docker-compose.yml

services:
  app:
    # One image per project, shared across worktrees: dev/devcontainer computes
    # DEV_IMAGE_REF = <project>-devimg:<fingerprint-of-build-inputs>, builds it
    # only when absent (ensure_image), and `devcontainer clean-images` removes
    # it project-wide. Identical worktrees reuse one image; divergent build
    # inputs get distinct tags and coexist.
    image: ${DEV_IMAGE_REF:?DEV_IMAGE_REF is required}
    build:
      context: ${DEV_BASE_DIR:-.}
      additional_contexts:
        project: ${DEV_PROJECT_DIR:-./defaults}
      dockerfile: Dockerfile
      args:
        USER_UID: "${DEV_UID:-1000}"
        USER_GID: "${DEV_GID:-1000}"
        HOST_USER: "${DEV_HOST_USER:-}"
        DEV_CONTAINER_WORKSPACE: "${DEV_CONTAINER_WORKSPACE:?DEV_CONTAINER_WORKSPACE is required}"
    user: vscode
    working_dir: ${DEV_CONTAINER_WORKSPACE:?DEV_CONTAINER_WORKSPACE is required}
    volumes:
      - ${DEV_WORKSPACE:?DEV_WORKSPACE is required}:${DEV_CONTAINER_WORKSPACE:?DEV_CONTAINER_WORKSPACE is required}:cached
      # mounted at its HOST path so worktree .git files (gitdir: /home/user/…)
      # resolve inside the container without rewriting paths;
      # must be writable — git write operations (add, commit, fetch) write to
      # .git/worktrees/, .git/objects/, and .git/refs/
      - ${DEV_MAIN_GIT:?DEV_MAIN_GIT is required}:${DEV_MAIN_GIT}:cached
      - ${DEV_MAIN_TREE:?DEV_MAIN_TREE is required}:${DEV_MAIN_TREE}:cached
      # sops age key (no-op when dir doesn't exist on host)
      - ${DEV_SOPS_AGE_DIR:-/dev/null}:/home/vscode/.config/sops/age:ro
      # Claude: host config read-only for baseline inheritance
      - ${HOME}/.claude:/home/vscode/.claude-host:ro
      - ${HOME}/.claude.json:/home/vscode/.claude-host.json:ro
      # Claude: container-isolated config (setup-claude copies baseline in and
      # seeds a private per-container token from the :ro host profile store —
      # see docs/adr/0001-devcontainer-private-token-isolation.md). No shared
      # credentials mount: each container refreshes its own token.
      - claude-home:/home/vscode/.claude
    tmpfs:
      - /home/vscode/.claude/shell-snapshots
      # SSH agent forwarding: socat bridges host agent over TCP via host.docker.internal
      # (the actual socket is created at runtime by the devcontainer script)
      - /run/ssh-agent:uid=${DEV_UID:-1000},gid=${DEV_GID:-1000},mode=0700
      # GPG agent forwarding: same socat bridge pattern as SSH
      - /run/gpg-agent:uid=${DEV_UID:-1000},gid=${DEV_GID:-1000},mode=0700
    extra_hosts:
      - "host.docker.internal:host-gateway"
    environment:
      - SSH_AUTH_SOCK=/run/ssh-agent/agent.sock
    command: sleep infinity

volumes:
  # per-worktree: session symlinks and project keys are workspace-specific
  claude-home: