fix(docker): include compose and persist home

.changeset/docker-compose-home.md

@@ -0,0 +1,5 @@
+---
+"@jmfederico/pi-web": patch
+---
+
+Keep the Docker setup documented as beta-only, include Docker Compose/Buildx in the container images, and make the container user's home persist under `/data/home`.

README.md

@@ -72,16 +72,6 @@ Common alternatives:
 curl -fsSL https://raw.githubusercontent.com/jmfederico/pi-web/main/install.sh | sh
 ```
 
-For trusted local/server installs, PI WEB also has a Docker local-build runtime:
-
-```bash
-curl -fsSL https://raw.githubusercontent.com/jmfederico/pi-web/main/docker/install.sh | sh
-```
-
-The Docker setup builds an openSUSE Tumbleweed based local image from npm, runs split `sessiond` and `web` services, and binds the browser UI to `127.0.0.1:8504` by default. It intentionally mounts the Docker socket and selected host paths; treat it as root-equivalent host access and use an SSH tunnel, VPN, or authenticated reverse proxy for remote access.
-
-See the [Docker guide](https://github.com/jmfederico/pi-web/blob/main/docker/README.md) for trust warnings, version pinning, package customization, host command examples, and development Compose usage.
-
 PI WEB is also published as a Pi package:
 
 ```bash
@@ -183,17 +173,6 @@ pi-web install --dev
 
 `dev:web` also watches bundled plugin TypeScript and rebuilds the browser-loaded plugin JavaScript under `dist/pi-web-plugins/`. You can restart `dev:web` or `dev:client` without stopping active Pi sessions.
 
-Docker development from the checkout is available too:
-
-```bash
-export PI_WEB_UID=$(id -u)
-export PI_WEB_GID=$(id -g)
-export DOCKER_GID=$(stat -c '%g' /var/run/docker.sock)
-docker compose -f docker/compose.dev.yml up --build
-```
-
-Open <http://127.0.0.1:8505>. The Docker dev setup keeps `sessiond` separate from the autoreloading web/API/client service and uses the runtime Docker data directory by default so sessions can be shared across modes. See the [Docker guide](https://github.com/jmfederico/pi-web/blob/main/docker/README.md#development-docker-setup).
-
 For a production-style run from a checkout:
 
 ```bash

docker/Dockerfile

@@ -54,6 +54,7 @@ ENV NODE_ENV=production \
 COPY --from=package /usr/local/lib/node_modules /usr/local/lib/node_modules
 COPY --from=package /usr/local/bin /usr/local/bin
 COPY --from=docker-cli /usr/local/bin/docker /usr/local/bin/docker
+COPY --from=docker-cli /usr/local/libexec/docker/cli-plugins /usr/local/libexec/docker/cli-plugins
 COPY bin/hostexec /usr/local/bin/hostexec
 RUN chmod 0755 /usr/local/bin/hostexec
 

docker/Dockerfile.dev

@@ -43,6 +43,7 @@ RUN npm ci \
   && chmod 0777 /workspace
 
 COPY --from=docker-cli /usr/local/bin/docker /usr/local/bin/docker
+COPY --from=docker-cli /usr/local/libexec/docker/cli-plugins /usr/local/libexec/docker/cli-plugins
 COPY docker/bin/hostexec /usr/local/bin/hostexec
 RUN chmod 0755 /usr/local/bin/hostexec
 

docker/README.md

@@ -1,4 +1,6 @@
-# PI WEB Docker
+# PI WEB Docker (beta)
+
+This Docker setup is beta. It is useful for trusted local/server testing and development, but it may still have rough edges and is intentionally documented only here for now.
 
 PI WEB has two Docker modes:
 
@@ -108,7 +110,7 @@ Host-derived IDs are refreshed on rerun unless you explicitly override them. Use
 
 ### Base image and tooling
 
-The Docker runtime and development images are openSUSE Tumbleweed based by default. They install Node.js 22, npm, `npx`, and Corepack through zypper, using the openSUSE Node.js build service repository when needed for the selected architecture. The image's `pi-web` account is created with `PI_WEB_UID:PI_WEB_GID`, so shells have a passwd entry instead of showing `I have no name!` when the host user is not `1000:1000`. The image also includes common agent/development tools such as Git/Git LFS, GitHub CLI, OpenSSH, Python with pip/virtualenv and headers, native build tooling, `jq`, `ripgrep`, `fd`, `fzf`, `bat`, ShellCheck, archive tools, network utilities, and the Docker CLI.
+The Docker runtime and development images are openSUSE Tumbleweed based by default. They install Node.js 22, npm, `npx`, and Corepack through zypper, using the openSUSE Node.js build service repository when needed for the selected architecture. The image's `pi-web` account is created with `PI_WEB_UID:PI_WEB_GID` and `/data/home` as its home directory, so shells have a passwd entry instead of showing `I have no name!` while user config stays in the persistent `/data` mount. The image also includes common agent/development tools such as Git/Git LFS, GitHub CLI, OpenSSH, Python with pip/virtualenv and headers, native build tooling, `jq`, `ripgrep`, `fd`, `fzf`, `bat`, ShellCheck, archive tools, network utilities, and the Docker CLI with Compose and Buildx plugins.
 
 Install extra distro packages without writing a hook by setting a whitespace-delimited package list:
 

docker/bin/install-opensuse-base

@@ -138,6 +138,9 @@ esac
 
 runtime_user=pi-web
 runtime_group=pi-web
+runtime_home=/data/home
+mkdir -p "$runtime_home" /data/config /data/npm-cache /data/pi-web /data/pi-agent /workspace
+
 if getent group "$runtime_gid" >/dev/null 2>&1; then
   runtime_group=$(getent group "$runtime_gid" | cut -d: -f1)
 elif getent group "$runtime_group" >/dev/null 2>&1; then
@@ -147,13 +150,12 @@ else
 fi
 
 if id "$runtime_user" >/dev/null 2>&1; then
-  usermod --non-unique --uid "$runtime_uid" --gid "$runtime_group" --home "/home/$runtime_user" --shell /bin/bash "$runtime_user"
+  usermod --non-unique --uid "$runtime_uid" --gid "$runtime_group" --home "$runtime_home" --shell /bin/bash "$runtime_user"
 else
-  useradd --non-unique --uid "$runtime_uid" --gid "$runtime_group" --create-home --home-dir "/home/$runtime_user" --shell /bin/bash "$runtime_user"
+  useradd --non-unique --uid "$runtime_uid" --gid "$runtime_group" --no-create-home --home-dir "$runtime_home" --shell /bin/bash "$runtime_user"
 fi
 
-mkdir -p /data/home /data/config /data/npm-cache /data/pi-web /data/pi-agent /workspace "/home/$runtime_user"
+chown -R "$runtime_uid:$runtime_gid" /data /workspace
-chown -R "$runtime_uid:$runtime_gid" /data /workspace "/home/$runtime_user"
 
 zypper clean --all
 rm -rf /var/cache/zypp/*