refactor: image-only distribution, docker run from OCIR

.env.example

@@ -1,29 +0,0 @@
-# ── REQUIRED ────────────────────────────────────────────────────────────────
-
-# OCIR region
-OCIR_REGION=us-ashburn-1
-
-# OCIR namespace
-OCIR_NAMESPACE=idi1o0a010nx
-
-# Application secret — REQUIRED
-# Generate with: openssl rand -hex 64
-# This key encrypts JWT tokens, credentials, and session data.
-APP_SECRET=
-
-# ── OPTIONAL ────────────────────────────────────────────────────────────────
-
-# Image tag (default: latest)
-# IMAGE_TAG=latest
-
-# JWT token expiry in hours (default: 12)
-# JWT_EXPIRY_HOURS=12
-
-# Frontend port (default: 8080)
-# PORT=8080
-
-# CORS allowed origins (comma-separated)
-# CORS_ORIGINS=https://your-domain.com
-
-# Timezone (default: America/Sao_Paulo)
-# TZ=America/Sao_Paulo

README.md

@@ -11,7 +11,7 @@
 <p align="center">
   <img src="https://img.shields.io/badge/version-1.0-C74634?style=flat-square" alt="Version">
   <img src="https://img.shields.io/badge/OCI-GenAI-C74634?style=flat-square" alt="OCI">
-  <img src="https://img.shields.io/badge/docker-compose-2496ED?style=flat-square" alt="Docker">
+  <img src="https://img.shields.io/badge/docker-2496ED?style=flat-square" alt="Docker">
   <img src="https://img.shields.io/badge/terraform-7B42BC?style=flat-square" alt="Terraform">
   <img src="https://img.shields.io/badge/license-MIT-green?style=flat-square" alt="License">
 </p>
@@ -106,7 +106,7 @@ Multi-architecture: `linux/amd64` + `linux/arm64`
 
 ---
 
-### Option 1 — Local Docker (any machine)
+### Option 1 — Docker (any machine)
 
 Run on any machine with Docker installed (Linux, macOS, Windows).
 
@@ -114,27 +114,18 @@ Run on any machine with Docker installed (Linux, macOS, Windows).
 # 1. Login to OCIR
 docker login us-ashburn-1.ocir.io
 
-# 2. Configure
-cp .env.example .env
-# Edit .env: set APP_SECRET (openssl rand -hex 64)
-
-# 3. Run
-docker compose up -d
-
-# 4. Access: http://localhost:8080
-docker logs oci-cis-agent | grep "password"
-```
-
-Or with `docker run` (no compose file needed):
-
-```bash
+# 2. Run
 docker run -d \
   --name oci-cis-agent \
   -p 8080:8080 \
   -v agent-data:/data \
   -e APP_SECRET=$(openssl rand -hex 64) \
   -e TZ=America/Sao_Paulo \
+  --restart unless-stopped \
   us-ashburn-1.ocir.io/idi1o0a010nx/oci-cis-agent:latest
+
+# 3. Access: http://localhost:8080
+docker logs oci-cis-agent | grep "password"
 ```
 
 ---
@@ -384,7 +375,7 @@ Allow group <group-name> to read buckets in compartment <compartment-name>
 Verify your `docker login` credentials and that the OCIR repositories exist in your namespace.
 
 **Backend health check fails:**
-Check logs: `docker compose logs backend`. Ensure `APP_SECRET` is set in `.env`.
+Check logs: `docker logs oci-cis-agent`. Ensure `APP_SECRET` is set.
 
 **ADB connection fails (`DPY-6005`):**
 Ensure the wallet ZIP contains `tnsnames.ora` and `ewallet.pem`. The DSN must match a service name in `tnsnames.ora`.

docker-compose.single.yml

@@ -1,31 +0,0 @@
-services:
-  agent:
-    image: ${OCIR_REGION:-us-ashburn-1}.ocir.io/${OCIR_NAMESPACE:-idi1o0a010nx}/oci-cis-agent:${IMAGE_TAG:-latest}
-    container_name: oci-cis-agent
-    restart: unless-stopped
-    environment:
-      - APP_SECRET=${APP_SECRET:?Set APP_SECRET in .env (openssl rand -hex 64)}
-      - JWT_EXPIRY_HOURS=${JWT_EXPIRY_HOURS:-12}
-      - DATA_DIR=/data
-      - CORS_ORIGINS=${CORS_ORIGINS:-}
-      - TZ=${TZ:-America/Sao_Paulo}
-      - OCI_CLI_SUPPRESS_FILE_PERMISSIONS_WARNING=True
-    ports:
-      - "${PORT:-8080}:8080"
-    volumes:
-      - agent-data:/data
-    healthcheck:
-      test: ["CMD", "curl", "-f", "http://localhost:8080/api/health"]
-      interval: 30s
-      timeout: 10s
-      retries: 3
-    logging:
-      driver: "json-file"
-      options:
-        max-size: "10m"
-        max-file: "3"
-    mem_limit: 4g
-
-volumes:
-  agent-data:
-    driver: local

docker-compose.yml

@@ -1,31 +0,0 @@
-services:
-  agent:
-    image: ${OCIR_REGION:-us-ashburn-1}.ocir.io/${OCIR_NAMESPACE:-idi1o0a010nx}/oci-cis-agent:${IMAGE_TAG:-latest}
-    container_name: oci-cis-agent
-    restart: unless-stopped
-    environment:
-      - APP_SECRET=${APP_SECRET:?Set APP_SECRET in .env (openssl rand -hex 64)}
-      - JWT_EXPIRY_HOURS=${JWT_EXPIRY_HOURS:-12}
-      - DATA_DIR=/data
-      - CORS_ORIGINS=${CORS_ORIGINS:-}
-      - TZ=${TZ:-America/Sao_Paulo}
-      - OCI_CLI_SUPPRESS_FILE_PERMISSIONS_WARNING=True
-    ports:
-      - "${PORT:-8080}:8080"
-    volumes:
-      - agent-data:/data
-    healthcheck:
-      test: ["CMD", "curl", "-f", "http://localhost:8080/api/health"]
-      interval: 30s
-      timeout: 10s
-      retries: 3
-    logging:
-      driver: "json-file"
-      options:
-        max-size: "10m"
-        max-file: "3"
-    mem_limit: 4g
-
-volumes:
-  agent-data:
-    driver: local

terraform/registry.tf

@@ -1,14 +0,0 @@
-# -----------------------------------------------------------------------------
-# OCIR Repositories
-# -----------------------------------------------------------------------------
-resource "oci_artifacts_container_repository" "backend" {
-  compartment_id = var.compartment_ocid
-  display_name   = "${var.ocir_repo_prefix}/backend"
-  is_public      = false
-}
-
-resource "oci_artifacts_container_repository" "frontend" {
-  compartment_id = var.compartment_ocid
-  display_name   = "${var.ocir_repo_prefix}/frontend"
-  is_public      = false
-}