: Path = typer.Option(
+        Path("compose.yml"),
+        "--compose-file",
+        help=(
+            "Base compose file. In a repo that authors its own stack (where compose.bake.yml lives) the default "
+            "compose.yml tears down the native multi-file stack. A consumer stack is torn down as the single graph "
+            "it was brought up as."
+        ),
+    ),
+) -> None:
+    # Mirror up: native multi-file teardown only when compose.bake.yml is present and the
+    # default compose.yml was requested. A consumer stack tears down its single graph.
+    native = compose_file == Path("compose.yml") and BAKE_FILE.exists()
+
+    if not ENV_FILE.exists():
+        raise RuntimeError("No .env file found")
+
+    if native and not LOCK_FILE.exists():
+        raise RuntimeError("No lock file found; run 'uv run build --lock-only' first")
+
+    if gpu == "auto":
+        gpu = detect_gpu()
+
+    resolve_auth_mode(ENV_FILE)
+
+    if BAKE_FILE.exists():
+        _resolve_service_shas()
+
+    if native:
+        compose_files = (
+            "-f compose.yml "
+            "-f compose.postgres.yml "
+            f"{f'-f compose.{gpu}.yml ' if gpu != 'none' else ''}"
+            "-f compose.dev.yml "  # Include so containers from a prior dev bring-up get torn down even with --no-dev later
+        )
+    else:
+        compose_files = f"-f {compose_file} "
+
+    # .env.lock keeps compose from erroring on missing stack-internal vars; it only
+    # exists in the native repo, so a consumer stack tears down with .env alone.
+    lock_flag = f"--env-file {LOCK_FILE} " if LOCK_FILE.exists() else ""
+    command = (
+        "docker compose "
+        f"{compose_files}"
+        "--profile keycloak "  # Always include so any keycloak containers from a previous AUTH_MODE=keycloak run get torn down
+        "--env-file .env "
+        f"{lock_flag}"
+        "down --remove-orphans"
+    )
+
+    if volumes:
+        command += " -v"
+
+    bash_handoff(command)
+
+
+def main():
+    app()
+
+
+if __name__ == "__main__":
+    main()

