lablink-cli 0.1.0a1__tar.gz → 0.3.0__tar.gz

{lablink_cli-0.1.0a1 → lablink_cli-0.3.0}/PKG-INFO

@@ -1,19 +1,18 @@
 Metadata-Version: 2.4
 Name: lablink-cli
-Version: 0.1.0a1
+Version: 0.3.0
 Summary: CLI tool for deploying and managing LabLink infrastructure
 Author-email: Elizabeth Berrigan <eberrigan@salk.edu>, Talmo Pereira <talmo@salk.edu>, Andrew Park <hep003@ucsd.edu>
 Project-URL: Homepage, https://github.com/talmolab/lablink
 Project-URL: Issues, https://github.com/talmolab/lablink/issues
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
-Requires-Dist: lablink-allocator-service[config]>=0.2.0
+Requires-Dist: lablink-allocator-service[config]>=0.4.0
 Requires-Dist: typer>=0.15
 Requires-Dist: textual>=3.0
 Requires-Dist: rich>=13.0
 Requires-Dist: pyyaml>=6.0
 Requires-Dist: boto3>=1.35
-Requires-Dist: psutil>=5.9
 Provides-Extra: dev
 Requires-Dist: pytest; extra == "dev"
 Requires-Dist: pytest-cov; extra == "dev"

{lablink_cli-0.1.0a1 → lablink_cli-0.3.0}/pyproject.toml

@@ -5,7 +5,7 @@ authors = [
   {name = "Talmo Pereira", email = "talmo@salk.edu"},
   {name = "Andrew Park", email = "hep003@ucsd.edu"},
 ]
-version = "0.1.0a1"
+version = "0.3.0"
 description = "CLI tool for deploying and managing LabLink infrastructure"
 readme = "README.md"
 requires-python = ">=3.10"
@@ -13,13 +13,12 @@ dependencies = [
     # >=0.2.0: deploy_compose imports PUBLIC_HOSTNAME_HINT,
     # is_valid_public_hostname and is_weak_admin_password, none of which
     # exist in 0.1.2 — an unpinned resolve breaks `provider: manual`.
-    "lablink-allocator-service[config]>=0.2.0",
+    "lablink-allocator-service[config]>=0.4.0",
     "typer>=0.15",
     "textual>=3.0",
     "rich>=13.0",
     "pyyaml>=6.0",
     "boto3>=1.35",
-    "psutil>=5.9",
 ]
 
 [project.optional-dependencies]

{lablink_cli-0.1.0a1 → lablink_cli-0.3.0}/src/lablink_cli/__init__.py

@@ -1,8 +1,8 @@
 """LabLink CLI - Deploy and manage LabLink infrastructure."""
 
 TEMPLATE_REPO = "talmolab/lablink-template"
-TEMPLATE_VERSION = "v0.3.0"
+TEMPLATE_VERSION = "v0.3.1"
 # SHA-256 of the GitHub release tarball for TEMPLATE_VERSION.
 # Update this when bumping TEMPLATE_VERSION.
 # To compute: curl -sL <tarball_url> | sha256sum
-TEMPLATE_SHA256 = "3d3f8803990f80e6bcda0b3098178d909bc454315fdf2304e70dbee5d43e3bb6"
+TEMPLATE_SHA256 = "97f2f96c7bbdcaeeec8bd681394883409357613bbe40f97115a7a974d61a7660"

