build: containerize the control layer and publish it to GHCR

Add a second image for the handler control CLI (spawn/list/kill, approve/
reject, forge-init, CI poller) alongside the existing API image. It shares
the package, database, and /var/lib/handler volume but runs the control
process instead of uvicorn.

- Dockerfile.control: git + tmux baked in for live spawning; default CMD is
  the `poll-ci --watch` loop; RUN_MIGRATIONS toggle reuses docker-entrypoint.sh.
- docker-control.yml: builds/pushes ghcr.io/<repo>/control (multi-arch),
  scoped gha cache so it doesn't clobber the API build.
- docker-compose.yml: new `control` service, RUN_MIGRATIONS=false, depends on
  the API (which owns migrations) being healthy.
- README: Containers section documenting both images and compose usage.
This commit is contained in:
Claude
2026-07-10 15:39:10 +00:00
parent da8ffff84c
commit 7b5a5e3c27
5 changed files with 187 additions and 0 deletions
+26
View File
@@ -143,6 +143,32 @@ curl -s -X POST $BASE/projects/leeworks-api/agents/api/resume -H "$TOKEN" \
-H 'Content-Type: application/json' -d '{}'
```
## Containers
Two images are published to GHCR, one per process, sharing the package, the database, and
the `/var/lib/handler` data volume:
| Image | Dockerfile | Runs | Workflow |
|---|---|---|---|
| `ghcr.io/0xwheatyz/handler` | [`Dockerfile`](Dockerfile) | the API (`uvicorn`) — also applies migrations on start | [`docker.yml`](.github/workflows/docker.yml) |
| `ghcr.io/0xwheatyz/handler/control` | [`Dockerfile.control`](Dockerfile.control) | the control layer (`handler poll-ci --watch`) | [`docker-control.yml`](.github/workflows/docker-control.yml) |
The control image bakes in `git` + `tmux`; the `claude` and `forge` binaries are
bring-your-own (layer or mount them in for live agent spawning — the CI poller degrades
gracefully without `forge`).
[`docker-compose.yml`](docker-compose.yml) wires both up with Postgres. The API owns
migrations, so the control service runs with `RUN_MIGRATIONS=false` and waits for the API:
```bash
export AUTH_TOKEN="$(openssl rand -hex 32)"
docker compose up -d # db + api + control (CI poller)
# One-shot control commands run against the same image:
docker compose run --rm control handler list
docker compose run --rm control handler spawn --project leeworks-api --name junior --task "…"
```
## Control CLI
The `handler` command manages agent processes (the write side):