docker

const (
	// ManagedLabel marks every container created by this provisioner.
	ManagedLabel = "com.llmbox.managed"

	// BoxIDLabel and DescriptionLabel persist the caller-assigned box ID and
	// description so List can report them straight from a container summary.
	BoxIDLabel       = "com.llmbox.box-id"
	DescriptionLabel = "com.llmbox.description"

	// GenerationLabel persists the box's opaque generation token: the per-box
	// incarnation identity exposed to the hub as the box's InstanceID. It is a
	// spoke-minted random token (never the Docker container id), stored on the
	// container so List can recover it after a spoke restart. The hub uses it only
	// for staleness/reap equality — it is never parsed, prefix-matched, or used to
	// address the box (addressing is by box ID). Keeping it distinct from the real
	// container id is what prevents any Docker-native handle from reaching the hub.
	GenerationLabel = "com.llmbox.generation"

	// NamespaceLabel scopes a container to one provisioner's namespace (see
	// SetNamespace). It is only set when a namespace is configured; boxes created
	// without one carry no NamespaceLabel and are visible to any unscoped
	// provisioner, preserving the pre-namespace behaviour.
	NamespaceLabel = "com.llmbox.namespace"

	// DefaultImage is launched when the caller does not specify one. It bakes in
	// the box workload, the llmbox-guest binary (its entrypoint),
	// tini, and a CA bundle (see Dockerfile.box).
	DefaultImage = "ghcr.io/clems4ever/llmbox-box:latest"

	// DefaultSocketDir is the host directory holding per-box control sockets when
	// the operator does not configure one. Each box gets a 0700 subdirectory.
	DefaultSocketDir = "/run/llmbox/boxsockets"
)