"""Prepare a reviewable GPU1 container definition; this script starts no services."""
import pathlib,json,hashlib,secrets,subprocess,sys
sys.path.insert(0,'/home/ps/huobao-gpu-selection')
from docker_worker_ops import api,inspect,clone,set_env,replace_bind,write_json
root=pathlib.Path('/home/ps/huobao-gpu-selection');work=root/'gpu1';name='huobao-comfy-gpu1'
assert not work.exists(),'GPU1 preparation already exists; inspect rather than overwrite'
work.mkdir(mode=0o700)
source=inspect('comfyui');cfg=clone(source,name)
write_json(work/'source.inspect.json',source)
for kind in ('input','output','user','temp','control'):(work/kind).mkdir(mode=0o700)
token=secrets.token_hex(32);(work/'control/canary.token').write_text(token);(work/'control/canary.token').chmod(0o600)
write_json(work/'control/control.json',{'schema':1,'maintenance':True,'purpose':'Huobao GPU1 authenticated submissions only'})
hist=work/'history.json';write_json(hist,{'schema':1,'queue_empty':True,'source_container_id':'huobao-gpu1-initial','history':{}})
for kind in ('input','output','user','temp'):replace_bind(cfg,'/app/'+kind,work/kind)
replace_bind(cfg,'/run/h3-control',work/'control')
replace_bind(cfg,'/run/h3-history.json',hist)
set_env(cfg,'H3_HISTORY_SNAPSHOT_SHA256',hashlib.sha256(hist.read_bytes()).hexdigest())
set_env(cfg,'H3_HISTORY_SOURCE_CONTAINER_ID','huobao-gpu1-initial')
# Reuse the existing read-only visual-verification socket, not its GPU workload.
control=next(m['Source'] for m in source['Mounts'] if m['Destination']=='/run/h3-control')
vision=pathlib.Path(control)/'vision'
if vision.exists():
 cfg['HostConfig']['Binds'].append(str(vision)+':/run/h3-shared-vision:ro')
 set_env(cfg,'H3_VISION_SOCKET','/run/h3-shared-vision/vision.sock')
for i,a in enumerate(cfg['Cmd']):
 if a=='--temp-directory':cfg['Cmd'][i+1]='/app/temp'
cfg['Cmd']+=['--reserve-vram','8']
cfg['HostConfig']['DeviceRequests']=[{'Driver':'nvidia','Count':0,'DeviceIDs':['1'],'Capabilities':[['gpu','gpu']],'Options':{}}]
cfg['HostConfig']['PortBindings']={};cfg['HostConfig']['PublishAllPorts']=False
cfg['HostConfig']['NetworkMode']='zq-platform-network'
cfg['NetworkingConfig']={'EndpointsConfig':{'zq-platform-network':{'Aliases':[name]}}}
cfg['HostConfig']['RestartPolicy']={'Name':'unless-stopped','MaximumRetryCount':0}
assert cfg['HostConfig']['Privileged'] is False and cfg['HostConfig']['ReadonlyRootfs'] is True
write_json(work/'create.json',cfg)
print('Prepared GPU1 definition only; no container created or started. Device 1, reserve 8 GiB, private zq-platform-network, no host ports, read-only root, user 1000.')