docs: Mesh Containers intro for readers new to Reticulum
docs(TASK-144): Containers page qualifies the loopback claim, the WARNING clause and the signal paragraph; Sandboxes names the in-sandbox daemon and its switches
Mesh-Containers: "nothing outside the container can reach 4242" holds on the default bridge and
not under --network host; COYOTE_MESH_LAN=1 row says the daemon becomes a transport node for the
LAN; the WARNING-and-no-daemon clause applies when the config still has to be rendered; the
entrypoint reports unapplied variables; debug-level logs and --log-opt max-size; IPv6 literals
refused; TERM reaches the main command only while it stays in the entrypoint's process group.
Sandboxes: the keep-alive command goes through the same entrypoint, so rnsd runs inside the
sandbox from v0.10.4; COYOTE_MESH_RELAY=host:port dials a relay (same egress entry),
COYOTE_MESH_RNSD=0 starts none.
docs(TASK-144): Mesh-Containers follows the image's bundled rnsd
The image as published: rnsd via `uv tool install "rns==1.5.2"` from v0.10.4, the tini `-s -g`
ENTRYPOINT, the only listener is rnsd on 127.0.0.1:4242 inside the container (never publish 4242),
and the pre-v0.10.4 state. Running with `type: private`: the three variables (COYOTE_MESH_RELAY,
COYOTE_MESH_LAN with `--network host`, COYOTE_MESH_RNSD=0), the render-once config and its tokens,
uid-1000 ownership of a mounted ~/.reticulum, raw daemon logs and rnstatus, a failing daemon never
blocks the main command, `--read-only --tmpfs`, the relay recipe, why a host daemon written by
mesh-relay.sh is not reachable from a container (the host.docker.internal recipe is gone), and the
signal contract. `type: lan` section: the daemon holds the AutoInterface under `--network host`.
Propagation-node section: a container reaches the node with COYOTE_MESH_RELAY.
docs(TASK-143): Mesh-Commands, Mesh-Configuration, Mesh-Containers follow the private 127.0.0.1:4242 default
Mesh-Commands.md: .mesh on samples name the loopback relay; the three WARNING lines, the relay failure
text, the loopback hint, the lan bind failure text and the connect idle line are quoted as the code prints
them; the .mesh info sample shows the interfaces[i] rows at the 32-wide label column. Mesh-Configuration.md:
the interfaces: block is the template's, the Keys row and the empty-interfaces validation sentence name the
new default, the Directories prose says what two sessions share and when two identities split. Mesh-Containers.md:
the image's ENTRYPOINT as the Dockerfile has it; two identities on one host link the new section; the
propagation node is dialled by a host's rnsd with --relay.
docs(TASK-097): fix the relay stanza and the instance-lock wording after round three
docs(TASK-097): correct the round-two review findings on the mesh pages
docs(TASK-097): correct the mesh pages after review
docs(TASK-097): add the mesh deployment, container and platform-support pages
Derived from the code repo at feat/PLAN-mesh:
- Mesh-Deployment.md: assets/config-template.yaml, src/config/mesh_config.rs
(validate, MeshInterface Display), src/repl/mesh.rs (reach_line,
on_question, trust_refusal, render_propagation_nodes), src/mesh/announce.rs,
src/mesh/card.rs (StatusError), src/mesh/r3/error.rs,
deployment/propagation-node/README.md, src/mesh/node.rs (fetch_propagated)
- Mesh-Containers.md: Dockerfile, src/config/paths.rs, src/mesh/identity.rs
(owner-only key and 0700 dir), deployment/propagation-node/README.md
- Mesh-Platform-Support.md: src/mesh/identity.rs (unix mode check,
owner_only_advice, owner_only_remedy, acl_less_volume_warning),
src/utils/windows_acl.rs, src/mesh/lock.rs, src/config/paths.rs,
.github/workflows/ci.yaml, src/repl/mesh.rs, src/mesh/knock.rs
(knock_text), src/mesh/trust.rs, src/mesh/events.rs