{lablink_cli-0.1.0a1 → lablink_cli-0.3.0}/src/lablink_cli/app.py

@@ -258,23 +258,41 @@ def deploy(
         None,
         "--tailscale-authkey",
         help="Tailscale auth key for the allocator's own tailnet sidecar. "
-        "Required on the first deploy when manual.connectivity is "
+        "Needed on the first deploy when manual.connectivity is "
         "'mesh_overlay' and/or manual.participant_exposure is "
-        "'tailscale_funnel'; optional on redeploys (the previous value is "
-        "carried forward). Manual provider only.",
+        "'tailscale_funnel' (prompted if omitted); optional on redeploys "
+        "(the previous value is carried forward). Manual provider only.",
     ),
     cloudflare_tunnel_token: str = typer.Option(
         None,
         "--cloudflare-tunnel-token",
         help="Cloudflare Tunnel token for publishing the allocator at "
-        "manual.public_hostname. Required on the first deploy when "
-        "manual.participant_exposure is 'cloudflare_tunnel'; optional on "
-        "redeploys (the previous value is carried forward). Supply it again "
-        "to rotate. Manual provider only.",
+        "manual.public_hostname. Needed on the first deploy when "
+        "manual.participant_exposure is 'cloudflare_tunnel' (prompted if "
+        "omitted); optional on redeploys (the previous value is carried "
+        "forward). Supply it again to rotate. Manual provider only.",
+    ),
+    render_only: bool = typer.Option(
+        False,
+        "--render-only",
+        help="Render the deployment bundle and print a launch sheet "
+        "instead of starting containers — for running the allocator "
+        "image on an external container platform (Run:AI, Kubernetes) "
+        "where no Docker daemon is available. Manual provider only.",
     ),
 ) -> None:
     """Deploy LabLink infrastructure (AWS OpenTofu or docker-compose)."""
     cfg = _load_cfg(config)
+
+    if render_only and cfg.provider != "manual":
+        from rich.console import Console
+
+        Console().print(
+            "[red]--render-only is only meaningful with provider: manual "
+            f"(this config has provider: {cfg.provider}).[/red]"
+        )
+        raise typer.Exit(1)
+
     if cfg.provider == "manual":
         from lablink_cli.commands.deploy_compose import run_deploy_compose
 
@@ -283,6 +301,7 @@ def deploy(
             yes=yes,
             tailscale_authkey=tailscale_authkey,
             cloudflare_tunnel_token=cloudflare_tunnel_token,
+            render_only=render_only,
         )
         return
 

{lablink_cli-0.1.0a1 → lablink_cli-0.3.0}/src/lablink_cli/commands/cleanup.py

@@ -16,6 +16,7 @@ from rich.panel import Panel
 
 from lablink_allocator_service.conf.structured_config import Config
 
+from lablink_cli import manual
 from lablink_cli.commands.setup import (
     _get_session,
     check_credentials,
@@ -28,8 +29,6 @@ from lablink_cli.docker import Docker, default_docker
 
 console = Console()
 
-DEFAULT_COMPOSE_DIR = Path.home() / ".lablink" / "compose"
-
 
 def _delete_if_exists(
     action: str, fn, *args, **kwargs
@@ -614,15 +613,21 @@ def run_cleanup(
 # Manual-provider cleanup
 # ------------------------------------------------------------------
 def _run_cleanup_manual(
-    cfg: Config, *, dry_run: bool, docker: Docker | None = None
+    cfg: Config,
+    *,
+    dry_run: bool,
+    docker: Docker | None = None,
+    workdir_root: Path | None = None,
 ) -> None:
     """Tear down a local docker-compose allocator stack.
 
     Runs `docker compose down --volumes` in the deployment workdir and
     then removes the workdir itself. No AWS API calls are made.
+
+    `workdir_root` overrides the default compose root (used by tests).
     """
     docker = docker or default_docker()
-    workdir = DEFAULT_COMPOSE_DIR / (cfg.deployment_name or "lablink")
+    workdir = manual.workdir(cfg, workdir_root)
 
     console.print(
         f"[bold]Manual cleanup:[/bold] {cfg.deployment_name or 'lablink'}"