docker_devkit/image_refs.py

@@ -0,0 +1,207 @@
+from __future__ import annotations
+
+import datetime
+import re
+import shlex
+import tomllib
+from dataclasses import dataclass
+from itertools import starmap
+from pathlib import Path
+
+import yaml
+from bashrun import bash_output
+from pydantic import BaseModel, ConfigDict, Field, RootModel
+
+BUILD_ARG_PATTERN = re.compile(r"\$\{[A-Za-z0-9_]+\}")
+FROM_PATTERN = re.compile(r"^FROM\s+(?:--platform=\S+\s+)?(\S+)", re.MULTILINE)
+COPY_FROM_PATTERN = re.compile(r"^COPY\s+--from=(\S+)", re.MULTILINE)
+IMAGE_LINE_PATTERN = re.compile(r"^\s*image:\s*[\"']?([^\s\"']+)", re.MULTILINE)
+DIGEST_PATTERN = re.compile(r"^Digest:\s+(sha256:[a-f0-9]+)", re.MULTILINE)
+MISSING_VERSION = "<missing>"
+
+
+class ComposeService(BaseModel):
+    model_config = ConfigDict(extra="ignore")
+
+    image_ref: str | None = Field(default=None, alias="x-image-ref")
+
+
+class ComposeDocument(BaseModel):
+    model_config = ConfigDict(extra="ignore")
+
+    services: dict[str, ComposeService] = Field(default_factory=dict)
+
+
+class BakeDocument(BaseModel):
+    model_config = ConfigDict(extra="ignore")
+
+    base_images: dict[str, str] = Field(default_factory=dict, alias="x-base-images")
+
+
+type TomlValue = (
+    str
+    | int
+    | float
+    | bool
+    | datetime.datetime
+    | datetime.date
+    | datetime.time
+    | list[TomlValue]
+    | dict[str, TomlValue]
+)
+
+
+class TomlDocument(RootModel[TomlValue]):
+    pass
+
+
+@dataclass(frozen=True)
+class ImageReference:
+    name: str
+    reference: str
+
+
+@dataclass(frozen=True)
+class VersionSite:
+    description: str
+    glob: str
+    pattern: str
+    base_image: str | None = None
+
+
+@dataclass(frozen=True)
+class VersionCoupling:
+    name: str
+    pyproject_key: str
+    sites: tuple[VersionSite, ...]
+
+
+def collect_repo_references(
+    root: Path,
+    compose_glob: str = "compose*.yml",
+    bake_glob: str = "compose*.bake.yml",
+    dockerfile_glob: str | None = "docker/*/Dockerfile*",
+    image_glob: str | None = "score/*.yaml",
+) -> list[ImageReference]:
+    return (
+        [
+            reference
+            for path in sorted(root.glob(compose_glob))
+            for reference in compose_service_refs(_load_yaml_document(path))
+        ]
+        + [
+            reference
+            for path in sorted(root.glob(bake_glob))
+            for reference in bake_base_image_refs(_load_yaml_document(path))
+        ]
+        + (
+            [
+                ImageReference("", match.group(1))
+                for path in sorted(root.glob(dockerfile_glob))
+                for match in FROM_PATTERN.finditer(path.read_text(encoding="utf-8"))
+            ]
+            + [
+                ImageReference("", match.group(1))
+                for path in sorted(root.glob(dockerfile_glob))
+                for match in COPY_FROM_PATTERN.finditer(path.read_text(encoding="utf-8"))
+                if "/" in match.group(1)
+            ]
+            if dockerfile_glob
+            else []
+        )
+        + (
+            [
+                ImageReference("", match.group(1))
+                for path in sorted(root.glob(image_glob))
+                for match in IMAGE_LINE_PATTERN.finditer(path.read_text(encoding="utf-8"))
+            ]
+            if image_glob
+            else []
+        )
+    )
+
+
+def compose_service_refs(document: object) -> list[ImageReference]:
+    return [
+        ImageReference(service_name, service.image_ref)
+        for service_name, service in ComposeDocument.model_validate(document).services.items()
+        if service.image_ref is not None
+    ]
+
+
+def bake_base_image_refs(document: object) -> list[ImageReference]:
+    return list(starmap(ImageReference, BakeDocument.model_validate(document).base_images.items()))
+
+
+def _load_yaml_document(path: Path) -> object:
+    return yaml.safe_load(path.read_text(encoding="utf-8"))
+
+
+def strip_build_args(reference: str) -> str:
+    return BUILD_ARG_PATTERN.sub("", reference).strip()
+
+
+def unpinned_references(root: Path) -> list[str]:
+    return [
+        occurrence.reference
+        for occurrence in collect_repo_references(root)
+        if "/" in (reference := strip_build_args(occurrence.reference))
+        and not BUILD_ARG_PATTERN.search(occurrence.reference)
+        and ":" not in (tail := reference[reference.rfind("/") + 1 :])
+        and "@" not in tail
+    ]
+
+
+def version_coupling_violations(root: Path, couplings: list[VersionCoupling]) -> list[str]:
+    return [
+        f"{coupling.name}: {site.description} at {path}: expected {expected}, found {found}"
+        for coupling in couplings
+        for expected in [_declared_version(_pyproject_value(root, coupling.pyproject_key))]
+        for site in coupling.sites
+        for path in _site_paths(root, site)
+        for found in [_site_version(path, site)]
+        if found != expected
+    ]
+
+
+def _pyproject_value(root: Path, dotted_key: str) -> str:
+    value = TomlDocument.model_validate(tomllib.loads((root / "pyproject.toml").read_text(encoding="utf-8"))).root
+    for component in dotted_key.split("."):
+        if not isinstance(value, dict) or component not in value:
+            raise RuntimeError(f"pyproject key {dotted_key} is missing or non-table at {component}")
+        value = value[component]
+    if not isinstance(value, str):
+        raise TypeError(f"pyproject key {dotted_key} is not a string")
+    return value
+
+
+def _declared_version(specifier: str) -> str:
+    return re.sub(r"^[^0-9]+", "", specifier).split(",")[0].strip()
+
+
+def _site_paths(root: Path, site: VersionSite) -> list[Path]:
+    return sorted(root.glob(site.glob)) or [Path(site.glob)]
+
+
+def _site_version(path: Path, site: VersionSite) -> str:
+    if not path.exists():
+        return MISSING_VERSION
+    haystack = _bake_base_image(path, site.base_image) if site.base_image else path.read_text(encoding="utf-8")
+    match = re.search(site.pattern, haystack)
+    return match.group(1) if match else MISSING_VERSION
+
+
+def _bake_base_image(path: Path, key: str) -> str:
+    return next(
+        (reference.reference for reference in bake_base_image_refs(_load_yaml_document(path)) if reference.name == key),
+        "",
+    )
+
+
+def resolve_remote_digest(reference: str) -> str:
+    print(f"Resolving digest for: {reference}")
+    output = bash_output(f"docker buildx imagetools inspect {shlex.quote(reference)}")
+    match = DIGEST_PATTERN.search(output)
+    if match is None:
+        raise RuntimeError(f"Could not parse digest for image reference: {reference}")
+    return match.group(1)

