# S6 — Containers

Re-surveyed **August 7, 2026** and **re-derived at 2026-08-08 02:24 UTC** under a corrected ephemeral-class rule (previous pass July 28, 2026 13:39 UTC), a full bounded census from Docker's own registries using the exact S6 checks. The daemon reachability check returned **0**, so this is a complete enumeration and not a degrade. `docker context ls` marks `desktop-linux *` and describes it as Docker Desktop, so **Docker Desktop is still the backend actually serving commands** — Colima remains installed but idle, exactly as the spec recorded and as the previous survey found.

## What changed since July 28 — this surface turned over almost completely

One workflow explains nearly all of it. `~/Projects/terminus3` runs an automated task-gate that builds container images, runs verifier sandboxes in them, and reaps both. Between the two surveys it ran many times.

| | 2026-07-28 | 2026-08-07 | What actually happened |
|---|---|---|---|
| **Containers** | 1 (`thirsty_easley`, Up 12s) | 1 (`lucid_cray`, **Up 6 hours**) | Complete replacement. The old terminus-review sandbox was reaped. The new one is a terminus3 *functional-gate verifier* holding itself open with `sleep infinity` while its run inspects it — bind-mounting `…/work/auger-screw/scratch/functional-gate.14gAf9/solved` read-only at `/workspace` and a `logs-PASS-primary-1` directory at `/logs/verifier`. It has already recorded a PASS. No published ports; attached to `none`. |
| **Images** | 6 | **30 present · 2 itemized, 28 summarized** | **Not one survivor.** Every pulled base image from July (the `public.ecr.aws` node/python/ruby/rust/maven mirrors, `golang:1.24-bookworm`) is gone. In their place: **28 locally built terminus3 artifacts** — 19 `fbtask-<slug>-env` / `-tests` pairs, 7 `<task>__<hash>-main` compose service images, 2 `*-scratch-tests` — plus 2 pulled bases (`python:3.13-slim`, and `alpine` carrying **no tag at all**). The 28 are now **summarized as an ephemeral class, not itemized** (see the spec fix below); only the 2 pulled bases are rows. The newest ephemeral image was built **one minute before the re-derivation**, which is the point: that churn no longer moves the itemized set. |
| **Volumes** | 0 | 0 | Unchanged. Nothing on this machine persists container state. |
| **Networks** | 7 | **17** | The 3 built-ins and the 4 old compose networks all survive; **10 new** compose-project networks appeared — 9 `ball-valve-parametric__<hash>_default` (2026-08-03) and 1 `tdisplay-enclosure__k3supgq_default` (2026-08-06), one per terminus3 vendor-run attempt. |
| **Disk** | 8.731GB images (67% reclaimable), 13.18GB build cache | **7.755GB images (53% reclaimable), 8.938GB build cache** | **Disk went DOWN despite five times the images.** Build cache fell ~4.2GB, consistent with terminus3's own per-task `docker builder prune -f` cleanup. |

## Two spec gaps this re-survey raised — both now CLOSED by a ratified spec fix

The re-survey found these, refused to patch the spec on its own authority, and raised them. The conductor ratified both fixes the same night; `specs/s6-containers.yaml` now carries them and this inventory was **re-derived** under the corrected rules (rows were not hand-edited to match).

**1. The ephemeral-class needle went stale — WIDENED.** The spec identified ephemeral images by the literal repository prefix `terminus-review-`. That workflow was renamed, so **nothing on this machine matched that prefix any more** while 28 images were unmistakably the same class — continuously built, continuously reaped artifacts under `fbtask-*`, `*__<hash>-main` and `*-scratch-tests`. Applied literally, all 30 images became rows that went stale within minutes of any terminus3 run — precisely the churn the ephemeral class exists to absorb.

The needle now matches the class rather than yesterday's name: an image is ephemeral if its **repository** matches `^fbtask-` (the `fbtask-<slug>-env` / `-tests` gate pair built by `terminus3/_build/gate-task.sh` lines 264-266 and the per-task `gate-oracle.sh`), `__<hash>-main$` (a compose service image from a vendor run), or `-scratch-tests$`. The parity probe's filter moved from `grep -v` to `awk` so it matches the repository *field* rather than the whole repo+ID line. Verified live: the probe emits **2**, and the inventory itemizes exactly those 2.

The conductor's recorded rationale, so this is not repeated: *a needle pinned to a renamed workflow is a probe that cannot match — it reds the drift sweep on every build while hiding the class it was written to summarize. Match the class, not yesterday's name.*

Note that the *container* half of the same rule never broke: `lucid_cray`'s IMAGE column is a bare 12-hex ID, so the container parity probe correctly excluded it. Only the image needle had gone dead.