{lablink_cli-0.1.0a1 → lablink_cli-0.3.0}/src/lablink_cli/commands/deploy.py

@@ -273,6 +273,20 @@ def _prompt_passwords() -> dict[str, str]:
     }
 
 
+def _warn_letsencrypt_rate_limit(cfg: Config) -> None:
+    """Warn that LE issues ≤5 certs/domain/7 days — redeploys fail opaquely."""
+    if cfg.ssl.provider != "letsencrypt":
+        return
+    console.print(
+        "  [yellow]Note:[/yellow] Let's Encrypt issues at most 5 "
+        "certificates per domain per 7 days. Repeated deploys of "
+        f"'{cfg.dns.domain}' within a week will hit this limit and the "
+        "site will fail with ERR_SSL_PROTOCOL_ERROR. Use a fresh "
+        "subdomain for repeated test deploys."
+    )
+    console.print()
+
+
 def _build_health_poll_target(cfg: Config, ec2_ip: str) -> dict:
     """Pick the post-deploy poll URL + timeout. Caddy is Host-bound under
     letsencrypt/cloudflare, so those must poll the domain, not the IP."""
@@ -372,6 +386,8 @@ def run_deploy(
     )
     console.print()
 
+    _warn_letsencrypt_rate_limit(cfg)
+
     # Validate AWS credentials
     check_credentials(_get_session(cfg.app.region))
 

{lablink_cli-0.1.0a1 → lablink_cli-0.3.0}/src/lablink_cli/commands/deploy_compose.py

@@ -35,9 +35,15 @@ from lablink_cli.deployment_metrics import (
     write_metrics,
 )
 from lablink_cli.docker import Docker, DockerUnavailable, default_docker
+from lablink_cli.manual import (
+    CANONICAL_URL_FILENAME,
+    DEFAULT_COMPOSE_DIR,  # noqa: F401 — re-exported for callers/tests
+    DEFAULT_HTTP_PORT,
+    RUNTIME_FILENAME,
+    deployment_runtime,
+    workdir as compose_workdir,
+)
 
-DEFAULT_COMPOSE_DIR = Path.home() / ".lablink" / "compose"
-DEFAULT_HTTP_PORT = "80"
 HEALTH_POLL_TIMEOUT_SECONDS = 300
 ALLOCATOR_IMAGE_BASE = "ghcr.io/talmolab/lablink-allocator-image"
 # Only ssl=none is supported by the manual-provider compose stack today:
@@ -61,25 +67,9 @@ FUNNEL_ENABLE_RETRY_DELAY_SECONDS = 2
 # a few seconds; 6 tries 5s apart leaves ~25s of headroom over that.
 PUBLIC_HOSTNAME_MAX_ATTEMPTS = 6
 PUBLIC_HOSTNAME_RETRY_DELAY_SECONDS = 5
-# Name of the file carrying the allocator's real public URL, staged next to
-# config.yaml and bind-mounted to /config/<name>. Must stay in sync with
-# config_helpers.CANONICAL_URL_FILENAME in the allocator package — duplicated
-# rather than imported because each package's CI job installs only its own
-# dependencies, so a cross-package import would fail there. Guarded by
-# test_deploy_compose.py::TestCanonicalUrlFile::test_filename_matches_allocator.
-CANONICAL_URL_FILENAME = "allocator-url"
-
 console = Console()
 
 
-def compose_workdir(cfg: Config, root: Path | None = None) -> Path:
-    """Path to the rendered compose working directory for this deployment.
-
-    `root` overrides `DEFAULT_COMPOSE_DIR` (used by tests via `workdir_root`).
-    """
-    name = cfg.deployment_name or "lablink"
-    return (root or DEFAULT_COMPOSE_DIR) / name
-
 
 def _read_env_value(env_path: Path, key: str) -> str | None:
     """Read a single KEY=value line from an existing .env file.
@@ -99,6 +89,27 @@ def _read_env_value(env_path: Path, key: str) -> str | None:
     return None
 