docker_devkit/modes.py

@@ -0,0 +1,39 @@
+from os import environ
+from pathlib import Path
+from urllib.parse import urlparse
+
+VALID_AUTH_MODES = ("keycloak", "disabled")
+DEFAULT_AUTH_MODE = "keycloak"
+
+
+def parse_env_file(path: Path) -> dict[str, str]:
+    result: dict[str, str] = {}
+    for raw_line in path.read_text().splitlines():
+        line = raw_line.strip()
+        if not line or line.startswith("#") or "=" not in line:
+            continue
+        key, _, value = line.partition("=")
+        result[key.strip()] = value.strip().strip("'\"")
+    return result
+
+
+def resolve_auth_mode(env_file: Path) -> str:
+    file_values = parse_env_file(env_file)
+    public_url = environ.get("PUBLIC_URL") or file_values.get("PUBLIC_URL")
+    auth_mode = environ.get("AUTH_MODE") or file_values.get("AUTH_MODE", DEFAULT_AUTH_MODE)
+
+    if not public_url:
+        raise RuntimeError("PUBLIC_URL is required; set it in .env")
+    if auth_mode not in VALID_AUTH_MODES:
+        raise RuntimeError(f"AUTH_MODE={auth_mode!r} is invalid; expected one of {list(VALID_AUTH_MODES)}")
+
+    scheme = urlparse(public_url).scheme
+    if scheme not in ("http", "https"):
+        raise RuntimeError(f"PUBLIC_URL={public_url!r} must use http:// or https://")
+    if scheme == "http" and auth_mode == "keycloak":
+        raise RuntimeError(
+            f"AUTH_MODE=keycloak with PUBLIC_URL={public_url!r} is rejected: OAuth credentials must "
+            f"not flow in cleartext. Use https:// (e.g. via ngrok), or set AUTH_MODE=disabled."
+        )
+
+    return auth_mode

