Function default_dockerfile 

pub fn default_dockerfile(
    port: u16,
    workdir: Option<&str>,
    base: &BaseImage,
) -> String

A Dockerfile that makes the daemon the container CMD.

ENTRYPOINT [] plus CMD ["/agentd"] is the deployment invariant the trust boundary rests on: it is what guarantees no task workload runs before the platform’s run hook lands. It is also what makes an omitted cwd inherit the image WORKDIR, since the daemon’s own cwd is the image’s.

The FROM is derived from base rather than written here, so it cannot disagree with the baseImageArn the create call sends.

The invariant is unenforced: a base image that starts its own background process before bootstrap breaks it, and enforcing that belongs to whoever builds the image (docs/PROTOCOL.md, “Trust boundary”).