 
+def _prompt_secret(label: str, hint: str) -> str:
+    """Prompt for a credential the deploy needs but was not given a flag for.
+
+    Typer's own `prompt=` on the flag would fire on every deploy that omits
+    it, including AWS ones that never want the value. The two callers below
+    already know the credential is required, so the prompt lives there.
+
+    getpass keeps the value off the terminal (and out of a `vhs` recording),
+    matching how the admin password is collected in `deploy.py`.
+    """
+    import getpass
+
+    console.print(hint)
+    value = getpass.getpass(f"  {label}: ").strip()
+    if not value:
+        console.print(f"[red]A {label.lower()} is required.[/red]")
+        raise SystemExit(1)
+    console.print()
+    return value
+
+
 def _needs_tailscale_sidecar(cfg: Config) -> bool:
     """True if a tailnet join is needed for either of two independent
     reasons: reaching mesh-overlay clients, or publishing the allocator
@@ -292,8 +303,11 @@ def run_deploy_compose(
     tailscale_authkey: str | None = None,
     cloudflare_tunnel_token: str | None = None,
     docker: Docker | None = None,
+    render_only: bool = False,
 ) -> None:
-    """Bring up the allocator stack via docker-compose.
+    """Bring up the allocator stack via docker-compose, or (with
+    `render_only=True`) render it for an external container platform
+    instead.
 
     Renders the compose working directory (`compose_workdir(cfg)`),
     runs `docker compose up -d`, polls the allocator's `/api/health`
@@ -302,8 +316,16 @@ def run_deploy_compose(
 
     `yes=True` skips the interactive confirmation prompt.
     `workdir_root` overrides `DEFAULT_COMPOSE_DIR` (used by tests).
-    `tailscale_authkey` is required when a tailnet join is needed for
-    either `cfg.manual.connectivity == "mesh_overlay"` or
+    `render_only=True` renders the compose bundle (config.yaml,
+    custom-startup.sh, the canonical-URL file) and writes the
+    `RUNTIME_FILENAME` marker, then prints a launch sheet and returns —
+    no docker on this machine is required or used. For running the
+    allocator image as a workload on an external container platform
+    (Run:AI, Kubernetes) instead of via `docker compose up`. Rejected
+    up front when the config needs the Tailscale sidecar, which such
+    platforms do not grant kernel TUN/NET_ADMIN access for.
+    `tailscale_authkey` is prompted for (hidden) when a tailnet join is
+    needed for either `cfg.manual.connectivity == "mesh_overlay"` or
     `cfg.manual.participant_exposure == "tailscale_funnel"`, unless a
     value is already on record in this deployment's existing `.env`
     (carried forward on ordinary redeploys by `render_compose_dir`) or
@@ -312,7 +334,7 @@ def run_deploy_compose(
     `lablink destroy`, which wipes the working directory — including
     `.env` — but keeps that volume specifically so this doesn't force a
     needless re-auth).
-    `cloudflare_tunnel_token` is required when
+    `cloudflare_tunnel_token` is prompted for (hidden) when
     `cfg.manual.participant_exposure == "cloudflare_tunnel"`, unless a
     value is already on record in this deployment's existing `.env`. There
     is no state-volume equivalent here: the tunnel's identity lives in
@@ -322,29 +344,49 @@ def run_deploy_compose(
     target = compose_workdir(cfg, workdir_root)
 
