Prebuilt Docker images (v0.1.0)

Prebuilt, ready-to-run Docker images of undroidwish running under the WebWish
wstiles driver — so you can try WebWish without doing the (long) source
build.

Each image runs the app headless in stdio mode: its stdin/stdout are the
wire, so the container opens no network port at all.

Images

Asset	Arch	Codec	Image tag inside
webwish-undroidwish-amd64-tiles.tar.gz	x86-64	lossless tiles	webwish/undroidwish:latest-amd64
webwish-undroidwish-arm64-tiles.tar.gz	arm64	lossless tiles	webwish/undroidwish:latest
webwish-undroidwish-arm64-av1.tar.gz	arm64	AV1 (libaom)	webwish/undroidwish:av1

Verify with shasum -a 256 -c SHA256SUMS.txt.

Quick start

# load the image for your architecture
gunzip -c webwish-undroidwish-amd64-tiles.tar.gz | docker load

# run one hardened session; its stdout is the wstiles wire protocol
# (first bytes are the handshake: 00 00 00 09 "wtil" <w> <h> <codec>)
docker run --rm -i --network none --read-only --tmpfs /tmp \
  --user 65534:65534 --cap-drop ALL --security-opt no-new-privileges \
  --pids-limit 128 --memory 256m --cpus 1 \
  webwish/undroidwish:latest-amd64 </dev/null | head -c 13 | od -An -tx1

To actually see it in a browser, put a bridge in front that pumps this stdio
stream to a WebSocket — the repo ships a NaviServer reference bridge:
server/stream-docker.adp + server/democ.adp, driven by docker/run-session.sh
(which is exactly the hardened docker run above). For AV1, run the :av1
image with WEBWISH_CODEC=av1.

⚠️ Security

These images run undroidwish's default Tcl console. Anyone who reaches it
gets an interactive Tcl interpreter — i.e. arbitrary code execution inside the
container. The container flags above are what keep that contained, and they
are the minimum. Read SECURITY.md
before exposing this to anyone you don't trust — in particular, ship a
locked-down app in a safe interpreter rather than a console, authenticate the
bridge, and never run it on a host holding anything you care about.

Notes

• Built from source with docker/build-linux-binary.sh (see docker/README.md);
  the images are Debian bookworm-slim + the single-file undroidwish-wstiles.
• Tiles is lossless and great for UI; AV1 wins on photographic/animated content.
• An x86-64 AV1 image isn't included — build it with
  WEBWISH_AV1=1 + --platform linux/amd64 per docker/README.md.