Add container registry pull, image source settings, and global AWS config

Support pulling images from registry (default: repo.anhonesthost.net/cybercovellc/triple-c/triple-c-sandbox:latest),
local builds, or custom images via a new settings UI. Add global AWS configuration
(config path auto-detect, profile picker, region) that serves as defaults overridable
per-project for Bedrock auth.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

app/src-tauri/src/docker/container.rs

@@ -6,7 +6,7 @@ use bollard::models::{ContainerSummary, HostConfig, Mount, MountTypeEnum};
 use std::collections::HashMap;
 
 use super::client::get_docker;
-use crate::models::{container_config, AuthMode, BedrockAuthMethod, ContainerInfo, Project};
+use crate::models::{AuthMode, BedrockAuthMethod, ContainerInfo, GlobalAwsSettings, Project};
 
 pub async fn find_existing_container(project: &Project) -> Result<Option<String>, String> {
     let docker = get_docker()?;
@@ -42,10 +42,12 @@ pub async fn create_container(
     project: &Project,
     api_key: Option<&str>,
     docker_socket_path: &str,
+    image_name: &str,
+    aws_config_path: Option<&str>,
+    global_aws: &GlobalAwsSettings,
 ) -> Result<String, String> {
     let docker = get_docker()?;
     let container_name = project.container_name();
-    let image = container_config::full_image_name();
 
     let mut env_vars: Vec<String> = Vec::new();
 
@@ -55,14 +57,32 @@ pub async fn create_container(
         let uid = std::process::Command::new("id").arg("-u").output();
         let gid = std::process::Command::new("id").arg("-g").output();
         if let Ok(out) = uid {
-            let val = String::from_utf8_lossy(&out.stdout).trim().to_string();
-            env_vars.push(format!("HOST_UID={}", val));
+            if out.status.success() {
+                let val = String::from_utf8_lossy(&out.stdout).trim().to_string();
+                if !val.is_empty() {
+                    log::debug!("Host UID detected: {}", val);
+                    env_vars.push(format!("HOST_UID={}", val));
+                }
+            } else {
+                log::debug!("Failed to detect host UID (exit code {:?})", out.status.code());
+            }
         }
         if let Ok(out) = gid {
-            let val = String::from_utf8_lossy(&out.stdout).trim().to_string();
-            env_vars.push(format!("HOST_GID={}", val));
+            if out.status.success() {
+                let val = String::from_utf8_lossy(&out.stdout).trim().to_string();
+                if !val.is_empty() {
+                    log::debug!("Host GID detected: {}", val);
+                    env_vars.push(format!("HOST_GID={}", val));
+                }
+            } else {
+                log::debug!("Failed to detect host GID (exit code {:?})", out.status.code());
+            }
         }
     }
+    #[cfg(windows)]
+    {
+        log::debug!("Skipping HOST_UID/HOST_GID on Windows — Docker Desktop's Linux VM handles user mapping");
+    }
 
     if let Some(key) = api_key {
         env_vars.push(format!("ANTHROPIC_API_KEY={}", key));
@@ -82,7 +102,16 @@ pub async fn create_container(
     if project.auth_mode == AuthMode::Bedrock {
         if let Some(ref bedrock) = project.bedrock_config {
             env_vars.push("CLAUDE_CODE_USE_BEDROCK=1".to_string());
-            env_vars.push(format!("AWS_REGION={}", bedrock.aws_region));
+
+            // AWS region: per-project overrides global
+            let region = if !bedrock.aws_region.is_empty() {
+                Some(bedrock.aws_region.clone())
+            } else {
+                global_aws.aws_region.clone()
+            };
+            if let Some(ref r) = region {
+                env_vars.push(format!("AWS_REGION={}", r));
+            }
 
             match bedrock.auth_method {
                 BedrockAuthMethod::StaticCredentials => {
@@ -97,8 +126,11 @@ pub async fn create_container(
                     }
                 }
                 BedrockAuthMethod::Profile => {
-                    if let Some(ref profile) = bedrock.aws_profile {
-                        env_vars.push(format!("AWS_PROFILE={}", profile));
+                    // Per-project profile overrides global
+                    let profile = bedrock.aws_profile.as_ref()
+                        .or(global_aws.aws_profile.as_ref());
+                    if let Some(p) = profile {
+                        env_vars.push(format!("AWS_PROFILE={}", p));
                     }
                 }
                 BedrockAuthMethod::BearerToken => {
@@ -148,22 +180,32 @@ pub async fn create_container(
         });
     }
 