     needs_sidecar = _needs_tailscale_sidecar(cfg)
+
+    # Preflight: --render-only can't serve a config that needs the
+    # Tailscale sidecar — a managed external container platform (the
+    # whole point of --render-only) grants the workload no kernel TUN
+    # device / NET_ADMIN, which containerboot requires to join a tailnet.
+    # Placed before ANY docker use — including the
+    # _tailscale_state_volume_exists check just below, which calls
+    # docker.volume_exists() and therefore docker.require() — so a
+    # docker-less machine gets this clean message instead of an unhandled
+    # DockerUnavailable traceback.
+    if render_only and needs_sidecar:
+        console.print(
+            "[red]--render-only cannot serve this config: "
+            f"manual.connectivity={cfg.manual.connectivity!r} / "
+            f"manual.participant_exposure={cfg.manual.participant_exposure!r} "
+            "need the Tailscale sidecar (kernel TUN device + NET_ADMIN), "
+            "which managed container platforms do not grant. Use "
+            "connectivity=reverse_tunnel with "
+            "participant_exposure=cloudflare_tunnel instead.[/red]"
+        )
+        raise SystemExit(1)
+
     if needs_sidecar:
         # Checking ".env exists" alone (i.e. "is this a redeploy") isn't
         # enough: a redeploy that *switches* to needing the sidecar has
         # an existing .env, but that .env has no TS_AUTHKEY line to carry
         # forward. Read the actual prior value (if any) so that case
-        # still requires --tailscale-authkey instead of silently
-        # rendering an empty key.
+        # still prompts instead of silently rendering an empty key.
         previous_authkey = _read_env_value(target / ".env", "TS_AUTHKEY")
         if (
             not tailscale_authkey
             and not previous_authkey
             and not _tailscale_state_volume_exists(target, docker=docker)
         ):
-            console.print(
-                "[red]A Tailscale sidecar is needed (manual.connectivity "
-                "is 'mesh_overlay' and/or manual.participant_exposure is "
-                "'tailscale_funnel') but no --tailscale-authkey was given, "
-                "and no previous value is on record for this "
-                "deployment.[/red]\n"
-                "Generate an authkey from your Tailscale admin console "
-                "and re-run with --tailscale-authkey <key>."
+            tailscale_authkey = _prompt_secret(
+                "Tailscale authkey",
+                "A Tailscale sidecar is needed (manual.connectivity is "
+                "'mesh_overlay' and/or manual.participant_exposure is "
+                "'tailscale_funnel') and no authkey is on record for this "
+                "deployment.\n"
+                "Generate one from your Tailscale admin console "
+                "(Settings > Keys).",
             )
-            raise SystemExit(1)
 
     # Preflight: cloudflare_tunnel needs a hostname and a token. The
     # hostname is also checked by get_config_errors(), but `lablink deploy`
@@ -380,16 +422,14 @@ def run_deploy_compose(
             raise SystemExit(1)
         previous_cf_token = _read_env_value(target / ".env", "CLOUDFLARE_TUNNEL_TOKEN")
         if not cloudflare_tunnel_token and not previous_cf_token:
-            console.print(
-                "[red]manual.participant_exposure is 'cloudflare_tunnel' but "
-                "no --cloudflare-tunnel-token was given, and no previous "
-                "value is on record for this deployment.[/red]\n"
+            cloudflare_tunnel_token = _prompt_secret(
+                "Cloudflare tunnel token",
+                "manual.participant_exposure is 'cloudflare_tunnel' and no "
+                "token is on record for this deployment.\n"
                 "Create a tunnel in Cloudflare's Zero Trust dashboard "
-                "(Networks > Tunnels), copy the token from its Docker "
-                "install command, and re-run with "
-                "--cloudflare-tunnel-token <token>."
+                "(Networks > Tunnels) and copy the token from its Docker "
+                "install command.",
             )
-            raise SystemExit(1)
 
     # Preflight: SSL provider must be one the compose template supports.
     # The allocator image has no TLS terminator, so only ssl=none works
@@ -431,16 +471,19 @@ def run_deploy_compose(
         )
         raise SystemExit(1)
 
-    # Preflight: docker on PATH.
-    try:
-        docker.require()
-    except DockerUnavailable:
-        console.print(
-            "[red]docker not found on PATH.[/red] "
-            "Install Docker Engine + the Compose plugin "
-            "(https://docs.docker.com/engine/install/) and re-run."
-        )
-        raise SystemExit(1)
+    # Preflight: docker on PATH. Not needed for --render-only — the whole
+    # point is running the image on a platform without a local docker
+    # daemon.
+    if not render_only:
+        try:
+            docker.require()
+        except DockerUnavailable:
+            console.print(
+                "[red]docker not found on PATH.[/red] "
+                "Install Docker Engine + the Compose plugin "
+                "(https://docs.docker.com/engine/install/) and re-run."
+            )
+            raise SystemExit(1)
 
