Session

Each session is its own compose project on the host: the pi container, plus a kube-proxy and an ssh-agent sidecar when the project’s config asks for them. The pages below describe what is mounted where, what the agent can reach, and what stays outside.

In this part

Mounts and paths

Host ↔ Container Path & Mount Contract

Security model

Agent state

Agent state (pi-agent-state volume)

Internals