fix(self-host): build the hub and sidecar from the checkout with Compose

compose.docker.yml

@@ -1,5 +1,11 @@
 # Code review on this machine's Docker: docker compose -f compose.yml -f compose.docker.yml up -d
 # The socket gives the hub control of this machine's Docker.
 services:
+  sidecar-image:
+    build: { context: ., target: sidecar }
+    image: corbits-triage-sidecar
+    pull_policy: build
+    entrypoint: ["true"]
   hub:
     volumes: ["${DOCKER_SOCKET:-/var/run/docker.sock}:/var/run/docker.sock"]
+    depends_on: { sidecar-image: { condition: service_completed_successfully } }

compose.yml

@@ -13,15 +13,17 @@ services:
     restart: unless-stopped
   migrate:
     build: .
-    image: ghcr.io/corbitsdev/corbits-triage-hub:${CORBITS_TRIAGE_TAG:-main}
+    image: corbits-triage-hub
+    pull_policy: build
     env_file: .env
     environment:
       DATABASE_URL: postgres://interchange:interchange@postgres:5432/interchange
     command: ["bun", "run", "db:migrate"]
     depends_on: { postgres: { condition: service_healthy } }
   hub:
     build: .
-    image: ghcr.io/corbitsdev/corbits-triage-hub:${CORBITS_TRIAGE_TAG:-main}
+    image: corbits-triage-hub
+    pull_policy: build
     env_file: .env
     environment:
       DATABASE_URL: postgres://interchange:interchange@postgres:5432/interchange

docs/SELF_HOST.md

@@ -53,16 +53,14 @@ docker compose up -d
 docker compose logs hub
 ```
 
-Compose pulls the hub image `ghcr.io/corbitsdev/corbits-triage-hub:main`, which
-every merge to `main` publishes; pulling needs no login. To run a fixed
-version, set `CORBITS_TRIAGE_TAG` to a commit SHA from `main` in your shell or
-in `.env`. To update, run `docker compose pull` and then `docker compose up -d`.
-To build the image from your checkout instead, run `docker compose up --build -d`;
-the first build needs about 3 GB of free Docker disk, and with less it stops with
-`no space left on device`. The `migrate` service runs to completion before the
-hub starts. The hub is ready when it logs `Started server: http://localhost:3000`;
-the portal is at that address. A `docker_sidecars_off` line is expected:
-triage needs no Docker, only code review does ([Where sidecars run](#where-sidecars-run)).
+Compose builds the hub image from your checkout. The first build needs about
+3 GB of free Docker disk, and with less it stops with `no space left on device`.
+To update, pull the new commits and run `docker compose up -d` again.
+
+The `migrate` service runs to completion before the hub starts. The hub is
+ready when it logs `Started server: http://localhost:3000`; the portal is at
+that address. A `docker_sidecars_off` line is expected: triage needs no Docker,
+only code review does ([Where sidecars run](#where-sidecars-run)).
 
 ### Railway
 
@@ -350,28 +348,21 @@ offers, with the `.env` lines and guide for each; code review uses the first
 ready one in the order shown and waits there when it is full.
 [provisioners/README.md](provisioners/README.md) covers each option.
 
-For Docker, a published hub has Docker pull its sidecar image the first time a
-code review needs it; a hub built from your checkout needs the sidecar image
-built before it starts ([Docker](provisioners/docker.md#set-up)).
+For Docker, the hub needs the sidecar image built before it starts
+([Docker](provisioners/docker.md#set-up)).
 The stock `compose.yml` mounts no Docker socket. For code review on the same
 machine's Docker under Compose, start it with `compose.docker.yml` as well:
 
