qbit-scripting/worker/deploy/README.md

Deployment examples — not installed automatically

The supplied systemd service/timer runs the exact-owned-container reaper independently every ten seconds and after boot. Review paths, service account, permissions, daemon access, timeout, monitoring, and host policy before installation. These units have not been installed/enabled, and Docker runtime configuration has not been changed. Local image candidates and fixed trusted compatibility fixtures exist; the hostile qualification harness has not run. The current SDK candidate and scoped evidence are in worker0447. It remains unqualified for hostile workloads.

Provision /opt/qqq-worker with the verified build, /opt/node/bin/node with the pinned runtime, and an existing /var/lib/qqq-worker owned only by the trusted qqq-worker account (mode 0700). State storage must support durable file and directory fsync. The account needs Docker daemon access; that is privileged host authority and belongs exclusively to this trusted coordinator/reaper, never the sandbox. The units do not grant group membership or alter the host's Docker configuration.

Create a protected /etc/qqq-worker/runtime.env containing deployment-specific, server-owned settings:

QQQ_WORKER_IMAGE=registry.example/qqq-worker@sha256:<approved-final-image-digest>
QQQ_WORKER_QUALIFICATION_ID=<reviewed-deployment-evidence-id>
QQQ_REQUIRED_QUALIFICATION_ID=<required-deployment-evidence-id>
QQQ_WORKER_OWNER_ID=<unique-stable-deployment-id>
QQQ_WORKER_STATE_DIRECTORY=/var/lib/qqq-worker

Placeholders intentionally cannot pass the launch gate. Supply the same owner/state settings to the Java coordinator adapter. Restrict image registry contents and runtime configuration to deployment administrators. Do not put application credentials in this environment.

Active lease files contain an immutable attempt UUID, exact container name, owner and timestamps. The launcher adds matching Docker labels. The reaper selects only expired leases for its configured owner, inspects each exact name, verifies both labels, and removes its immutable ID. It never issues docker system prune, wildcard kills, or name-prefix enumeration. Ownership mismatch or daemon failure retains the lease and records failure. A later run retries. Successful/absent cleanup records evidence before removing the lease, so a crash can repeat a safe inspection. Up to 1,000 expired leases are handled per invocation; alert and increase deployment capacity when cleanup backlogs grow.

The 60-second lease exceeds the launcher's ordinary create, execution, inspection and removal budget. Running the reaper every ten seconds normally gives an abandoned worker a roughly 70-second maximum lifetime after preparation, plus Docker response time. This is conditional on a healthy timer, durable filesystem, and daemon; it is not a guarantee under host failure. A daemon/host outage requires restoring the service and running recovery before accepting new work. Monitor nonzero exit codes, expired active-lease count, evidence storage capacity, timer freshness and Docker availability. Retain lifecycle evidence according to the application's audit policy.

For an authorized sandbox lab, run the qualification harness described in QUALIFICATION.md. Also test kill/restart scenarios against the actual service deployment. Synthetic tests validate ownership and recovery logic but do not validate host filesystem durability or gVisor containment.