Devops

Package the agent stack with one multi-target Dockerfile, one Compose file, and a dev.sh script with health gates locally.

Revised, split, and expanded — The two halves of this article are now separate chapters in the MAF v1: Python and .NET series: the auth + hardening half is covered by MAF v1 — 20c production hardening (with the password reset, refresh-token rotation, and graceful secret rotation that the original missed), and the deployment half is covered by MAF v1 — 25 deployment (with the .NET twin Dockerfile and a dev.sh that polls instead of sleeping). The architecture below is still the canonical reference for the combined story.

If you read the Cloudflare Tunnel post, you know the problem: localhost does not accept webhooks, OAuth providers reject http://localhost as a redirect URI, and showing a client a work-in-progress means a deploy. Cloudflare Tunnel solves it, but it wants a Cloudflare account and domain setup.

Expose localhost with a stable custom subdomain using Cloudflare Tunnel — a free ngrok alternative that works behind NAT and corporate firewalls, with no session limits.

A custom image that only exists on your laptop is not shipped; it is a local experiment. The moment a teammate or a server needs to run it, the image has to live in a registry. Docker Hub is the one most people start with, and the push workflow is the same shape you will later use against Azure Container Registry or Amazon ECR, so it is worth doing once by hand before automating it. This post walks through that manual path with a small nginx-based image.