[gowrishacv]

What changed

Adds a Dockerfile that builds and installs the current repository source using python:3.12-slim. The final image includes Git and defaults to the non-root crg user (UID/GID 10001).

Adds Docker and Podman instructions to the English README and all four translations, including user mapping for writable repository mounts and persisted graph data.

No graph is generated during image construction. GHCR publishing remains outside this PR.

Related issue

Closes #232

Validation

• Docker: ARM64 image build and mounted-repository graph build passed.
• Docker: AMD64 image build and CLI startup passed under emulation on an ARM64 Mac.
• Podman 6.1.2: ARM64 image build, CLI startup, and mounted-repository graph build passed.
• Default runtime identity: uid=10001(crg) gid=10001(crg).
• Git available in the runtime image: git version 2.47.3.

Both Docker and Podman produced:

Full build: 356 files, 7852 nodes, 71308 edges (postprocess=full)

A separate container read the persisted graph with status:

Nodes: 7789
Edges: 70499
Files: 336

Repository checks

• README parity: 21 passed.
• Full test suite: 3962 passed, 774 skipped, 2 xfailed, 2 xpassed, 1 warning.
• Ruff: all checks passed.
• Mypy: no issues found in 75 source files.
• git diff --check: passed.

The test warning concerns Starlette’s deprecated use of httpx in its test client.

[github-actions]

code-review-graph review

Overall risk: 0.00 (LOW) — 0 changed function(s)/class(es), 0 affected flow(s), 0 test gap(s)

Token savings: this graph-backed report used ~66,028 fewer tokens (~100%) than reading every changed file in full (estimated, chars/4 approximation).

---

Powered by code-review-graph — local-first analysis; no code leaves the CI runner.

[tirth8205]

Thank you for this PR. I tested build, update and detect-changes in Docker Desktop on macOS.

Before I can merge it, please fix these:

1. Git refuses the mounted repo (README.md:111-116 and the four translated READMEs). In the container, root owns /workspace. So git -C /workspace rev-parse HEAD fails with "detected dubious ownership". Then update does a full rebuild. detect-changes says "No changes detected." after an edit. Ignored files get indexed. This Dockerfile line fixed all of it:
   ENV GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=safe.directory GIT_CONFIG_VALUE_0=/workspace

2. The container graph stores paths like /workspace/app.py. Then a host update on the same repo fails. The error says "built with a different repository root". Please add a short note near README.md:133.

After you push the fix, I will test it again.

[gowrishacv]

@tirth8205 Both requested changes are pushed in 7d3af0d.

1. The Dockerfile now sets GIT_CONFIG_COUNT=1, GIT_CONFIG_KEY_0=safe.directory, and GIT_CONFIG_VALUE_0=/workspace. Trust is scoped to the documented mount path and works with the README's user mapping and HOME=/tmp.
2. The English README and all four translations now explain that the persisted graph contains absolute container paths such as /workspace/app.py. They advise using the same /workspace mount for container update and detect-changes, explain the host update repository-root mismatch, and document running code-review-graph build on the host when switching to host commands.

Validation on an Apple Silicon Mac:

• Docker Desktop 4.95.0 / Engine 29.8.2: ARM64 image build passed. AMD64 image build and CLI startup passed under emulation.
• Podman 6.1.4: ARM64 image build passed.
• For both engines, mounted temporary Git repositories passed build, detect-changes --base HEAD after an edit, incremental update, and status from a separate container. Ignored files stayed excluded, graph files remained owned by the host user, and the default image identity was UID/GID 10001 (crg).
• The ownership regression was checked explicitly using GIT_TEST_ASSUME_DIFFERENT_OWNER=1: disabling the trust configuration reproduced "dubious ownership"; enabling it allowed Git access and the graph checks to pass.
• On the small fixture, both engines reported Incremental: 1 files updated, 3 nodes, 3 edges (postprocess=full); the subsequent status showed 3 nodes, 3 edges, and 1 file.
• The relevant repository tests passed: 251 tests covering README parity, repository-root identity, Git integration, incremental updates, and CLI behavior. Ruff, README shell-syntax checks, and git diff --check also passed.

Could you please retest the updated image with your Docker Desktop workflow, especially build, update, and detect-changes on the mounted repository? Thank you.

[Copilot]

🟡 Changes recommended

The documented bind mount can deny repository access on SELinux-enforcing hosts, so all four README translations need guidance on the :z mount option.

1 open issue

• Document SELinux :z option for repository bind mounts · New

What changed in this PR

Adds Docker and Podman support for running the code-review-graph CLI from a locally built image, addressing #232.

Changes:

• Adds a multi-stage Python 3.12 image that installs repository source, includes Git, and defaults to a non-root user.
• Documents container builds, writable repository mounts, and user mapping in English and four translations.
• Explains graph persistence and container-path constraints when switching to host commands.

File	Description
README.zh-CN.md	Adds Simplified Chinese container usage instructions.
README.md	Documents Docker and Podman commands and graph persistence.
README.ko-KR.md	Adds Korean container usage instructions.
README.ja-JP.md	Adds Japanese container usage instructions.
README.hi-IN.md	Adds Hindi container usage instructions.
Dockerfile	Builds and installs the CLI with Git and a non-root runtime.

_{Review effort: Balanced}

[tirth8205]

Thank you! Your Docker and Podman work is now in staging through merge train #1186, with your commits kept (merge commit bdc5937). GitHub didn't mark this PR merged only because the last commit here merges staging in again and adds nothing new, so I'm closing it by hand.