# AetherDesk containers and wireable runtimes

AetherDesk should make Docker-style runtime setup quick, visible, and AI-friendly.
The rule is simple: useful local work comes before sign-in.

## Runtime lanes

- Docker Desktop / Docker Engine: default mainstream container and Compose lane.
- Podman / Podman Desktop: free/open local fallback when Docker sign-in, licensing, or admin friction blocks useful work.
- WSL2: free local Linux substrate for Windows agents and toolchains.
- Dev Containers: portable environment contract through `devcontainer.json`.
- Dagger: OCI-backed automation functions for repeatable build/test/package/release workflows.
- kind / minikube: local Kubernetes before cloud Kubernetes sign-in.
- nerdctl / containerd: advanced Docker-like runtime fallback.
- Nix shell / flakes: reproducible dev environment lane when containers are blocked or unnecessary.

## Sign-in policy

- Do not block local work on Docker Hub, GitHub, or cloud sign-in.
- Ask for sign-in only when a private registry, push, cloud runtime, paid provider, or account-scoped feature is actually required.
- Prefer device-code or browser-mediated sign-in flows when a human account is needed.
- Never store Docker, registry, cloud, or provider tokens in AetherDesk artifacts.
- If sign-in blocks progress, use a no-signup local fallback such as Podman, WSL, Dev Containers, local files, or Nix where appropriate.

## Headless command

```powershell
npm run aetherdesk:containers:map
```

## Programmatic route

```text
GET /api/agent/container-wire-map
```

## Workflow Library/API action

```text
container_wire_map
```

This workflow runs `npm run aetherdesk:containers:map` through the existing receipted agent workflow lane with `artifact-write` scope.

## One-click wiring behavior

The map reports each lane as:

- detected or not detected
- free/local-first or not
- sign-in required, optional, or avoidable
- quick actions an agent can stage
- suggested install command when missing
- boundaries that prevent silent credential capture or host mutation

The map does not install Docker, start VMs, create clusters, log in, pull private images, or mutate repo files by itself.
Those are explicit operator actions.

## Runtime quickstart

For compact action cards derived from the container and sign-in maps:

```powershell
npm run aetherdesk:runtime:quickstart
```

```text
GET /api/agent/runtime-quickstart
POST /api/agent/workflows/runtime_quickstart/run
```

The quickstart is the human/agent short form: use local runtime first, avoid Docker sign-in blocks, name the private-registry boundary, and only ask for auth when the account-scoped action is real.

## Runtime action cards

For UI-button-ready runtime actions:

```powershell
npm run aetherdesk:runtime:actions
```

```text
GET /api/agent/runtime-action-cards
POST /api/agent/workflows/runtime_action_cards/run
```

These cards separate safe read-only probes from install/admin, reboot, auth, secret, and remote-write boundaries. A desktop button can show or copy each action without pretending sign-in is required for local work.
