docs(hck-cli): refresh docs for 8.12.7, consolidated writes, and hardened profile (HCK-17257)

README.md

@@ -1,5 +1,26 @@
-# Running Hackolade Studio Command Line Interface in Docker containers
+# Running Hackolade CLI in Docker
 
-This repository contains instructions and files for running Hackolade Studio CLI using our official Docker image which can be found on [Docker Hub](https://hub.docker.com/r/hackolade/studio/tags).  This image doesn't contain Hackolade Studio but provides a preconfigured runtime for running it inside Docker containers.
+This repository provides **ready-to-use examples** for the pre-built [`hackolade/hck-cli`](https://hub.docker.com/r/hackolade/hck-cli/tags) image: Hackolade Studio CLI, all target plugins, no build step.
 
-Check [How to run Hackolade Studio with Docker](./Studio/README.md) in [./Studio subfolder](./Studio) for details.
+![Docker Image Version (latest by date)](https://img.shields.io/docker/v/hackolade/hck-cli)
+
+**Start here:** [Getting started with hackolade/hck-cli](./Studio/doc/getting-started-hck-cli.md)
+
+## Runtime model
+
+All examples use the **same two write paths** (whether or not the root filesystem is read-only):
+
+- **`/data`** — persistent volume or PVC (license, models, output, logs)
+- **`/tmp`** — tmpfs / memory emptyDir (ephemeral scratch)
+
+## Examples in [`Studio/`](./Studio)
+
+| File | Profile |
+| --- | --- |
+| [`compose.yml`](./Studio/compose.yml) | Local — consolidated `/data` + `/tmp` |
+| [`compose.hardened.yml`](./Studio/compose.hardened.yml) | **Hardened** — same mounts + read-only rootfs, dropped caps (CI / production) |
+| [`k8s/`](./Studio/k8s/) | **Kubernetes** — same mounts + Restricted Pod Security Standard |
+
+## Custom-built images (legacy)
+
+Build on [`hackolade/studio`](https://hub.docker.com/r/hackolade/studio/tags) if you need a custom plugin set. That path uses the legacy `/home/hackolade/Documents/*` layout — see [getting-started.md](./Studio/doc/getting-started.md).

Studio/README.md

@@ -1,48 +1,51 @@
 # Running Hackolade Studio CLI in Docker
 
-![Docker Image Version (latest by date)](https://img.shields.io/docker/v/hackolade/studio)
+![Docker Image Version (latest by date)](https://img.shields.io/docker/v/hackolade/hck-cli)
 
-The instructions below assume that you have Docker [installed](https://www.docker.com/get-started) and running.
+The purpose of running Hackolade in a Docker container is to operate the **Command-Line Interface (CLI)**, typically in CI/CD pipelines.
 
-The purpose of running Hackolade Studio in a Docker container is to operate the Command-Line Interface ("CLI"), typically in a the context of integration with CI/CD pipelines.
+⚠ The purpose is **not** to run the application GUI in Docker — this is **not** supported.
 
-⚠ The purpose is **not** to run the application GUI in Docker -- this is **not** supported.
+The instructions below assume Docker is [installed](https://www.docker.com/get-started) and running.
 
-## 🚀 Getting Started
+## 🚀 Getting started (recommended)
 
-**New to Docker or need step-by-step instructions?** Start with our comprehensive [Getting Started Guide](./doc/getting-started.md) which includes:
-- Docker basics explained in simple terms
-- Instructions using **Docker CLI directly** (for beginners and those who want explicit control)
-- Instructions using **Docker Compose** (for simpler, shorter commands)
-- Complete examples for common scenarios
-- Troubleshooting tips
+Use the pre-built [`hackolade/hck-cli`](https://hub.docker.com/r/hackolade/hck-cli/tags) image — Hackolade Studio CLI with all plugins, no build step:
 
-The guide is designed to be understandable even if you've never used Docker before.
+**[Getting started with hackolade/hck-cli](./doc/getting-started-hck-cli.md)** — consolidated writes to `/data` + `/tmp`, hardened Compose, and Kubernetes examples.
 
-## 🎯 Using the Pre-built CLI Image (Recommended)
+```bash
+# Recommended baseline for CI / production (read-only rootfs, same write layout)
+docker compose -f compose.hardened.yml run --rm hck-cli version
+```
+
+## Runtime model
+
+Every `hackolade/hck-cli` deployment uses **two writable mounts only**:
 
-**Want to skip the build step?** We now provide a ready-to-use Docker image (`hackolade/hck-cli`) that includes Hackolade Studio and all plugins pre-installed. This is the fastest way to get started!
+| Mount | Purpose |
+| --- | --- |
+| `/data` | License state, models, output, logs (persistent volume or PVC) |
+| `/tmp` | Sockets, caches, scratch (tmpfs / memory emptyDir) |
 
-**Benefits:**
-- ✅ No build step required - just pull and use
-- ✅ Simplified data paths (`/data` instead of `/home/hackolade/Documents/...`)
-- ✅ Secure secret management for license keys
-- ✅ Always up-to-date with latest releases
+[`compose.yml`](./compose.yml) and [`compose.hardened.yml`](./compose.hardened.yml) share this layout. Hardened adds read-only root filesystem, dropped capabilities, and non-root execution — the profile used in [`k8s/`](./k8s/) as well.
 