 ```sh
 docker compose -f compose.yml -f compose.docker.yml up -d
 ```
 
-That mounts the Docker socket into the hub. With `--build`, first build the
-sidecar image from the same checkout:
-
-```sh
-docker build --target sidecar -t corbits-triage-sidecar .
-```
-
-The hub then controls that machine's Docker, which on Linux is root on the
-machine: whoever takes over the hub takes over the machine. For a socket
-elsewhere, such as rootless Docker's or Podman's, set `DOCKER_SOCKET` in
-`.env` to its path. Pass the same `-f` flags to
-later `docker compose` commands. Settings → Code review → **Where it runs**
+That builds the sidecar image from the same checkout before the hub starts,
+and mounts the Docker socket into the hub. The hub then controls that
+machine's Docker, which on Linux is root on the machine: whoever takes over
+the hub takes over the machine. For a socket elsewhere, such as rootless
+Docker's or Podman's, set `DOCKER_SOCKET` in `.env` to its path. Pass the
+same `-f` flags to later `docker compose` commands. Settings → Code review → **Where it runs**
 then shows **Docker on this machine** ready. Or set `DOCKER_HOST` in `.env` to
 [another machine](provisioners/docker-remote.md).
 

docs/provisioners/docker-remote.md

@@ -97,7 +97,7 @@ DOCKER_HOST=tcp://$HOST:2376 DOCKER_TLS_VERIFY=1 DOCKER_CERT_PATH=$PWD docker in
 
 ## 5. Put the sidecar image on the VPS
 
-A hub from the published image has the VPS's daemon pull its sidecar image the first time a code review needs it; skip this step. A hub built from a checkout needs `corbits-triage-sidecar` on the VPS's daemon, built from the same commit as the hub. Build it there straight from a checkout of that commit; the build runs on the VPS, so the image has its architecture, and no registry is involved:
+The hub needs `corbits-triage-sidecar` on the VPS's daemon, built from the same commit as the hub. Build it there straight from a checkout of that commit; the build runs on the VPS, so the image has its architecture, and no registry is involved:
 
 ```sh
 DOCKER_HOST=tcp://$HOST:2376 DOCKER_TLS_VERIFY=1 DOCKER_CERT_PATH=/path/to/certs \

docs/provisioners/docker.md

@@ -5,7 +5,7 @@
 ## Set up
 
 1. Install Docker Desktop (macOS, Windows) or Docker Engine (Linux) on the hub's machine, and start it. For Docker on another machine, such as a VPS, follow [Docker on another machine](docker-remote.md) instead.
-2. Get the sidecar image. A hub from the published `ghcr.io/corbitsdev/corbits-triage-hub` image runs the sidecar image published with it, `ghcr.io/corbitsdev/corbits-triage-sidecar@sha256:…`, and Docker pulls it the first time a code review needs it. The first review after an upgrade may be retried while the image downloads; a review whose pull fails fails, and the next one tries again. Older sidecar images stay on the daemon; remove unused ones now and then with `docker image prune -a`. A hub built from a checkout runs `corbits-triage-sidecar` instead: build it from the repository root, and rebuild it after changing the code:
+2. Build the sidecar image. The hub runs `corbits-triage-sidecar`. Under Docker Compose, `compose.docker.yml` builds it with the hub. Otherwise build it from the repository root, and rebuild it after changing the code:
 
    ```sh
    docker build --target sidecar -t corbits-triage-sidecar .
@@ -19,7 +19,7 @@
 
 Containers dial the hub at `HUB_SIDECAR_WEBSOCKET_URL`, with a loopback host replaced by `host.docker.internal`. Containers on [another machine](docker-remote.md) dial the hub's public `wss://` address instead. A hub that itself runs in a container needs the daemon's socket mounted and its port published to the Docker host.
 
-Under Docker Compose, `compose.docker.yml` mounts the host's Docker socket into the hub at `/var/run/docker.sock`, where the hub finds it; `compose.yml` already publishes the hub's port. The host socket is `/var/run/docker.sock` unless `DOCKER_SOCKET` in `.env` names another, such as rootless Docker's `$XDG_RUNTIME_DIR/docker.sock` or Podman's. The hub then controls that Docker, which on Linux is root on the host: whoever takes over the hub takes over the machine.
+Under Docker Compose, `compose.docker.yml` builds the sidecar image and mounts the host's Docker socket into the hub at `/var/run/docker.sock`, where the hub finds it; `compose.yml` already publishes the hub's port. The host socket is `/var/run/docker.sock` unless `DOCKER_SOCKET` in `.env` names another, such as rootless Docker's `$XDG_RUNTIME_DIR/docker.sock` or Podman's. The hub then controls that Docker, which on Linux is root on the host: whoever takes over the hub takes over the machine.
 
 ```sh
 docker compose -f compose.yml -f compose.docker.yml up -d

skills/corbits-triage-install/SKILL.md

@@ -48,7 +48,7 @@ done && rm .env.bak
 docker compose up -d
 ```
 
-Compose sets every other variable and pulls the published hub image; pulling needs no login. Run `docker compose logs hub` until it shows `Started server`. A pull that stops with `no space left on device` needs more free Docker disk.
+Compose sets every other variable and builds the hub image from the checkout. Run `docker compose logs hub` until it shows `Started server`. A build that stops with `no space left on device` needs about 3 GB of free Docker disk.
 
 **Their own Postgres** (`docs/DEV.md`). Run `bun install`, then create an empty database whose role has a password, as `docs/DEV.md` "2. Database" shows; the database setup refuses a URL without a password. Set `DATABASE_URL` in `.env`: