import pathlib,json,sys,subprocess
sys.path.insert(0,'/home/ps/huobao-gpu-selection')
from docker_worker_ops import api,inspect,write_json
root=pathlib.Path('/home/ps/huobao-gpu-selection');work=root/'gpu1';name='huobao-comfy-gpu1'
cfg=json.loads((work/'create.json').read_text())
assert cfg['HostConfig']['DeviceRequests'][0]['DeviceIDs']==['1']
assert not cfg['HostConfig']['PortBindings'] and not cfg['HostConfig']['Privileged']
assert list(cfg['NetworkingConfig']['EndpointsConfig'])==['zq-platform-network']
assert cfg['HostConfig']['ReadonlyRootfs'] and cfg['User']=='1000:1000'
assert cfg['Cmd'][-2:]==['--reserve-vram','8']
created=api('POST','/containers/create?name='+name,cfg);write_json(work/'created.json',created)
api('POST','/containers/'+name+'/start')
normal=inspect('canvas-h3-prompt-normalizer-healthy-20261026')
tokens=pathlib.Path(next(m['Source'] for m in normal['Mounts'] if m['Destination']=='/run/h3-workers'))
target=tokens/'gpu1.token';assert not target.exists()
target.write_text((work/'control/canary.token').read_text());target.chmod(0o600)
subprocess.run(['setfacl','-m','u:65534:r--',str(target)],check=True)
write_json(root/'extra-providers.json',[{'id':'gpu1','name':'ComfyUI GPU1','base_url':'http://huobao-comfy-gpu1:8188','control_token_file':'/run/h3-workers/gpu1.token'}])
(root/'extra-providers.json').chmod(0o644) # Nonsecret catalogue: names, URL and token path only.
print('Started prepared private GPU1 worker; existing services untouched:',created['Id'][:12])