Local CLI demo

Final check. The shipped image runs with your repository mounted as a read-write workspace. The agent can read, write, and shell, but only inside that mount. Everything else in the container is read-only.

docker-compose.yml
yaml
services:
  agent:
    build: .
    image: coding-agents-from-scratch-go:latest
    container_name: lwp-coding-agent
    stdin_open: true
    tty: true
    environment:
      - LLM_PROVIDER=${LLM_PROVIDER:-openrouter}
      - OPENROUTER_API_KEY=${OPENROUTER_API_KEY}
      - OPENROUTER_MODEL=${OPENROUTER_MODEL:-google/gemma-3-12b-it}
    volumes:
      - ./:/workspace:rw
    working_dir: /workspace

stdin_open and tty give you an interactive REPL inside the container. The only writable path is /workspace, which is your repo on the host. Distroless does the rest.

terminal
bash
make docker-build
make up

# Inside the container REPL:
> read the go.mod file and tell me the module path
> write a file called HELLO.md that lists the three tools this agent exposes
> run go test ./... and summarize the results

# When done
make down

The same REPL you have been using all course, now inside a nonroot static image with just your repo mounted. That is the artifact.

Validation checklist: Ship checklist

Loading practice…

Checkpoint: Final checkpoint

Loading practice…