-    // AWS config mount (read-only, for profile-based auth)
-    if project.auth_mode == AuthMode::Bedrock {
+    // AWS config mount (read-only)
+    // Mount if: Bedrock profile auth needs it, OR a global aws_config_path is set
+    let should_mount_aws = if project.auth_mode == AuthMode::Bedrock {
         if let Some(ref bedrock) = project.bedrock_config {
-            if bedrock.auth_method == BedrockAuthMethod::Profile {
-                if let Some(home) = dirs::home_dir() {
-                    let aws_dir = home.join(".aws");
-                    if aws_dir.exists() {
-                        mounts.push(Mount {
-                            target: Some("/home/claude/.aws".to_string()),
-                            source: Some(aws_dir.to_string_lossy().to_string()),
-                            typ: Some(MountTypeEnum::BIND),
-                            read_only: Some(true),
-                            ..Default::default()
-                        });
-                    }
-                }
+            bedrock.auth_method == BedrockAuthMethod::Profile
+        } else {
+            false
+        }
+    } else {
+        false
+    };
+
+    if should_mount_aws || aws_config_path.is_some() {
+        let aws_dir = aws_config_path
+            .map(|p| std::path::PathBuf::from(p))
+            .or_else(|| dirs::home_dir().map(|h| h.join(".aws")));
+
+        if let Some(ref aws_path) = aws_dir {
+            if aws_path.exists() {
+                mounts.push(Mount {
+                    target: Some("/home/claude/.aws".to_string()),
+                    source: Some(aws_path.to_string_lossy().to_string()),
+                    typ: Some(MountTypeEnum::BIND),
+                    read_only: Some(true),
+                    ..Default::default()
+                });
             }
         }
     }
@@ -190,7 +232,7 @@ pub async fn create_container(
     };
 
     let config = Config {
-        image: Some(image),
+        image: Some(image_name.to_string()),
         hostname: Some("triple-c".to_string()),
         env: Some(env_vars),
         labels: Some(labels),
@@ -257,11 +299,17 @@ pub async fn get_container_info(project: &Project) -> Result<Option<ContainerInf
                     .map(|s| format!("{:?}", s))
                     .unwrap_or_else(|| "unknown".to_string());
 
+                // Read actual image from Docker inspect
+                let image = info
+                    .config
+                    .and_then(|c| c.image)
+                    .unwrap_or_else(|| "unknown".to_string());
+
                 Ok(Some(ContainerInfo {
                     container_id: container_id.clone(),
                     project_id: project.id.clone(),
                     status,
-                    image: container_config::full_image_name(),
+                    image,
                 }))
             }
             Err(_) => Ok(None),
@@ -282,7 +330,6 @@ pub async fn list_sibling_containers() -> Result<Vec<ContainerSummary>, String>
         .await
         .map_err(|e| format!("Failed to list containers: {}", e))?;
 
-    // Filter out Triple-C managed containers
     let siblings: Vec<ContainerSummary> = all_containers
         .into_iter()
         .filter(|c| {

app/src-tauri/src/docker/image.rs

@@ -1,4 +1,4 @@
-use bollard::image::{BuildImageOptions, ListImagesOptions};
+use bollard::image::{BuildImageOptions, CreateImageOptions, ListImagesOptions};
 use bollard::models::ImageSummary;
 use futures_util::StreamExt;
 use std::collections::HashMap;
@@ -10,13 +10,12 @@ use crate::models::container_config;
 const DOCKERFILE: &str = include_str!("../../../../container/Dockerfile");
 const ENTRYPOINT: &str = include_str!("../../../../container/entrypoint.sh");
 
