Add compose Dockerfile builds

[sjmiller609]

Summary

• add compose dockerfile services that build through the Hypeman build API and run the resulting image
• resolve Dockerfile services through the ready build output image ref, then wait for the runnable image before creating or reusing instances
• apply .dockerignore patterns to compose build archives and include .dockerignore content in build hashes
• expand compose interpolation across string fields, including nested ${file:...} contents, so loaded config files can use ${env:...} and ${file:...} references
• document Dockerfile services and add tests for validation, deterministic rebuild behavior, interpolation behavior, and .dockerignore handling

Testing

• go test ./...
• ./scripts/lint
• ./scripts/build
• manual live smoke: Dockerfile compose build reached Running, logs showed nested interpolation, repeat plan was unchanged, and cleanup removed the instance plus built image
• manual live smoke: .dockerignore excluded an uploaded file required to make the Dockerfile build pass

---

Note

Medium Risk
Adds a new build phase to compose up that archives local source and invokes the Hypeman Build API, plus expands interpolation across all string fields; this changes compose planning/apply ordering and instance hash/tag computation, which could affect rollout/replace behavior.

Overview
Adds first-class dockerfile support to hypeman compose: services can now build from a local Dockerfile + context via the Hypeman Build API (with .dockerignore support), then run instances from the resulting runnable image reference.

compose plan/up now includes build actions ahead of image/instance/ingress reconciliation, updates instance images (and re-hashes tags) once a ready build image ref is known, and waits for built images to be ready before instance creation.

Interpolation is expanded from env-only to all string fields in the compose spec, and ${file:...} contents are now recursively interpolated (bounded depth), with validation updated to require either image or dockerfile (mutually exclusive). Documentation and tests are updated accordingly, and go.mod/go.sum add github.com/moby/patternmatcher for .dockerignore parsing.

^{Reviewed by Cursor Bugbot for commit 0f8f0be. Bugbot is set up for automated code reviews on this repo. Configure here.}

[firetiger-agent]

Firetiger deploy monitoring skipped

This PR didn't match the auto-monitor filter configured on your GitHub connection:

Any PR that changes the kernel API. Monitor changes to API endpoints (packages/api/cmd/api/) and Temporal workflows (packages/api/lib/temporal) in the kernel repo

Reason: PR changes Dockerfile and compose configuration, not API endpoints or Temporal workflows as specified in the filter.

To monitor this PR anyway, reply with @firetiger monitor this.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 0f8f0be. Configure here.}

[cursor]

Ignores in-progress compose builds

Medium Severity

The findReadyBuild function only recognizes builds with a Ready status. If a build for a given hash is already queued or building, concurrent compose up runs will incorrectly initiate duplicate builds.

 

^{Reviewed by Cursor Bugbot for commit 0f8f0be. Configure here.}