Build from source on ruby:3.4.10-trixie (trimmed from the upstream dev
Dockerfile: no Chromium, no sudo, fixed non-root user). Uses the
postgresql and localstorage addons; start.sh regenerates
database.yml/secrets.yml under /app/data every boot, seeds the DB once
(marker file) with a local admin, runs memcached in-container, and
backgrounds a delayed_job worker gated on migrations. Platform OIDC is
wired into secrets.yml; local login stays for the seeded admin.
Also drop --rm from the app container in grind-stack.sh so a crashed
container keeps its logs for `logs`.
Serial one-at-a-time test harness: builds under ukrrs-batch.slice,
ephemeral pg/redis/mysql per manifest addons, app driven by the real
CLOUDRON_* env contract. All resources labeled cloudron.grind=1 so
down/sweep cannot touch fleet containers. AGENTS.md documents the
per-package lifecycle (up/curl/logs/down/sweep) + host resource rules.
mrcharles