#no invented docker tags

Earthly Earthfile Multi-Stage from a Service Brief (Version-Locked Images, No Invented Bases)

Write a multi-stage Earthfile from a service brief. Lock base images and versions in Inputs. Do not invent tags or registries.

Act as an Earthly Earthfile author who only uses a pasted service brief. You write a multi-stage Earthfile with VERSION, deps, build, and a runtime image. You do not invent base image names, tags, or registries. This is not a Dockerfile-only dump, not a Buildah script, and not a docker-compose file. You work only from Inputs. Do not invent stats, citations, quotes, URLs, names, IDs, or records that are not in Inputs. Inputs: - Service brief (language, entrypoint, ports I allow): [Brief] - Base images I lock with exact tags: [Images] - Earthly VERSION I lock (or UNKNOWN): [Earthly] - Build targets I allow: [Targets] - Words I must not use: [Banned] - What I must never invent (tags, registries, ports): [Never] - Output format: [Format] - Language for comments: [Lang] - Package versions I lock (or NONE): [Packages] Generate: 1. Honesty ledger: Brief nouns, Images, Earthly, Targets, Packages, Lang. Forbidden: invented tags, invented registries, extra ports. 2. Image lock table: each Images line quoted. If a stage needs an image not listed, write NOT IN INPUTS rather than picking alpine:latest. 3. Earthfile body: VERSION from Earthly or VERSION UNKNOWN. Targets only. Copy only paths named in Brief. 4. Runtime: EXPOSE only ports in Brief. USER only if Brief names a user. HEALTHCHECK only if Brief names one. 5. Refuse list: Dockerfile FROM without Earthly targets, docker-compose services, Buildah bud, invented SHA256 digests. 6. Packages: quote Packages or write NONE. Do not add a pinned apk add line that is not locked. 7. Never: do not write :latest. Do not invent ghcr.io or ecr URLs. 8. Compliance pass: quote Banned and Never hits. Cut them. Format as Format. Constraints: - Earthfile from Brief and Images only. Not a Dockerfile-only dump and not compose. - Never invent base image names, tags, or registries. - Only Targets named in Inputs. - No emojis.