     # Resolve admin credentials (mirrors AWS deploy.py). The wizard does
     # NOT collect admin user/password — they're resolved here. Write the
@@ -473,13 +516,35 @@ def run_deploy_compose(
             raise SystemExit(1)
 
     if not yes:
-        action = "create" if not target.exists() else "update"
+        existed_before = target.exists()
+        action = "create" if not existed_before else "update"
+        verb = (
+            f"render an external-runtime bundle in {target}"
+            if render_only
+            else f"{action} compose stack in {target}"
+        )
         console.print(
-            f"About to {action} compose stack in {target}\n"
+            f"About to {verb}\n"
             f"  provider: manual\n"
             f"  ssl: {cfg.ssl.provider}\n"
             f"  admin user: {admin_user}\n"
         )
+        # A workdir that already exists with no external marker is a live
+        # compose-managed deployment. --render-only would flip it to
+        # external — after which `lablink destroy` stops managing any
+        # local compose stack for it at all, orphaning one still running.
+        # Only the marker transition is checked here (no docker probe):
+        # the transition itself is the signal, regardless of whether a
+        # stack happens to be up right now.
+        if render_only and existed_before and deployment_runtime(target) == "compose":
+            console.print(
+                "[bold red]Warning:[/bold red] this deployment is currently "
+                "managed by docker-compose. --render-only will flip it to "
+                "external-runtime — afterward, `lablink destroy` no longer "
+                "manages any local docker-compose stack for it. If a "
+                "compose stack is running for this deployment, tear it "
+                "down FIRST with `lablink destroy`, before proceeding here."
+            )
         if not typer.confirm("Proceed?", default=True):
             console.print("Aborted.")
             raise SystemExit(1)
@@ -514,6 +579,62 @@ def run_deploy_compose(
         )
         console.print(f"[green]Rendered {target}[/green]")
 
+        # Write or clear the runtime marker `deployment_runtime()` reads
+        # back (status/logs/destroy branch on it). render_only returns
+        # immediately after — no docker.compose/health-poll/summary,
+        # since an external platform runs the image, not this machine.
+        marker = target / RUNTIME_FILENAME
+        if render_only:
+            marker.write_text("external\n")
+
+            # A bundle with no recorded public URL leaves every day-2
+            # command broken: `status`/`logs` have no address to reach the
+            # externally-run allocator at, and (until now) `status` simply
+            # probed localhost, which has nothing listening on it for this
+            # mode. Read the canonical-URL file directly rather than
+            # importing status._public_url, to avoid a needless
+            # cross-module reach for one string check.
+            canonical_url = (target / CANONICAL_URL_FILENAME).read_text().strip()
+            if not canonical_url.startswith(("http://", "https://")):
+                console.print(
+                    "[red]--render-only produced a bundle with no public "
+                    "URL recorded.[/red]\n"
+                    "Day-2 `lablink status` / `lablink logs` need one to "
+                    "reach the externally-run allocator. The only exposure "
+                    "mode --render-only supports today is "
+                    "manual.participant_exposure: cloudflare_tunnel (with "
+                    "manual.public_hostname set) — update your config and "
+                    "re-render."
+                )
+                raise SystemExit(1)
+
+            # Render-only's own success write, mirroring the compose
+            # path's success write below (allocator_deploy_end_time /
+            # allocator_total_deployment_duration_seconds / status) —
+            # the render IS the deploy action here, so without this the
+            # in_progress record written above would never be finalized
+            # (the early return skips the compose path's write entirely).
+            # No compose_up/health_check phases ran in this path, so the
+            # duration sums to 0 — an honest reflection of "no docker
+            # phases," not a stand-in for a real elapsed time.
+            metrics.allocator_deploy_end_time = datetime.now(timezone.utc).isoformat()
+            metrics.allocator_total_deployment_duration_seconds = round(
+                sum(
+                    v
+                    for v in (
+                        metrics.allocator_compose_up_duration_seconds,
+                        metrics.allocator_health_check_duration_seconds,
+                    )
+                    if v is not None
+                ),
+                3,
+            )
+            metrics.status = "success"
+            write_metrics(metrics_path, metrics)
+            _print_launch_sheet(cfg, target, console)
+            return
+        marker.unlink(missing_ok=True)
+
         # Explicitly disable Funnel *before* _compose_up, whenever the new
         # config no longer wants it — this must run before --remove-orphans
         # potentially deletes the sidecar (a removed container can't be
@@ -860,6 +981,34 @@ def _print_last_log_lines(lines: int = 30, *, docker: Docker) -> None:
         console.print(_redact_secrets(result.stdout))
 