docker_devkit/up.py

@@ -0,0 +1,111 @@
+import os
+from pathlib import Path
+
+import typer
+from bashrun import bash_handoff
+from .detect_gpu import Gpu, detect_gpu
+
+from .build_docker import run_build
+from .context_sha import compute_service_shas
+from .modes import resolve_auth_mode
+
+ENV_FILE = Path(".env")
+LOCK_FILE = Path(".env.lock")
+BAKE_FILE = Path("compose.bake.yml")
+
+
+def _resolve_service_shas() -> None:
+    os.environ.update(compute_service_shas(Path.cwd(), BAKE_FILE))
+
+
+app = typer.Typer(add_completion=False)
+
+
+@app.command()
+def up(
+    attached: bool = typer.Option(False, "--attached", "-a", help="Run in foreground (not detached)"),
+    quiet_pull: bool = typer.Option(
+        False,
+        "--quiet-pull",
+        "-q",
+        help="Suppress per-layer pull progress (still shows pull/push totals).",
+    ),
+    build: bool = typer.Option(
+        False, "--build", help="Build all images locally before bringing the stack up; skips pulling"
+    ),
+    gpu: Gpu = typer.Option("auto", "--gpu", help="auto|cuda|rocm|none"),
+    no_dev: bool = typer.Option(False, "--no-dev", help="Skip layering compose.dev.yml (production-shape bring-up)"),
+    compose_file: Path = typer.Option(
+        Path("compose.yml"),
+        "--compose-file",
+        help=(
+            "Base compose file. In a repo that authors its own images (where compose.bake.yml lives) the default "
+            "compose.yml triggers the native multi-file assembly. A consumer stack — a repo whose compose.yml "
+            "OCI-pulls an already-baked upstream artifact and layers on top — is run as the complete graph with "
+            "only --env-file .env."
+        ),
+    ),
+) -> None:
+    # A repo that authors its own stack carries compose.bake.yml and builds its own images,
+    # so the default compose.yml means the native multi-file stack (postgres + gpu + dev layers,
+    # per-service SHA injection, .env.lock). A consumer repo has no bake file: its
+    # --compose-file is the whole graph (the upstream stack arrives baked via OCI include or a
+    # sibling-checkout include), so SHA resolution and .env.lock don't apply.
+    native = compose_file == Path("compose.yml") and BAKE_FILE.exists()
+
+    if not ENV_FILE.exists():
+        raise RuntimeError("No .env file found; create one first (e.g., copy .env.example)")
+
+    if native and not LOCK_FILE.exists():
+        raise RuntimeError("No lock file found; run 'uv run build --lock-only' first")
+
+    if build and not native:
+        raise typer.BadParameter(
+            "--build is only supported for the native stack (compose.bake.yml present); a consumer stack "
+            "consumes images from an OCI-included upstream artifact and has no local build graph."
+        )
+
+    if gpu == "auto":
+        gpu = detect_gpu()
+
+    auth_mode = resolve_auth_mode(ENV_FILE)
+
+    if build:
+        run_build(gpu=gpu)
+
+    if BAKE_FILE.exists():
+        _resolve_service_shas()
+
+    profile_flag = "--profile keycloak " if auth_mode == "keycloak" else ""
+    if native:
+        gpu_file = f"-f compose.{gpu}.yml " if gpu != "none" else ""
+        dev_file = "" if no_dev else "-f compose.dev.yml "
+        compose_args = (
+            f"-f compose.yml -f compose.postgres.yml {gpu_file}{dev_file}{profile_flag}"
+            f"--env-file .env --env-file {LOCK_FILE}"
+        )
+    else:
+        lock_flag = f"--env-file {LOCK_FILE} " if LOCK_FILE.exists() else ""
+        compose_args = f"-f {compose_file} {profile_flag}--env-file .env {lock_flag}".rstrip()
+
+    up_command = f"docker compose {compose_args} up"
+    if not build:
+        # tree-<sha> tags are immutable (derived from dockerignore-allowlisted
+        # context), so a local hit is byte-identical to what the registry would
+        # serve. --pull missing skips locally-present tags, avoiding hard errors
+        # on images built locally but not yet pushed.
+        up_command += " --pull missing"
+        if quiet_pull:
+            up_command += " --quiet-pull"
+    if not attached:
+        up_command += " -d"
+
+    bash_handoff(up_command)
+
+
+def main():
+    app()
+
+
+if __name__ == "__main__":
+    main()