-pub async fn image_exists() -> Result<bool, String> {
+pub async fn image_exists(image_name: &str) -> Result<bool, String> {
     let docker = get_docker()?;
-    let full_name = container_config::full_image_name();
 
     let filters: HashMap<String, Vec<String>> = HashMap::from([(
         "reference".to_string(),
-        vec![full_name],
+        vec![image_name.to_string()],
     )]);
 
     let images: Vec<ImageSummary> = docker
@@ -30,14 +29,65 @@ pub async fn image_exists() -> Result<bool, String> {
     Ok(!images.is_empty())
 }
 
+pub async fn pull_image<F>(image_name: &str, on_progress: F) -> Result<(), String>
+where
+    F: Fn(String) + Send + 'static,
+{
+    let docker = get_docker()?;
+
+    // Parse image name into from_image and tag
+    let (from_image, tag) = if let Some(pos) = image_name.rfind(':') {
+        // Check that the colon is part of a tag, not a port
+        let after_colon = &image_name[pos + 1..];
+        if after_colon.contains('/') {
+            // The colon is part of a port (e.g., host:port/repo)
+            (image_name, "latest")
+        } else {
+            (&image_name[..pos], after_colon)
+        }
+    } else {
+        (image_name, "latest")
+    };
+
+    let options = CreateImageOptions {
+        from_image,
+        tag,
+        ..Default::default()
+    };
+
+    let mut stream = docker.create_image(Some(options), None, None);
+
+    while let Some(result) = stream.next().await {
+        match result {
+            Ok(info) => {
+                let mut msg_parts = Vec::new();
+                if let Some(ref status) = info.status {
+                    msg_parts.push(status.clone());
+                }
+                if let Some(ref progress) = info.progress {
+                    msg_parts.push(progress.clone());
+                }
+                if !msg_parts.is_empty() {
+                    on_progress(msg_parts.join(" "));
+                }
+                if let Some(ref error) = info.error {
+                    return Err(format!("Pull error: {}", error));
+                }
+            }
+            Err(e) => return Err(format!("Pull stream error: {}", e)),
+        }
+    }
+
+    Ok(())
+}
+
 pub async fn build_image<F>(on_progress: F) -> Result<(), String>
 where
     F: Fn(String) + Send + 'static,
 {
     let docker = get_docker()?;
-    let full_name = container_config::full_image_name();
+    let full_name = container_config::local_build_image_name();
 
-    // Create a tar archive in memory containing Dockerfile and entrypoint.sh
     let tar_bytes = create_build_context().map_err(|e| format!("Failed to create build context: {}", e))?;
 
     let options = BuildImageOptions {
@@ -71,7 +121,6 @@ fn create_build_context() -> Result<Vec<u8>, std::io::Error> {
     {
         let mut archive = tar::Builder::new(&mut buf);
 
-        // Add Dockerfile
         let dockerfile_bytes = DOCKERFILE.as_bytes();
         let mut header = tar::Header::new_gnu();
         header.set_size(dockerfile_bytes.len() as u64);
@@ -79,7 +128,6 @@ fn create_build_context() -> Result<Vec<u8>, std::io::Error> {
         header.set_cksum();
         archive.append_data(&mut header, "Dockerfile", dockerfile_bytes)?;
 
-        // Add entrypoint.sh
         let entrypoint_bytes = ENTRYPOINT.as_bytes();
         let mut header = tar::Header::new_gnu();
         header.set_size(entrypoint_bytes.len() as u64);
@@ -90,7 +138,6 @@ fn create_build_context() -> Result<Vec<u8>, std::io::Error> {
         archive.finish()?;
     }
 
-    // Flush to make sure all data is written
     let _ = buf.flush();
     Ok(buf)
 }