 
+def _print_launch_sheet(cfg: Config, workdir: Path, console: Console) -> None:
+    """Print everything needed to launch the rendered bundle on an
+    external container platform (the platform is the container runtime;
+    nothing needs docker on this machine)."""
+    cf_token = _read_env_value(workdir / ".env", "CLOUDFLARE_TUNNEL_TOKEN")
+    console.print("\n[bold]Bundle rendered — launch it on your platform:[/bold]")
+    console.print(f"  Image:    {_allocator_image(cfg)}  (default command)")
+    console.print("  Env vars:")
+    console.print(f"    PARTICIPANT_EXPOSURE={cfg.manual.participant_exposure}")
+    if cfg.manual.participant_exposure == "cloudflare_tunnel":
+        console.print(f"    CLOUDFLARE_TUNNEL_TOKEN={cf_token or '<missing>'}")
+    console.print("  Mounts (read-only files, all rendered in this dir):")
+    console.print(f"    {workdir}/config.yaml        -> /config/config.yaml")
+    console.print(f"    {workdir}/custom-startup.sh  -> /config/custom-startup.sh")
+    console.print(f"    {workdir}/allocator-url      -> /config/allocator-url")
+    console.print(
+        "  Persistent volume (optional): /var/lib/postgresql "
+        "(DB survives pod restarts)"
+    )
+    console.print("  Inbound ports: none required — every leg dials out.")
+    console.print("  The image expects to run as root (postgres + nginx).")
+    console.print(
+        "\n  After boot, the BYO register token prints in the workload's "
+        "log\n  (also at /var/log/lablink/allocator.log inside the "
+        "container).\n  See docs: CLI → External runtime (Run:AI walkthrough)."
+    )
+
+
 def _print_summary(
     cfg: Config,
     *,
@@ -916,6 +1065,15 @@ def _print_summary(
             "  Allocator URL (LAN):   (no LAN IP detected — pass the "
             "operator host's reachable address manually)"
         )
+    # public_url and lan_direct are mutually exclusive (preflight above), so
+    # this chain encodes the connectivity rule without re-reading it.
+    admin_url = public_url or lan_url or local_url
+    # soft_wrap: a real Funnel URL plus the column prefix overruns 80 cols.
+    console.print(
+        f"  Admin URL:             {admin_url}/admin",
+        soft_wrap=True,
+        highlight=False,
+    )
     console.print(f"  Admin user:            {cfg.app.admin_user}")
     if register_token:
         console.print(f"  Register token:        {register_token}")
@@ -1146,6 +1304,36 @@ def run_destroy_compose(
         )
         return
 
+    if deployment_runtime(target) == "external":
+        console.print(
+            "[bold]This deployment runs on an external platform[/bold] — "
+            "there is nothing to stop here.\n"
+            "Delete the platform workload yourself (e.g. "
+            "`runai workspace delete <name> -p <project>`); any Postgres "
+            "data lives in the volume you attached there.\n"
+            f"Removing only the local bundle at {target}."
+        )
+        if not yes:
+            confirmation = typer.prompt(
+                f"Type 'yes' to remove the local bundle at {target}",
+                default="no",
+                show_default=False,
+            )
+            if confirmation.strip().lower() != "yes":
+                console.print("Aborted.")
+                raise SystemExit(1)
+        shutil.rmtree(target)
+        console.print(f"[green]Removed {target}.[/green]")
+        console.print(
+            "\n[bold]Reminder:[/bold] this only removed the local rendered "
+            "bundle — every BYO client still has `lablink-client` running, "
+            "and any client submitted as its own platform workload is "
+            "still running there too.\n"
+            "Run [bold]lablink client unregister[/bold] on each BYO box, "
+            "and delete each client workload on the platform yourself."
+        )
+        return
+
     if not yes:
         if not keep_data:
             console.print(