openso/docker-templates
Watch
1
0
Fork
You've already forked docker-templates
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Import reference Docker Compose templates and openso agent rules #2

Merged
MHE merged 9 commits from feat/import-reference-templates into main 2026-10-22 08:30:24 +02:00
Conversation 0 Commits 9 Files changed 32 +986
MHE commented 2026-10-22 08:18:21 +02:00
Owner
Copy link

What changed

Imports the initial repository baseline for docker-templates:

  • Commit gate: .githooks/pre-commit runs only executable scripts in .openso/scripts/commit/ (empty for now, so the gate passes).
  • Agent policy: AGENTS.md points agents at .openso/rules/ as the single source of conventions. .pi/ holds PI runtime settings, with empty skills/ and prompts/ directories.
  • Rules (.openso/rules/): naming and format, repository layout, Compose extension keys and anchors, env file conventions, scripts cleanup, security baseline, image build handoff, and self-improvement process.
  • Memory (.openso/memory/): dated layout and workflow decisions that are staged for promotion into rules.
  • App template (app_template/): hardened application Compose stack with Traefik labels, Docker secrets, read-only root filesystem, dropped capabilities, resource limits, and a README with a placeholder checklist.
  • Service template (templates/template/): shared, hardened single-service Compose template that any app can require via x-required-services, with the same anchor contract.
  • Repo hygiene: .gitignore for generated files (docker-compose.main.yaml, app.env, .run.conf/) and Python bytecode, plus MIT LICENSE.

Why

Establishes a reusable, security-first baseline so new apps and satellite services start from one shared template instead of copies, and so conventions live in one place (.openso/rules/) that humans and agents both follow. Secrets in the templates are placeholders (CHANGE_ME) only.

Notes for reviewers

  • forgejo-dind is the documented privileged exception (.openso/rules/30-security-baseline.md); it is not included in this PR.
  • Template and app Compose files use placeholders (<other-service>, <health-check-command>, your-image:latest) by design and are not valid to deploy as-is.
  • No runtime code is added beyond the commit gate and documentation/config files.
## What changed Imports the initial repository baseline for `docker-templates`: - **Commit gate**: `.githooks/pre-commit` runs only executable scripts in `.openso/scripts/commit/` (empty for now, so the gate passes). - **Agent policy**: `AGENTS.md` points agents at `.openso/rules/` as the single source of conventions. `.pi/` holds PI runtime settings, with empty `skills/` and `prompts/` directories. - **Rules** (`.openso/rules/`): naming and format, repository layout, Compose extension keys and anchors, env file conventions, scripts cleanup, security baseline, image build handoff, and self-improvement process. - **Memory** (`.openso/memory/`): dated layout and workflow decisions that are staged for promotion into rules. - **App template** (`app_template/`): hardened application Compose stack with Traefik labels, Docker secrets, read-only root filesystem, dropped capabilities, resource limits, and a README with a placeholder checklist. - **Service template** (`templates/template/`): shared, hardened single-service Compose template that any app can require via `x-required-services`, with the same anchor contract. - **Repo hygiene**: `.gitignore` for generated files (`docker-compose.main.yaml`, `app.env`, `.run.conf/`) and Python bytecode, plus MIT `LICENSE`. ## Why Establishes a reusable, security-first baseline so new apps and satellite services start from one shared template instead of copies, and so conventions live in one place (`.openso/rules/`) that humans and agents both follow. Secrets in the templates are placeholders (`CHANGE_ME`) only. ## Notes for reviewers - `forgejo-dind` is the documented privileged exception (`.openso/rules/30-security-baseline.md`); it is not included in this PR. - Template and app Compose files use placeholders (`<other-service>`, `<health-check-command>`, `your-image:latest`) by design and are not valid to deploy as-is. - No runtime code is added beyond the commit gate and documentation/config files.
New apps start from this baseline: a published port for the Traefik file provider, and anchors shared with satellite services.

Co-authored-by: Cursor <cursoragent@cursor.com>
Agents, the commit hook, and the rules now live in the tree, including how a container gets its time zone.

Co-authored-by: Cursor <cursoragent@cursor.com>
Call out the Traefik route, restart behaviour, template overrides, and where the container clock is defined.

Co-authored-by: Cursor <cursoragent@cursor.com>
The app template keeps secret exclusions and host log rotation commented, and inline comments stay true when an app copies them.

Co-authored-by: Cursor <cursoragent@cursor.com>
A satellite shares an app section only when the values match, and a copied template renames TEMPLATE to its required-service name.

Co-authored-by: Cursor <cursoragent@cursor.com>
Every template is one reusable service. App differences stay in the app .env, and a privileged exception has to be named before it is merged.

Co-authored-by: Cursor <cursoragent@cursor.com>
A Compose file ends its SPDX header with the document start. Trailing comments stay on character 161, and the reference comments describe the line.

Co-authored-by: Cursor <cursoragent@cursor.com>
Commented labels use the template suffix, and the shared comments now match the app template.

Co-authored-by: Cursor <cursoragent@cursor.com>
A rule names what every matching app and template must do. Host logrotate stays tied to a large bind-mounted log.

Co-authored-by: Cursor <cursoragent@cursor.com>
MHE merged commit 102de5dfdf into main 2026-10-22 08:30:24 +02:00
MHE deleted branch feat/import-reference-templates 2026-10-22 09:54:29 +02:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
openso/docker-templates!2
No description provided.