ompweb-docker

ompweb-docker is a turnkey container that hosts oh-my-pi (the omp coding-agent engine) and ompweb (its web UI) in one image, with persistent state, host-UID alignment, and Docker access for the agent. The image contains the launcher, the engine, and the UI. At runtime the container starts as root only long enough to remap PUID / PGID, join the Docker socket group, chown the volumes, and seed a workspace registry — then drops to the unprivileged omp user with gosu before any user code runs. Both upstream sources are selected at build time via OMP_REPO / OMP_REF and OMPWEB_REPO / OMPWEB_REF, so a fork or an unreleased ref is one --build-arg away. Every state path is a bind mount, so backup is a tar over ./data and your files are visible on the host. The image ships the Docker client only; the daemon is the host's, reached through the mounted socket. At startup the entrypoint reads the socket's GID, reuses or creates a matching group, and adds omp to it, so docker ps works inside the container without running as root. OMP_WEB_PASSWORD is the only auth boundary; pick a strong, unique value. The runtime process runs as an unprivileged user (omp, UID 1000 by default or your PUID).