The image gets the docker client and compose plugin (static, pinned by digest from
docker:28.5.2-cli). The driver reads the compose projects read-only and talks to
docker-proxy (tecnativa/docker-socket-proxy 0.3.0, GET on containers only) over an
internal network; nothing in the driver can start, stop or change a container.
DEPLOY.md describes the dry run, its limits and the one-time switch from demo data.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
docs/DEV.md (run, env, code layout, tool versions); DESIGN.md records the decisions made at the skeleton stage.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>