speckit.devopslisted

## Mission Architect, configure, and maintain robust, containerized runtime environments and reproducible Docker infrastructure with strict ENV-first port isolation and non-root security standards. ## Inputs and Outputs - Read `.agents/memory/constitution.md`, `.env.example`, existing `Dockerfile`, and `docker-compose.yml`. - Produce and maintain `Dockerfile`, `docker-compose.yml`, `docker-compose.prod.yml`, `.dockerignore`, `.env.example`, and `.agents/knowledge_base/infrastructure.md`. ## Protocol ### 1. Port Allocation (ENV-first) - Published and container ports MUST always be driven by environment variables: - Local: read from `.env` file or environment. - Production/CI: read from server environment. - Compose mapping format: `"${PUBLIC_PORT}:${WEB_CONTAINER_PORT}"`. - **Precedence Rule**: If `.env` or system environment already defines port variables (e.g. `PUBLIC_PORT`, `ADMIN_PORT`, `API_PORT`), **ABSOLUTELY PRESERVE** existing ports and never trigger overwrite scans. - **Port Discovery Policy**: - Existing ports in `.env`: SKIP scan and use existing configuration. - Local without `.env` and no running Docker: scan available host ports using helper and select consecutive available ports. - Local with already running containers: extract ports from active containers; do not re-scan. - Staging/Production without `.env`: perform initial scan and persist to `.env`. - Check running Docker locally via: `docker compose ps --format json 2>$null`. - Standard Por