docker_devkit-0.1.0.dist-info/METADATA

@@ -0,0 +1,13 @@
+Metadata-Version: 2.5
+Name: docker-devkit
+Version: 0.1.0
+Summary: Docker-stack lifecycle commands (up/down/build) with a native/consumer split
+License-File: LICENSE
+License-File: NOTICE
+Requires-Python: >=3.13
+Requires-Dist: bashrun>=0.1.0
+Requires-Dist: pathspec>=1.0.4
+Requires-Dist: pydantic-settings>=2.9.1
+Requires-Dist: pydantic>=2.11.7
+Requires-Dist: pyyaml>=6.0
+Requires-Dist: typer>=0.17.4

docker_devkit-0.1.0.dist-info/RECORD

@@ -0,0 +1,15 @@
+docker_devkit/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+docker_devkit/build_docker.py,sha256=DHv2hbnUPENyZVbmyjW5AZoVmoL-VMNPakAD37CMS_g,11857
+docker_devkit/context_sha.py,sha256=KWwJtIKfgKkogYoPL7_KEcKX8XG3i-P6_ReIOkB5wE4,3085
+docker_devkit/detect_gpu.py,sha256=V7X-eu-q0HrJo_rFmviOor62tm1yKjR2PX2RLnv7JBw,451
+docker_devkit/down.py,sha256=IMl-sjsLfa53sETcss6mEiAGEUhNIo3jYvKHg-t3xqA,2669
+docker_devkit/image_refs.py,sha256=PxYDVLkP43Gmc2Qh-R5AnpwYqkaZFD-uvAE-hWpJlho,6436
+docker_devkit/modes.py,sha256=-6mNyvu3G97PzJ2vsfnXr5LwQhjvhlDfd11u6rkhN6M,1510
+docker_devkit/py.typed,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+docker_devkit/up.py,sha256=_8oZY0DBCC4mroWPjFC6wPIW0raPPwUXFMRoCFU57Cs,4082
+docker_devkit-0.1.0.dist-info/METADATA,sha256=q6uY1zs7LxQJ-BK72wvJGxsdMmiAhdaE-PBHPTyZHww,399
+docker_devkit-0.1.0.dist-info/WHEEL,sha256=W3fkpkm7-wf9vBI5Z-7s0eWkeM-spu78I8Neb98DeEg,87
+docker_devkit-0.1.0.dist-info/entry_points.txt,sha256=0AJlYxdEuQ7w21s1y-07MJ4AU_aJBUfkVWrwrxCqaMI,113
+docker_devkit-0.1.0.dist-info/licenses/LICENSE,sha256=RFhQPdSOiMTguUX7JSoIuTxA7HVzCbj_p8WU36HjUQQ,10947
+docker_devkit-0.1.0.dist-info/licenses/NOTICE,sha256=jvglZza3GCdN7v4_TLuXUqX9C_uABlwAKUkcIeKwk_8,26
+docker_devkit-0.1.0.dist-info/RECORD,,

docker_devkit-0.1.0.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: hatchling 1.32.4
+Root-Is-Purelib: true
+Tag: py3-none-any

docker_devkit-0.1.0.dist-info/entry_points.txt

@@ -0,0 +1,4 @@
+[console_scripts]
+build = docker_devkit.build_docker:app
+down = docker_devkit.down:app
+up = docker_devkit.up:app

