fix(workflow): remove build contexts from compose; build.sh uses docker build directly

build.sh

@@ -1,17 +1,19 @@
 #!/usr/bin/env bash
 # build.sh — Build Docker images locally for development
-# Usage: ./build.sh [--no-cache] [--push]
+# Usage: ./build.sh [docker build flags, e.g. --no-cache]
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-COMPOSE_FILE="$SCRIPT_DIR/docker-compose.yml"
+REGISTRY="registry.zeidler.dev/docker/playground"
-PROJECT="claude-secure"
+TAG="${IMAGE_TAG:-latest}"
 
 GREEN='\033[0;32m'; NC='\033[0m'
 info() { echo -e "${GREEN}[+]${NC} $*"; }
 
-dc() { docker compose -f "$COMPOSE_FILE" -p "$PROJECT" "$@"; }
+info "Building proxy..."
+docker build "$@" -t "${REGISTRY}/docker-claude-proxy:${TAG}" "${SCRIPT_DIR}/proxy"
+
+info "Building claude..."
+docker build "$@" -t "${REGISTRY}/docker-claude-claude:${TAG}" "${SCRIPT_DIR}/claude"
 
-info "Building images..."
-dc build "$@"
 info "Done. Run './claude.sh start' to launch."

claude.sh

@@ -85,9 +85,9 @@ build_volume_args() {
 cmd_start() {
     check_deps; load_env; build_volume_args
     info "Starting proxy sidecar..."
-    dc up -d --no-build proxy
+    dc up -d proxy
     info "Launching Claude Code..."
-    dc run --rm --no-build --service-ports "${VOLUME_ARGS[@]}" claude "$@"
+    dc run --rm --service-ports "${VOLUME_ARGS[@]}" claude "$@"
 }
 
 cmd_stop() {
@@ -116,7 +116,7 @@ cmd_status() {
 cmd_shell() {
     check_deps; load_env; build_volume_args
     warn "Opening debug shell inside Claude container (non-Claude entrypoint)."
-    dc run --rm --no-build --service-ports --entrypoint /bin/bash "${VOLUME_ARGS[@]}" claude
+    dc run --rm --service-ports --entrypoint /bin/bash "${VOLUME_ARGS[@]}" claude
 }
 
 cmd_web() {
@@ -124,7 +124,7 @@ cmd_web() {
     [[ -n "${WEBUI_PASSWORD:-}" ]] \
         || { error "WEBUI_PASSWORD is not set. Add it to .env before starting the web interface."; exit 1; }
     info "Starting proxy and web interface..."
-    dc up -d --no-build webui
+    dc up -d webui
     info "Web interface is up → http://0.0.0.0:7681"
     info "Credentials: ${WEBUI_USER:-claude} / [WEBUI_PASSWORD]"
 }

docker-compose.yml

@@ -4,9 +4,6 @@ services:
   # Enforces an egress allowlist — see proxy/squid.conf.
   proxy:
     image: registry.zeidler.dev/docker/playground/docker-claude-proxy:${IMAGE_TAG:-latest}
-    build:
-      context: proxy
-      dockerfile: Dockerfile
     networks:
       - claude-internal # reachable by claude and webui containers
       - proxy-external # has outbound internet access
@@ -26,9 +23,6 @@ services:
   # Run via "docker compose run --rm --service-ports claude" (managed by claude.sh).
   claude:
     image: registry.zeidler.dev/docker/playground/docker-claude-claude:${IMAGE_TAG:-latest}
-    build:
-      context: claude/
-      dockerfile: Dockerfile
     depends_on:
       proxy:
         condition: service_healthy
@@ -67,9 +61,6 @@ services:
   # Network isolation is identical to the CLI container.
   webui:
     image: registry.zeidler.dev/docker/playground/docker-claude-claude:${IMAGE_TAG:-latest}
-    build:
-      context: claude/
-      dockerfile: Dockerfile
     entrypoint: ["/usr/local/bin/webui-entrypoint.sh"]
     depends_on:
       proxy: