One container, one yaml file

[tschm]

Running the board meant cloning this repo, installing uv, editing two files and running up.sh, which started two containers and installed a launchd agent. Now it is one docker run and a repos.yml.

docker run -d --name jq-fleet \
  -p 127.0.0.1:3000:3000 \
  -v "$PWD/repos.yml:/config/repos.yml:ro" \
  -v "$HOME:/host:ro" \
  -v jq-fleet-data:/data \
  -e GITHUB_TOKEN="$(gh auth token)" \
  ghcr.io/jebel-quant/monitoring:latest

How the working copies get in

The collector lived on the host because it reads your working copies, and a per-repo bind mount can only name a checkout at /repos/<owner>/<name> — which silently loses the four repos in this fleet that live somewhere else.

The fix is to stop mounting repos one at a time. -v "$HOME:/host:ro" mounts the home directory once, whole, and ~/... in repos.yml resolves against it, so ~/repos/tschm/rhiza_projects/cs means exactly what it says. One mount expresses any layout, so the collector comes back inside.

Leave the mount off and the GitHub half still works; the working-copy panels stay empty. That is a supported way to run this, not an error.

The trade: the collector can see everything under $HOME, not only the checkouts you listed — the mount is the same width either way. It still never writes (every git call passes --no-optional-locks), and :ro now means the kernel enforces that rather than it being a property of the code.

repos.yml is read directly

The collector parses it at startup. That deletes the gen-repos.py → environment → collector.sh chain, and with it the three places a repo could be lost between the file and the board. JQ_REPOS / JQ_REPO_PATHS stay as the escape hatch for a deployment with no file to mount.

A broken file is a refusal at startup, not a board that is quietly one repo short — except an unreachable path alongside an explicit repo:, which is what "no $HOME mount" looks like and is logged as a warning.

One container, three processes

Prometheus, Grafana and the collector share a container, with the dashboard, datasource, alert rules and scrape config baked in. docker logs prefixes each process.

Nothing restarts a dead process: the three are one board, so any of them exiting takes the container down and Docker's restart policy handles it. That keeps docker ps honest about whether the board is up, which a supervisor quietly restarting one process in a still-healthy container would not.

Verified end to end

Built and run against the real 25-repo fleet:

• 25 repos on the board, 24 with checkouts — including jq_repo_cloned{repo="tschm/cs"} 1.0, the nested path the old architecture could not express in a container
• Prometheus target jq-collector up, Grafana datasource healthy, jq-fleet dashboard provisioned, 1795 metric lines
• Collector at 100% line coverage, ruff clean, check-dashboard.py passes
• History migrated from the old volumes: 2d 13h, one unbroken series, 6 alert rules and 364 annotations intact

Two bugs the run caught and this fixes: the dashboard provider still pointed at /var/lib/grafana/dashboards, which is now the /data volume; and Grafana was downloading a Loki plugin at every start.

Notes for review

• The image does not exist yet. .github/workflows/image.yml publishes ghcr.io/jebel-quant/monitoring (amd64 + arm64) on merge to main. Every doc points at it, so until this merges the recipe is docker build -t ... .
• First scan is slow — cold Docker Desktop mount: 21s for the very first git call, ~2 min before the GitHub pass started, ~3ms per call once warm. Documented in docs/operations.md.
• purge-repo now needs a container restart to toggle the admin API, where the old script flipped it live. It prints the exact commands when the API is off.
• Migration — docs/operations.md#coming-from-the-two-container-stack carries the Prometheus history over. The instance relabel in prometheus.yml already existed for exactly this move, so the series do not fork.

Gone: scripts/up.sh, down.sh, collector.sh, gen-repos.py, docker-compose.admin.yml. docker-compose.yml is now one optional service; purge-repo.sh moves into the image as docker exec jq-fleet purge-repo.

🤖 Generated with Claude Code