# Privileged self-update sidecar. Holds the docker socket and, on an
# authenticated webhook trigger, runs `git pull && docker compose up -d --build app`
# against the moonbase stack. It only ever runs the fixed updater/update.sh —
# no request data reaches the shell. See docker-compose.yml + updater/hooks.json.
FROM docker:27-cli
RUN apk add --no-cache git docker-cli-compose webhook
ENTRYPOINT ["webhook"]