updaze

.project-wiki/technical/deployment.md

@@ -4,7 +4,7 @@ type: technical
 status: active
 title: Deployment (Runtime Environment)
 created: '2026-09-09'
-updated: '2026-09-09'
+updated: '2026-10-11'
 tags:
 - technical
 - deployment
@@ -17,6 +17,7 @@ source_paths:
 - docker/requirements.yml
 - docker/ansible-functs.sh
 - ansible.cfg
+- README.md
 confidence: confirmed
 ---
 
@@ -38,14 +39,24 @@ confidence: confirmed
 
 ## Launch Flow (execute.sh)
 
-1. Pick next free container name `ansible-<n>`.
-2. Ensure IPv6-enabled bridge network `ansible-dualstack` (fails fast with
+1. Resolve `SSH_KEY_DIR` (default `$HOME/.ssh`) and reject a missing or
+   unreadable directory before invoking Docker. Relative paths are resolved
+   against the current working directory.
+2. Pick next free container name `ansible-<n>`.
+3. Ensure IPv6-enabled bridge network `ansible-dualstack` (fails fast with
    a clear message if the network exists without IPv6).
-3. Run the container detached: repo mounted at `/ansible` (workdir), SSH
-   keys from the `ansible_ssh_keys` volume into `/root/.ssh`, env
+4. Run the container detached: repo mounted at `/ansible` (workdir), local
+   SSH directory bind-mounted read-only at `/root/.ssh`, env
    `ANSIBLE_HOST_KEY_CHECKING=False`, `ANSIBLE_CONFIG=./ansible.cfg`.
-4. Write a per-container SSH client config, print name/IPv4/IPv6/OS, then
-   `docker attach` for interactive use.
+   Abort if `docker run` fails.
+5. Print name/IPv4/IPv6/OS, then `docker attach` for interactive use.
+
+The launcher preserves the local SSH configuration and permissions. Standard
+key names are discovered by OpenSSH; other filenames require `IdentityFile`
+or Ansible's `--private-key /root/.ssh/<filename>`. Host-specific absolute
+paths in SSH configuration must also exist inside the container. Encrypted
+keys can be loaded into an agent started inside the container with
+`eval "$(ssh-agent -s)"` followed by `ssh-add /root/.ssh/<filename>`.
 
 ## Controller-Side Artifacts
 
@@ -57,3 +68,5 @@ confidence: confirmed
 - Changing collections requires updating `docker/requirements.yml` and an
   image rebuild (AGENTS.md).
 - Default image tag: `ansible:deb13`.
+- Build from the repository root with `docker build -t ansible:deb13 docker/`.
+- SSH keys are supplied at runtime, not embedded in the image.