docker_devkit-0.1.0.dist-info/licenses/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+1.  Definitions.
+
+    "License" shall mean the terms and conditions for use, reproduction,
+    and distribution as defined by Sections 1 through 9 of this document.
+
+    "Licensor" shall mean the copyright owner or entity authorized by
+    the copyright owner that is granting the License.
+
+    "Legal Entity" shall mean the union of the acting entity and all
+    other entities that control, are controlled by, or are under common
+    control with that entity. For the purposes of this definition,
+    "control" means (i) the power, direct or indirect, to cause the
+    direction or management of such entity, whether by contract or
+    otherwise, or (ii) ownership of fifty percent (50%) or more of the
+    outstanding shares, or (iii) beneficial ownership of such entity.
+
+    "You" (or "Your") shall mean an individual or Legal Entity
+    exercising permissions granted by this License.
+
+    "Source" form shall mean the preferred form for making modifications,
+    including but not limited to software source code, documentation
+    source, and configuration files.
+
+    "Object" form shall mean any form resulting from mechanical
+    transformation or translation of a Source form, including but
+    not limited to compiled object code, generated documentation,
+    and conversions to other media types.
+
+    "Work" shall mean the work of authorship, whether in Source or
+    Object form, made available under the License, as indicated by a
+    copyright notice that is included in or attached to the work
+    (an example is provided in the Appendix below).
+
+    "Derivative Works" shall mean any work, whether in Source or Object
+    form, that is based on (or derived from) the Work and for which the
+    editorial revisions, annotations, elaborations, or other modifications
+    represent, as a whole, an original work of authorship. For the purposes
+    of this License, Derivative Works shall not include works that remain
+    separable from, or merely link (or bind by name) to the interfaces of,
+    the Work and Derivative Works thereof.
+
+    "Contribution" shall mean any work of authorship, including
+    the original version of the Work and any modifications or additions
+    to that Work or Derivative Works thereof, that is intentionally
+    submitted to Licensor for inclusion in the Work by the copyright owner
+    or by an individual or Legal Entity authorized to submit on behalf of
+    the copyright owner. For the purposes of this definition, "submitted"
+    means any form of electronic, verbal, or written communication sent
+    to the Licensor or its representatives, including but not limited to
+    communication on electronic mailing lists, source code control systems,
+    and issue tracking systems that are managed by, or on behalf of, the
+    Licensor for the purpose of discussing and improving the Work, but
+    excluding communication that is conspicuously marked or otherwise
+    designated in writing by the copyright owner as "Not a Contribution."
+
+    "Contributor" shall mean Licensor and any individual or Legal Entity
+    on behalf of whom a Contribution has been received by Licensor and
+    subsequently incorporated within the Work.
+
+2.  Grant of Copyright License. Subject to the terms and conditions of
+    this License, each Contributor hereby grants to You a perpetual,
+    worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+    copyright license to reproduce, prepare Derivative Works of,
+    publicly display, publicly perform, sublicense, and distribute the
+    Work and such Derivative Works in Source or Object form.
+
+3.  Grant of Patent License. Subject to the terms and conditions of
+    this License, each Contributor hereby grants to You a perpetual,
+    worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+    (except as stated in this section) patent license to make, have made,
+    use, offer to sell, sell, import, and otherwise transfer the Work,
+    where such license applies only to those patent claims licensable
+    by such Contributor that are necessarily infringed by their
+    Contribution(s) alone or by combination of their Contribution(s)
+    with the Work to which such Contribution(s) was submitted. If You
+    institute patent litigation against any entity (including a
+    cross-claim or counterclaim in a lawsuit) alleging that the Work
+    or a Contribution incorporated within the Work constitutes direct
+    or contributory patent infringement, then any patent licenses
+    granted to You under this License for that Work shall terminate
+    as of the date such litigation is filed.
+
+4.  Redistribution. You may reproduce and distribute copies of the
+    Work or Derivative Works thereof in any medium, with or without
+    modifications, and in Source or Object form, provided that You
+    meet the following conditions:
+
