The automation that quietly runs the business is now fully isolated, credential-safe, and reversible – the multi-phase move into Docker is complete.
- Finished moving the automation off the Mac's own environment: the code runs from versioned, labelled images, and its working data and credentials live in dedicated storage volumes rather than loose files on the machine.
- Every action software can't undo – outbound email, writes to the CRM – is now recorded in an append-only audit log, plus a duplicate-write guard so a re-run can't post the same CRM record twice.
- The containers now run as a restricted, non-privileged user, each with a written rollback path – re-run a prior image version, restore a data snapshot, or reverse the specific external change.
- Every routine job was tested end-to-end through the new setup before trusting it – same schedules, same reports, stronger isolation.