Not always running; started for the gate and quit after. The one rule: a build argument printed in a RUN line goes into every build log, so the Dockerfile declares the token and never references it.
Docker Desktop
ToolSprout
The container runtime on the laptop — the image gate (`pnpm run gate:image`) builds this site’s production image with it before any PR that touches the build lands.
macOSWindowsLinux