didericis
6a22b9f654
Rootless Docker cannot run in an Apple Container bottle: the runtime's capability bounding set omits CAP_SYS_ADMIN, which the kernel requires to write a multi-range uid_map via newuidmap. Every other prerequisite (setuid bit, subuid ranges, initial userns, no nosuid, no seccomp) was already correct, so this is not a packaging gap we can close. Also records two defects found while validating the podman alternative: - a large download OOM-kills the shared egress proxy, which buffers whole response bodies to scan them; the gateway is a per-host singleton with no restart-on-death, so one bottle's pull removes egress for every bottle - registry auth collides with the proxy's unconditional Authorization strip, measured: a valid bearer token behaves exactly like sending none Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GnMp8SUGH57hZX7192Rv2F
Docs
How this project records what it builds and why — and a guide to picking the right document for what you're capturing.
When to write which document
| Artifact | For |
|---|---|
PRD (docs/prds/) |
A feature: what to build, scope, success criteria. |
Research note (docs/research/) |
A landscape/tradeoff investigation. |
Decision record (docs/decisions/) |
A decision that isn't itself a feature — a policy, a convention, a "we will / won't do this," or a load-bearing choice made inside a larger PRD that deserves to be discoverable on its own. |
A decision that's fully specified by a PRD doesn't need duplicating in a decision record. Write one when the decision would otherwise be buried in prose, lost in an issue thread, or have no in-repo home at all (small requests that don't merit a PRD; non-feature choices like merge strategy or a trust posture).