Plan a single service

Validation and manifest planning are read-only. Confirmed lifecycle execution changes the selected runtime and persists durable intent and ownership. Save this canonical example to a new hostwright.yaml; check project and port conflicts first.

version: 3
project: phase04-single
imagePolicy: require-digest

services:
  web:
    image: docker.io/library/python@sha256:26730869004e2b9c4b9ad09cab8625e81d256d1ce97e72df5520e806b1709f92
    resources:
      requests: {cpus: 1, memory: 512MiB}
      limits: {cpus: 1, memory: 512MiB}
    command: ["python3", "-m", "http.server", "8080", "--bind", "0.0.0.0"]
    ports:
      - "18080:8080"
    probes:
      startup:
        exec: ["python3", "-c", "raise SystemExit(0)"]
      readiness:
        tcp:
          port: 8080
      liveness:
        http:
          port: 8080
          path: /
    restart:
      policy: unless-stopped
    update:
      strategy: recreate
      maxSurge: 0
      maxUnavailable: 1
      progressDeadline: 60s

Review and execute

Use a signed current-source candidate and start Apple container. Follow installation and daemon setup before running these commands: validation, planning, and lifecycle requests use the authenticated Control API. The public dev.12 package uses older contracts.

hostwright validate hostwright.yaml
hostwright image pull docker.io/library/python@sha256:26730869004e2b9c4b9ad09cab8625e81d256d1ce97e72df5520e806b1709f92 --platform linux/arm64 --runtime-provider apple-cli
hostwright plan hostwright.yaml --output json
hostwright runtime providers --json
hostwright up hostwright.yaml --dry-run --runtime-provider apple-cli --output json

validate and plan do not change the runtime. plan is a manifest-level plan; the lifecycle confirmation hash comes from the observed-runtime up --dry-run. Review its exact image, resource requests/limits, ownership, provider, and actions.

hostwright up hostwright.yaml --confirm-plan <planSHA256> --runtime-provider apple-cli
hostwright status hostwright.yaml --runtime-provider apple-cli --output json

Use the exact hash from the fresh dry run, with the same manifest, provider, and selected state path. If anything changes, review another dry run. Stopping and removing resources each require their own fresh dry-run hash:

hostwright down hostwright.yaml --dry-run --runtime-provider apple-cli
hostwright down hostwright.yaml --confirm-plan <down-planSHA256> --runtime-provider apple-cli
hostwright rm hostwright.yaml --dry-run --runtime-provider apple-cli
hostwright rm hostwright.yaml --confirm-plan <rm-planSHA256> --runtime-provider apple-cli

Only proven Hostwright-owned resources are eligible for removal. Preserve unmanaged workloads and inspect recovery after interruption.