refactor: use Docker registry image instead of local builds

- docker-compose now pulls letsbesolutions/sysadmin-agent:latest
- setup.sh pulls image instead of cloning repo and building
- Removed dev-only volume mounts
- Updated resource limits for production

This enables proper CI/CD: push to repo → Gitea builds image →
tenant servers pull latest image.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

script/setup.sh

@@ -398,38 +398,8 @@ else
             fi
 
             if [[ "$tool_name" == "sysadmin" ]]; then
-                echo "Cloning/updating sysadmin repository..."
-                SYSADMIN_DIR="/opt/letsbe/stacks/sysadmin"
-                SYSADMIN_REPO="https://code.letsbe.solutions/letsbe/letsbe-sysadmin.git"
-
-                # Save our docker-compose.yml before clone
-                if [[ -f "${SYSADMIN_DIR}/docker-compose.yml" ]]; then
-                    cp "${SYSADMIN_DIR}/docker-compose.yml" /tmp/sysadmin-compose.yml
-                fi
-
-                # Clone or pull the repo
-                if [[ -d "${SYSADMIN_DIR}/.git" ]]; then
-                    echo "  Pulling latest changes..."
-                    cd "${SYSADMIN_DIR}" && git pull origin main || git pull origin master
-                else
-                    echo "  Cloning repository..."
-                    # Clone into temp, then move contents
-                    rm -rf /tmp/letsbe-sysadmin
-                    git clone "${SYSADMIN_REPO}" /tmp/letsbe-sysadmin
-                    # Move repo contents to sysadmin dir (preserving our docker-compose)
-                    cp -r /tmp/letsbe-sysadmin/* "${SYSADMIN_DIR}/" 2>/dev/null || true
-                    cp -r /tmp/letsbe-sysadmin/.* "${SYSADMIN_DIR}/" 2>/dev/null || true
-                    rm -rf /tmp/letsbe-sysadmin
-                fi
-
-                # Restore our docker-compose.yml (with template variables)
-                if [[ -f /tmp/sysadmin-compose.yml ]]; then
-                    cp /tmp/sysadmin-compose.yml "${SYSADMIN_DIR}/docker-compose.yml"
-                    rm /tmp/sysadmin-compose.yml
-                fi
-
-                echo "  Building sysadmin image..."
-                docker-compose -f "$compose_file" build
+                echo "  Pulling latest sysadmin agent image..."
+                docker-compose -f "$compose_file" pull
             fi
 
             echo "Starting $tool_name..."
@@ -504,31 +474,8 @@ if [[ -f "$SYSADMIN_COMPOSE" ]]; then
         echo "  Sysadmin agent already running, updating..."
     fi
 
-    SYSADMIN_DIR="/opt/letsbe/stacks/sysadmin"
-    SYSADMIN_REPO="https://code.letsbe.solutions/letsbe/letsbe-sysadmin.git"
-
-    # Save our docker-compose.yml before clone
-    cp "${SYSADMIN_DIR}/docker-compose.yml" /tmp/sysadmin-compose.yml
-
-    # Clone or pull the repo
-    if [[ -d "${SYSADMIN_DIR}/.git" ]]; then
-        echo "  Pulling latest sysadmin changes..."
-        cd "${SYSADMIN_DIR}" && git pull origin main || git pull origin master || true
-    else
-        echo "  Cloning sysadmin repository..."
-        rm -rf /tmp/letsbe-sysadmin
-        git clone "${SYSADMIN_REPO}" /tmp/letsbe-sysadmin
-        cp -r /tmp/letsbe-sysadmin/* "${SYSADMIN_DIR}/" 2>/dev/null || true
-        cp -r /tmp/letsbe-sysadmin/.* "${SYSADMIN_DIR}/" 2>/dev/null || true
-        rm -rf /tmp/letsbe-sysadmin
-    fi
-
-    # Restore our docker-compose.yml (with template variables replaced)
-    cp /tmp/sysadmin-compose.yml "${SYSADMIN_DIR}/docker-compose.yml"
-    rm /tmp/sysadmin-compose.yml
-
-    echo "  Building sysadmin image..."
-    docker-compose -f "$SYSADMIN_COMPOSE" build
+    echo "  Pulling latest sysadmin agent image..."
+    docker-compose -f "$SYSADMIN_COMPOSE" pull
 
     echo "  Starting sysadmin agent..."
     docker-compose -f "$SYSADMIN_COMPOSE" up -d

script/stacks/sysadmin/docker-compose.yml

@@ -2,9 +2,7 @@ version: "3.8"
 
 services:
   agent:
-    build:
-      context: .
-      dockerfile: Dockerfile
+    image: letsbesolutions/sysadmin-agent:latest
     container_name: {{ customer }}-agent
 
     environment:
@@ -17,17 +15,13 @@ services:
       # credentials are persisted to ~/.letsbe-agent/credentials.json
       - REGISTRATION_TOKEN={{ sysadmin_registration_token }}
 
-      # Legacy auth (deprecated - for backward compatibility only)
-      # Uncomment if using older orchestrator version:
-      # - AGENT_TOKEN={{ sysadmin_agent_token }}
-
       # Timing (seconds)
       - HEARTBEAT_INTERVAL=${HEARTBEAT_INTERVAL:-30}
       - POLL_INTERVAL=${POLL_INTERVAL:-5}
 
       # Logging
-      - LOG_LEVEL=${LOG_LEVEL:-DEBUG}
-      - LOG_JSON=${LOG_JSON:-false}
+      - LOG_LEVEL=${LOG_LEVEL:-INFO}
+      - LOG_JSON=${LOG_JSON:-true}
 
       # Resilience
       - MAX_CONCURRENT_TASKS=${MAX_CONCURRENT_TASKS:-3}
@@ -42,12 +36,9 @@ services:
       - SHELL_TIMEOUT=${SHELL_TIMEOUT:-60}
 
     volumes:
-      # Docker socket for docker executor
+      # Docker socket for container management
       - /var/run/docker.sock:/var/run/docker.sock
 
-      # Hot reload in development
-      - ./app:/app/app:ro
-
       # Host directory mounts for real infrastructure access
       - /opt/letsbe/env:/opt/letsbe/env
       - /opt/letsbe/stacks:/opt/letsbe/stacks
@@ -56,8 +47,8 @@ services:
       # Credential persistence (survives restarts without re-registration)
       - agent_home:/home/agent/.letsbe-agent
 
-    # Run as root for Docker socket access in dev
-    # In production, use Docker group membership instead
+    # Run as root for Docker socket access
+    # TODO: Use Docker group membership instead for better security
     user: root
 
     restart: unless-stopped
@@ -66,11 +57,11 @@ services:
     deploy:
       resources:
         limits:
-          cpus: '0.5'
-          memory: 256M
+          cpus: '1.0'
+          memory: 512M
         reservations:
           cpus: '0.1'
-          memory: 64M
+          memory: 128M
 
 volumes:
   agent_home: