Lithosia

DeepSeek harness container, Dockerfile and migration tools.

This project is named after the Lithosia quadra Four-Spotted Footman, 四点苔蛾.

The shared agent rules, hooks and GitHub tooling now live in Acsala-agents. This project keeps its own copies until they are removed in a later step.

Running the container

The harness runs in a container built from docker/Dockerfile. Three mounts matter, and they are independent:

• The project source, pointed to by LITHOSIA_CODE and mounted at /Zarquan/Lithosia-docker. Needed to read or edit this project.
• The harness home, pointed to by DSH_HOME on the host and mounted at /opt/dsh. This is the harness's single root for user data: profiles, installed plugins, session logs, credentials and backups. It lives in its own host directory, outside this clone.
• The agent scratch area, from AGENTS_SCRATCH on the host, mounted at both /Zarquan/agents/scratch and /Calycopis/agents/scratch. It is shared between projects and is not part of either repository. Inside the container the two paths are also exported as ZARQUAN_SCRATCH and CALYCOPIS_SCRATCH.

Variable	Container path	Host source	Purpose
LITHOSIA_CODE	/Zarquan/Lithosia-docker	this clone	The project source.
DSH_HOME	/opt/dsh	a dedicated host directory, outside this clone	The harness home.
ZARQUAN_SCRATCH, CALYCOPIS_SCRATCH	/Zarquan/agents/scratch, /Calycopis/agents/scratch	${AGENTS_SCRATCH}, a shared host directory	Temporary agent files.

The current launch commands are in notes/20261025-03-launch.txt. The older notes/20261009-02-launch.txt is deprecated: it still mounts the harness home from inside the clone.

Launch variants

Both the project and the harness home, for an agent that can also edit this project:

podman run \
    --rm \
    --tty \
    --interactive \
    --pod    "lithosia-dsh-pod" \
    --name   "lithosia-dsh-container" \
    --env    "CONTAINER_HOST=unix:///run/podman/podman.sock" \
    --volume "${HOST_CONTAINER_PATH}:/run/podman/podman.sock:rw,Z" \
    --env    "LITHOSIA_CODE=/Zarquan/Lithosia-docker" \
    --volume "${LITHOSIA_CODE:?}:/Zarquan/Lithosia-docker:rw,Z" \
    --env    "DSH_HOME=/opt/dsh" \
    --volume "${DSH_HOME:?}:/opt/dsh:rw,Z" \
    localhost/zarquan/lithosia-quadra:latest \
        bash

Source only, to read or edit this project with no harness:

podman run \
    ....
    --env    "LITHOSIA_CODE=/Zarquan/Lithosia-docker" \
    --volume "${LITHOSIA_CODE:?}:/Zarquan/Lithosia-docker:rw,Z" \
    ....

Harness only, to run the agent against other mounted projects with no copy of this project's source:

podman run \
    ....
    --env    "DSH_HOME=/opt/dsh" \
    --volume "${DSH_HOME:?}:/opt/dsh:rw,Z" \
    ....

The full command in the launch note also mounts the Calycopis projects, /Zarquan/Jordanita, /Zarquan/Phyllonorycter-archive and /Zarquan/Acsala-agents.

Notes

• The harness home has to be mounted. Without it DSH_HOME resolves to a path inside the container's own filesystem, so every profile, plugin and session is lost when the container is removed.

• The host DSH_HOME and the container DSH_HOME are not the same path: the host variable names the directory on the host, while --env DSH_HOME=/opt/dsh sets the path the harness uses inside the container.

• Only one container should use a given harness home at a time. Two harnesses writing the same session state corrupt it. For parallel agents give each its own home, for example --volume "${DSH_HOME:?}-<name>:/opt/dsh:rw,Z".

• The :rw,Z suffix matters: Z relabels the mount for SELinux, and without write access the harness cannot persist anything.

• dsh/ and agents/scratch/ are deprecated placeholders. Their READMEs point to /opt/dsh and /Zarquan/agents/scratch; do not write data into them.

• On a fresh home the web proxy plugin has to be installed once. The image runs init-dsh.sh at build time, but DSH_HOME is unset during the build, so that installs into the harness's default home rather than the mounted one. Run it again inside the container:

  /usr/local/bin/init-dsh.sh

  It is idempotent — it reinstalls the plugin and reapplies the dsh-client-connection patch, both against the mounted home. Then start the harness with dsh web --no-open. The Web UI listens on 3080 inside the container, and the proxy plugin publishes 3081.

• VOLUME /root/.dsh in the image is a leftover from when the harness used DSH's default home. It is unused whenever DSH_HOME is set, and it creates an empty anonymous volume on every run.

• Nothing here is DSH-specific in principle: another harness would get its own variable and its own mount, and a project would choose which to mount.