Function default_dockerfile 

pub fn default_dockerfile(
    port: u16,
    workdir: Option<&str>,
    base: &BaseImage,
    project: Option<Ecosystem>,
) -> String

A Dockerfile that makes the daemon the container CMD.

ENTRYPOINT [] plus CMD ["/agentd"] is the deployment invariant the trust boundary rests on: it is what guarantees no task workload runs before the platform’s run hook lands. It is also what makes an omitted cwd inherit the image WORKDIR, since the daemon’s own cwd is the image’s.

The FROM is derived from base rather than written here, so it cannot disagree with the baseImageArn the create call sends.

project bakes the environment layer (#74): the manifest+lockfile pair is copied into the working directory — workdir when given, DEFAULT_PROJECT_WORKDIR otherwise — and the ecosystem’s Ecosystem::install_run_line installs from the lockfile. Without it the derived Dockerfile installs nothing, which was the measured state this closes: every launch then pays dependency installation inside the guest, the 31–48% of launch time docs/STRATEGY.md attributes to environment init.

The invariant is unenforced: a base image that starts its own background process before bootstrap breaks it, and enforcing that belongs to whoever builds the image (docs/PROTOCOL.md, “Trust boundary”).