# CASAN Docker Guide

Run the CASAN governance harness as a container against any mounted repo — no install into
the target project.

## Image: `casan-harness` (Level 1/2)
Dockerfile: [`packages/casan-devkit/Dockerfile.harness`](../../packages/casan-devkit/Dockerfile.harness).
Minimal Debian + bash + python3 + openssl + git. Ships the core harness + `bin/casan`.

### Build
```bash
V=$(cat VERSION)
docker build -f packages/casan-devkit/Dockerfile.harness -t casan-harness:$V .
```

### Run the gate on a project
```bash
docker run --rm -v "$PWD":/workspace -w /workspace casan-harness:1.0.0 gate
# (ENTRYPOINT is `casan`, so the CMD is a casan subcommand)
docker run --rm -v "$PWD":/workspace casan-harness:1.0.0 reuse
docker run --rm -v "$PWD":/workspace casan-harness:1.0.0 \
  run in.txt out.txt my_step -- echo hello
```
The harness inside the image lives at `/opt/casan` (`CASAN_HARNESS_ROOT` preset); your
project is mounted at `/workspace`. Domain data is read from the mounted repo
(`apps/<project>/domain` via `CASAN_DOMAIN_ROOT`).

### With a domain root
```bash
docker run --rm -v "$PWD":/workspace -w /workspace \
  -e CASAN_DOMAIN_ROOT=apps/ticketing/domain casan-harness:1.0.0 gate
```

## Notes
- **State** (`.specify/logs`, audit) is written under `/workspace` (your mounted repo), so it
  persists on the host and is inspectable after the run.
- **Enforced mode:** add `-e CASAN_PROFILE=prod` (or `-e CASAN_VERIFY_STRICT=1`) to make
  missing signatures fail-closed.
- **No app runtime:** this image runs the *harness*, not the OKR app. For the app, use the
  project's own `Dockerfile.backend` / `Dockerfile.frontend` + `docker-compose.prod.yml`.

## Other images
| Image | Status | Notes |
|---|:--:|---|
| `casan-harness:X.Y.Z` | ✅ | this guide |
| `casan-platform:X.Y.Z` | 🟡 preview | dashboard only today; build from platform preview when needed |
| `casan-enterprise:X.Y.Z` | 📋 future | not built — governed console does not exist yet |

## Publish to Gitea container registry
See `GITEA_PACKAGE_GUIDE.md` §3 (`docker login` + `docker push` to the Gitea registry).