+    (a) You must give any other recipients of the Work or
+    Derivative Works a copy of this License; and
+
+    (b) You must cause any modified files to carry prominent notices
+    stating that You changed the files; and
+
+    (c) You must retain, in the Source form of any Derivative Works
+    that You distribute, all copyright, patent, trademark, and
+    attribution notices from the Source form of the Work,
+    excluding those notices that do not pertain to any part of
+    the Derivative Works; and
+
+    (d) If the Work includes a "NOTICE" text file as part of its
+    distribution, then any Derivative Works that You distribute must
+    include a readable copy of the attribution notices contained
+    within such NOTICE file, excluding those notices that do not
+    pertain to any part of the Derivative Works, in at least one
+    of the following places: within a NOTICE text file distributed
+    as part of the Derivative Works; within the Source form or
+    documentation, if provided along with the Derivative Works; or,
+    within a display generated by the Derivative Works, if and
+    wherever such third-party notices normally appear. The contents
+    of the NOTICE file are for informational purposes only and
+    do not modify the License. You may add Your own attribution
+    notices within Derivative Works that You distribute, alongside
+    or as an addendum to the NOTICE text from the Work, provided
+    that such additional attribution notices cannot be construed
+    as modifying the License.
+
+    You may add Your own copyright statement to Your modifications and
+    may provide additional or different license terms and conditions
+    for use, reproduction, or distribution of Your modifications, or
+    for any such Derivative Works as a whole, provided Your use,
+    reproduction, and distribution of the Work otherwise complies with
+    the conditions stated in this License.
+
+5.  Submission of Contributions. Unless You explicitly state otherwise,
+    any Contribution intentionally submitted for inclusion in the Work
+    by You to the Licensor shall be under the terms and conditions of
+    this License, without any additional terms or conditions.
+    Notwithstanding the above, nothing herein shall supersede or modify
+    the terms of any separate license agreement you may have executed
+    with Licensor regarding such Contributions.
+
+6.  Trademarks. This License does not grant permission to use the trade
+    names, trademarks, service marks, or product names of the Licensor,
+    except as required for reasonable and customary use in describing the
+    origin of the Work and reproducing the content of the NOTICE file.
+
+7.  Disclaimer of Warranty. Unless required by applicable law or
+    agreed to in writing, Licensor provides the Work (and each
+    Contributor provides its Contributions) on an "AS IS" BASIS,
+    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+    implied, including, without limitation, any warranties or conditions
+    of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+    PARTICULAR PURPOSE. You are solely responsible for determining the
+    appropriateness of using or redistributing the Work and assume any
+    risks associated with Your exercise of permissions under this License.
+
+8.  Limitation of Liability. In no event and under no legal theory,
+    whether in tort (including negligence), contract, or otherwise,
+    unless required by applicable law (such as deliberate and grossly
+    negligent acts) or agreed to in writing, shall any Contributor be
+    liable to You for damages, including any direct, indirect, special,
+    incidental, or consequential damages of any character arising as a
+    result of this License or out of the use or inability to use the
+    Work (including but not limited to damages for loss of goodwill,
+    work stoppage, computer failure or malfunction, or any and all
+    other commercial damages or losses), even if such Contributor
+    has been advised of the possibility of such damages.
+
+9.  Accepting Warranty or Additional Liability. While redistributing
+    the Work or Derivative Works thereof, You may choose to offer,
+    and charge a fee for, acceptance of support, warranty, indemnity,
+    or other liability obligations and/or rights consistent with this
+    License. However, in accepting such obligations, You may act only
+    on Your own behalf and on Your sole responsibility, not on behalf
+    of any other Contributor, and only if You agree to indemnify,
+    defend, and hold each Contributor harmless for any liability
+    incurred by, or claims asserted against, such Contributor by reason
+    of your accepting any such warranty or additional liability.
+
+END OF TERMS AND CONDITIONS
+
+APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+Copyright [yyyy] [name of copyright owner]
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.

docker_devkit-0.1.0.dist-info/licenses/NOTICE

@@ -0,0 +1 @@
+Copyright 2026 Tyler Hatch