Publish multi-arch Docker images (linux/amd64 + linux/arm64)

[Nic-dorman]

@

Summary

Publish official Docker images for Indelible on every release, supporting both linux/amd64 and linux/arm64.

Background

Indelible currently has a working Dockerfile (multi-stage Node + Go + Alpine, 33MB, /health healthcheck) and a make docker target, but no automated build/publish pipeline. The Docker-based Quick Start shown in README.md and USER-GUIDE.md references image tags that do not exist anywhere yet.

This issue tracks closing that gap so that docker pull and docker compose up work out of the box on every released version.

Scope

Image build & publish

• Build with Buildx for linux/amd64 and linux/arm64 in the same workflow
• Tag each release with :vX.Y.Z and :latest
• Dual-publish:
  • ghcr.io/withautonomi/indelible
  • withautonomi/indelible on Docker Hub
• Run on tag push (v*), alongside the existing platform binary release job

antd companion image

• Publish a separate withautonomi/antd image (same dual-registry pattern) that wraps the antd daemon binary from ant-sdk releases
• linux/amd64 from day one; linux/arm64 follows once the upstream antd-linux-arm64 release artifact exists

docker-compose.yml

• Ship a canonical docker-compose.yml at the repo root covering Postgres + antd + indelible
• Replace the inline examples in README.md and USER-GUIDE.md with a pointer to the shipped compose file
• Resolve the existing /data vs /var/lib/indelible volume-path mismatch between the docs and the Dockerfile

Dockerfile hardening

• Add a non-root USER
• Declare VOLUME ["/var/lib/indelible"] and a runtime WORKDIR
• Verify cross-arch build cleanliness under Buildx + QEMU

Misc

• Add .dockerignore to keep the build context lean

Acceptance

• docker pull ghcr.io/withautonomi/indelible:latest and docker pull withautonomi/indelible:latest both succeed on amd64 and arm64 hosts after a release
• A fresh clone followed by docker compose up brings up a working stack
• Container runs as non-root with a persistent volume on /var/lib/indelible
• README has a "Quick start with Docker" section pointing at the real image names and the shipped compose file

Out of scope

• Helm chart / Kubernetes manifests
• Image signing (cosign / sigstore) — desirable follow-up but not required for initial publish
  @

[Nic-dorman]

Closed by #64, which shipped the multi-arch publish pipeline (Docker Hub + GHCR, linux/amd64 + linux/arm64, :vX.Y.Z + :latest, plus the antd companion image). The earlier Dockerfile hardening, canonical docker-compose.yml, .dockerignore, and README Quick Start updates landed in prior PRs on the same docker workstream. Out-of-scope items (Helm, cosign) remain out of scope.