Docs/compose tell users to pull ghcr.io/apodexai/frontieragent, but the package is private (unauthorized)

[PromptPartner]

Summary

The README and docs/install/docker.md say pre-built linux/amd64 / linux/arm64 images are published to GHCR and that docker compose run --rm agent works with no local build. For anyone outside the org, it doesn't: the package is private. Anonymous pulls are refused, so the documented quick start fails on the first command.

.github/workflows/docker-publish.yml says the privacy is deliberate:

The package is private by org policy, so this pull relies on the ghcr.io login established earlier in the job. Do not add an anonymous-pull check here: it cannot succeed.

So the publish pipeline works as designed, and the user-facing docs and compose.yaml contradict it.

Reproduce

On a clean machine with no ghcr.io login (checked at 9e533db):

git clone https://github.com/ApodexAI/FrontierAgent && cd FrontierAgent
cp .env.example .env
docker compose run --rm agent

Image ghcr.io/apodexai/frontieragent:latest Error error from registry: unauthorized

The registry agrees: the anonymous token endpoint returns {"errors":[{"code":"UNAUTHORIZED","message":"authentication required"}]}, and /v2/apodexai/frontieragent/tags/list returns 403.

Why this also breaks the local-build workaround

compose.yaml sets pull_policy: always on agent and eval. After a successful local build (docker compose -f compose.yaml -f compose.dev.yaml build), a plain docker compose run --rm agent (or ./docker/run.sh) still tries to pull, and fails again with the same error. It only works with --pull never or by keeping -f compose.dev.yaml on every command, and the docs mention neither.

Suggested fix (either works)

1. Make the GHCR package public, if org policy allows it. The docs are then correct as written.
2. Or keep it private and align the docs and compose:
   • README "Containers and local models" and docs/install/docker.md: make the local build the default path and drop the "no local build needed" wording.
   • compose.yaml: change pull_policy: always to missing, so a locally built image is used when the pull isn't possible.
   • Update docker/run.sh to match.

Environment

macOS (arm64), Docker Engine 29.7.2, Docker Compose v2. A local build from the checkout works fine: frontier-agent --version returns FrontierAgent 0.1.0.