docs(getting-started): clarify deploy token risk and Buildx requirement
- commit
- ef77fcee7794edb2c86b99f4d6d38215abebd20b
- author
- bnema · · 2026-02-11 20:43 UTC
- parent
- ecc578c
- signature
- unsigned
1 file · +5 -2
M docs/getting-started.md +5 -2
| @@ -124,7 +124,9 @@ Create a token for remote CLI deploys (skip if auth is disabled): | |||
| 124 | 124 | gordon auth token generate --subject deploy --scopes push,pull --expiry 0 | |
| 125 | 125 | ``` | |
| 126 | 126 | ||
| 127 | - | Save this token securely - you'll use it with `gordon --remote` (or a saved remote). | |
| 127 | + | `--expiry 0` creates a non-expiring token. Prefer a finite expiry and a rotation policy unless you explicitly need a long-lived deploy token. | |
| 128 | + | ||
| 129 | + | Save this token securely - you'll use it with `gordon --remote` (or a saved remote), and it should be limited to remote deploy use. | |
| 128 | 130 | ||
| 129 | 131 | ## 8. Deploy Your First App | |
| 130 | 132 | ||
| @@ -144,7 +146,8 @@ What this command does: | |||
| 144 | 146 | - `gordon push myapp` resolves the route for `myapp`, chooses a version tag, | |
| 145 | 147 | pushes image tags to Gordon's registry, and triggers deploy. | |
| 146 | 148 | - `--build` runs `docker buildx build` first, injecting `VERSION` from the tag | |
| 147 | - | into the build and then pushing both version and `latest` tags. | |
| 149 | + | into the build and then pushing both version and `latest` tags. This requires | |
| 150 | + | Docker with Buildx; a Podman-only setup is not supported for `--build`. | |
| 148 | 151 | - `--no-confirm` skips the interactive "Deploy now?" prompt so the deploy runs | |
| 149 | 152 | immediately. | |
| 150 | 153 | ||
| @@ -124,7 +124,9 @@ Create a token for remote CLI deploys (skip if auth is disabled): | |||||
| 124 | gordon auth token generate --subject deploy --scopes push,pull --expiry 0 | 124 | gordon auth token generate --subject deploy --scopes push,pull --expiry 0 | ||
| 125 | ``` | 125 | ``` | ||
| 126 | 126 | ||||
| 127 | - | Save this token securely - you'll use it with `gordon --remote` (or a saved remote). | 127 | + | `--expiry 0` creates a non-expiring token. Prefer a finite expiry and a rotation policy unless you explicitly need a long-lived deploy token. |
| 128 | + | ||||
| 129 | + | Save this token securely - you'll use it with `gordon --remote` (or a saved remote), and it should be limited to remote deploy use. | |||
| 128 | 130 | ||||
| 129 | ## 8. Deploy Your First App | 131 | ## 8. Deploy Your First App | ||
| 130 | 132 | ||||
| @@ -144,7 +146,8 @@ What this command does: | |||||
| 144 | - `gordon push myapp` resolves the route for `myapp`, chooses a version tag, | 146 | - `gordon push myapp` resolves the route for `myapp`, chooses a version tag, | ||
| 145 | pushes image tags to Gordon's registry, and triggers deploy. | 147 | pushes image tags to Gordon's registry, and triggers deploy. | ||
| 146 | - `--build` runs `docker buildx build` first, injecting `VERSION` from the tag | 148 | - `--build` runs `docker buildx build` first, injecting `VERSION` from the tag | ||
| 147 | - | into the build and then pushing both version and `latest` tags. | 149 | + | into the build and then pushing both version and `latest` tags. This requires |
| 150 | + | Docker with Buildx; a Podman-only setup is not supported for `--build`. | |||
| 148 | - `--no-confirm` skips the interactive "Deploy now?" prompt so the deploy runs | 151 | - `--no-confirm` skips the interactive "Deploy now?" prompt so the deploy runs | ||
| 149 | immediately. | 152 | immediately. | ||
| 150 | 153 | ||||