**2. A running ephemeral container cannot be summarized away — now the spec's STATED RULE.** The liveness probe is a bare `docker ps` with no ephemeral filter, and the gate's `missed` check — unlike its `ghosts` check — is **not** transient-exempt. So a running sandbox must be itemized or the gate reds, which is exactly what happened at the 2026-08-08T01:48:11Z drift sweep. `lucid_cray` is therefore a row, with `live_now: true` and `flags: [transient]`, which satisfies the parity probe (transient clears the phantom) and the liveness probe (claimed matches actual) honestly. The re-survey improvised that correctly; the spec now *requires* it, so the next scan does not have to invent it. The `missed` check was deliberately **left non-exempt**: something actually running on this machine must appear in the atlas, and itemizing a live transient is the right behavior, not a workaround. The 2026-07-25 spec text assumed every container would be Exited; that assumption no longer holds.

## Findings and self-use answers

1. **What backend is actually serving Docker?** `desktop-linux *` / Docker Desktop. Colima's own status command still says `colima is not running`, re-verified at 2026-08-07 22:04:17. Two surveys, same answer: colima is installed infrastructure nobody uses.

2. **Is any container safe to remove, or does one hold data?** There is exactly one container and it is **live** — a terminus3 gate run is holding it open. Do not reap it by hand. There is **no persistent container and no volume at all**, so there is no container-held data to protect on this machine right now.

3. **How much disk is reclaimable, and what is eating it?** Docker reports **4.112GB reclaimable from images** (53% of 7.755GB) and **1.522GB from build cache** (of 8.956GB across 177 entries), with zero volume space. The picture inverted since July: build cache used to be the larger reclaimable bucket at 9.694GB and is now the smaller one. The images are the target now — and 28 of the 30 rebuild deterministically from terminus3's own Dockerfiles, so reclaiming them costs rebuild time, not data. Note the two figures come from re-reads minutes apart and differ slightly (173 → 177 cache entries); this surface moves while you read it.

4. **Is anything listening on a LAN-exposed port?** No. The one running container reports `Ports: map[]` and is attached to the `none` network, so it has no network access at all. This snapshot shows **no Docker container publishing anything**, on 0.0.0.0 or otherwise.

5. **Are other runtimes installed?** Colima and Lima are installed; Colima is idle and redundant beside Docker Desktop. OrbStack, UTM, Parallels Desktop and VirtualBox were each re-checked first-hand at the paths and CLI names the spec dictates, and were absent — the same result as July, re-derived rather than carried forward on faith.

6. **Which networks have attachments?** One: `none`, holding `lucid_cray`. The other 16 are empty, including all 14 compose-project networks. Nine of those 14 belong to `ball-valve-parametric__<hash>` attempts from a single day (2026-08-03) — a strong hint that terminus3's vendor-run harness creates compose projects it never tears down. That is the cleanest prune candidate on this surface, though it should be confirmed with the harness owner rather than assumed abandoned.

7. **What if Docker was down?** It was not: the reachability check returned 0 and every object registry responded. If a future build gets a nonzero check, the S6 contract requires a plainly labelled definitions-only, runtime-down degrade — this dossier must not be reused as if that future inventory were complete.

## Per-item dispositions

| Item | Disposition | Reason |
|---|---|---|
| `lucid_cray` (container) | **KEEP (workflow-owned)** | Running terminus3 functional-gate verifier for the `auger-screw` task; leave its lifecycle to that workflow. Do not `docker rm` it by hand — a gate run is holding it. |
| `alpine:<none>` (image) | **INVESTIGATE** | Pulled base image, unreferenced by any container; confirm no build workflow needs it before pruning. |
| **28 terminus3 task-gate images** (ephemeral class, summarized not itemized) | **PRUNE (after confirming no run is in flight)** | 19 `fbtask-<slug>-env`/`-tests` pairs, 7 `<task>__<hash>-main` compose service images, 2 `*-scratch-tests`. All locally built and rebuilt deterministically by terminus3 from its own Dockerfiles, all unreferenced at scan time. Summarized per the corrected `ephemeral_class` needle — they turn over continuously, so naming each one is stale within minutes. Their aggregate disk cost is the actionable number: see `docker system df` above. Safe to reclaim once no gate run is active. |
| `python:3.13-slim` (image) | **INVESTIGATE** | Pulled base image, unreferenced by any container; confirm no build workflow needs it before pruning. |
| `00-foundation-auth_default` (network) | **PRUNE (after confirmation)** | Empty compose-project network; confirm the owning run is finished first. |
| `01-rsvp-reader_default` (network) | **PRUNE (after confirmation)** | Empty compose-project network; confirm the owning run is finished first. |
| `04-import_default` (network) | **PRUNE (after confirmation)** | Empty compose-project network; confirm the owning run is finished first. |
| `ball-valve-parametric__2xgejhu_default` (network) | **PRUNE (after confirmation)** | Empty compose-project network; confirm the owning run is finished first. |
| `ball-valve-parametric__9ixytzq_default` (network) | **PRUNE (after confirmation)** | Empty compose-project network; confirm the owning run is finished first. |
| `ball-valve-parametric__c69cn4r_default` (network) | **PRUNE (after confirmation)** | Empty compose-project network; confirm the owning run is finished first. |
| `ball-valve-parametric__ehwbvgl_default` (network) | **PRUNE (after confirmation)** | Empty compose-project network; confirm the owning run is finished first. |
| `ball-valve-parametric__ftk3cxy_default` (network) | **PRUNE (after confirmation)** | Empty compose-project network; confirm the owning run is finished first. |
| `ball-valve-parametric__hvi9vxb_default` (network) | **PRUNE (after confirmation)** | Empty compose-project network; confirm the owning run is finished first. |
| `ball-valve-parametric__it5ndh2_default` (network) | **PRUNE (after confirmation)** | Empty compose-project network; confirm the owning run is finished first. |
| `ball-valve-parametric__j7gpm7j_default` (network) | **PRUNE (after confirmation)** | Empty compose-project network; confirm the owning run is finished first. |
| `ball-valve-parametric__yshv6m8_default` (network) | **PRUNE (after confirmation)** | Empty compose-project network; confirm the owning run is finished first. |
| `bridge` (network) | **KEEP** | Docker built-in network infrastructure. |
| `host` (network) | **KEEP** | Docker built-in network infrastructure. |
| `none` (network) | **KEEP** | Docker built-in network infrastructure. |
| `server-deploy_default` (network) | **PRUNE (after confirmation)** | Empty compose-project network; confirm the owning run is finished first. |
| `tdisplay-enclosure__k3supgq_default` (network) | **PRUNE (after confirmation)** | Empty compose-project network; confirm the owning run is finished first. |
| `Colima` (runtime) | **INVESTIGATE** | Installed, idle, and still not the backend after two surveys. Decide whether colima + lima are worth their Homebrew footprint. |
| `OrbStack` (runtime) | **ABSENCE CONFIRMED** | Re-checked first-hand at the spec's path/CLI on 2026-08-07; absent. |
| `UTM` (runtime) | **ABSENCE CONFIRMED** | Re-checked first-hand at the spec's path/CLI on 2026-08-07; absent. |
| `Parallels Desktop` (runtime) | **ABSENCE CONFIRMED** | Re-checked first-hand at the spec's path/CLI on 2026-08-07; absent. |
| `VirtualBox` (runtime) | **ABSENCE CONFIRMED** | Re-checked first-hand at the spec's path/CLI on 2026-08-07; absent. |

## Verification gaps, stated honestly

- **No degrade rung was needed**, and no sudo was used. Every stop/remove/prune string in `inventory.yaml` is documentation; no Docker object, runtime, service or configuration was mutated.
- **This snapshot is the most perishable in the atlas** — but it is no longer *fragile*. An image was built one minute before the re-derivation ran, and between two reads minutes apart the build-cache entry count moved 173 → 177. With the ephemeral-class needle repaired, that churn no longer moves the itemized set (2 images, and the parity probe agrees at 2), so a re-gate after the next terminus3 run should stay green. What *will* still legitimately move is the container row: a gate run starting or finishing changes `docker ps`, and a running sandbox must be itemized when it exists.
- **Image provenance is inferred from naming plus the builder script, not from image labels.** `terminus3/_build/gate-task.sh` lines 264-266 build `fbtask-${slug}-env` / `fbtask-${slug}-tests`, and the per-task `gate-oracle.sh` scripts do the same, which is solid evidence for the `fbtask-*` family. The `<task>__<hash>-main` images are attributed to terminus3 vendor runs on the strength of matching compose-project labels on their sibling networks and matching names in `_build/logs/vendor-runs/*/raw`. No Dockerfile was traced per image. **This naming inference is now what the ephemeral-class needle keys on**, which is a deliberate trade: it is the same evidence a human would use, and it is the reason the needle must be re-checked whenever that workflow renames its artifacts — the failure mode this fix was written for.
- **Container environment was read for KEYS only** (`[PATH]`); no value was read or copied, and no credential-shaped key was present.
- **`docker system df` cannot split the ephemeral class from anything else.** Its aggregate is the actionable disk signal; no individual object's size is inferred from it.