-**Get started:** See our [Getting Started Guide for the Pre-built CLI Image](./doc/getting-started-hck-cli.md) for complete instructions.
+## Build your own image (advanced)
 
-**When to use the pre-built image vs. building your own:**
-- **Use pre-built image** (`hackolade/hck-cli`) if you want simplicity and all plugins included
-- **Build your own** (instructions below) if you need specific plugin versions or customizations
+Need a custom plugin set or Dockerfile based on [`hackolade/studio`](https://hub.docker.com/r/hackolade/studio/tags)? See [getting-started.md](./doc/getting-started.md) and [build.md](./doc/build.md).
 
 ## Repository structure
-This repository contains files and instructions for running the [Hackolade Studio](https://hackolade.com) data modeling application, using the base image published on [Docker Hub](https://hub.docker.com/r/hackolade/studio):
 
-- [Dockerfile](Dockerfile): ready-to-use example of a full installation of Hackolade Studio, including the possibility to install selected target plugins
-- [docker-compose.yml](docker-compose.yml): example for **custom-built** `hackolade/studio` images (traditional paths)
-- [compose.yml](compose.yml): simple example for the pre-built **`hackolade/hck-cli`** image
-- [compose.hardened.yml](compose.hardened.yml): hardened `hck-cli` example (read-only rootfs, `/data` + `/tmp` tmpfs)
-- [k8s/](k8s/): Kubernetes Job examples with PVC at `/data` and memory emptyDir at `/tmp`
+Primary examples use the pre-built **`hackolade/hck-cli`** image (same `/data` + `/tmp` write layout in every profile):
+
+- [compose.yml](compose.yml): local Compose — consolidated mounts, writable rootfs
+- [compose.hardened.yml](compose.hardened.yml): **hardened** — same mounts + read-only rootfs, `cap_drop: ALL`
+- [k8s/](k8s/): **Kubernetes** Jobs — same mounts + Restricted Pod Security Standard
+
+Custom-build path (legacy layout on `hackolade/studio`):
+
+- [Dockerfile](Dockerfile): example full installation with selected plugins
+- [docker-compose.yml](docker-compose.yml): Compose for custom-built images
 - [securityPolicies.json](securityPolicies.json) - [optional] the list of required system call operations to be able to run Hackolade with Chrome sandboxing (disabled by default) inside a container ([more details](https://docs.docker.com/engine/security/seccomp/))
 - batch files examples when running on Windows:
   - [docker-help.bat](docker-help.bat): verify the proper running of the CLI by displaying the CLI help in a container.  Will work without a validated license key.

Studio/compose.hardened.yml

@@ -9,27 +9,28 @@
 
 # Hardened Docker Compose example for hackolade/hck-cli.
 #
-# Matches how the image runs under the Kubernetes Restricted Pod Security Standard
-# and OpenShift restricted-v2 SCC:
+# Same consolidated write layout as compose.yml (/data + /tmp). This file adds the
+# security profile expected in CI, production, and Kubernetes Restricted:
 #
 #   - read-only root filesystem
 #   - all capabilities dropped, no privilege escalation
 #   - non-root user (1000:1001 by default)
-#   - exactly two writable mounts:
-#       /data  persistent volume — license state, logs, models, output, settings
-#       /tmp   tmpfs — sockets, caches, scratch (discarded when the container exits)
+#
+# Writable mounts (always the same two paths):
+#   /data  persistent volume — license state, logs, models, output, settings
+#   /tmp   tmpfs — sockets, caches, scratch
 #
 # Usage:
 #   docker compose -f compose.hardened.yml run --rm hck-cli version
 #
-# For local development without these constraints, use compose.yml instead.
+# For the same /data + /tmp layout without read-only rootfs, use compose.yml.
 # For Kubernetes manifests with a PVC, see k8s/hck-cli-job.yaml.
 # Documentation: doc/getting-started-hck-cli.md
 
 services:
   hck-cli: &hck-cli
     init: true
-    image: hackolade/hck-cli:8.9.2
+    image: hackolade/hck-cli:8.12.7
     command: ["version"]
     restart: 'no'
     read_only: true

Studio/compose.yml

@@ -10,13 +10,16 @@
 # Example Docker Compose file for the pre-built hackolade/hck-cli image from Docker Hub.
 # The image includes Hackolade Studio and all plugins — ready to use without a build step.
 #
-# For complete documentation and usage instructions, see: doc/getting-started-hck-cli.md
+# Runtime writes are consolidated to exactly two mounts (same layout as compose.hardened.yml
+# and the k8s/ manifests — only the security profile differs here):
+#   /data  persistent volume — license state, logs, models, output, settings
+#   /tmp   tmpfs — sockets, caches, scratch
 #
-# If you are building your own image using hackolade/studio, use docker-compose.yml instead.
-# See doc/getting-started.md for building instructions.
+# For read-only root filesystem, dropped capabilities, and Kubernetes Restricted parity,
+# use compose.hardened.yml instead.
 #
-# For Kubernetes Restricted / OpenShift restricted-v2 parity (read-only root filesystem,
-# dropped capabilities, /data volume + /tmp tmpfs), use compose.hardened.yml instead.
+# Documentation: doc/getting-started-hck-cli.md
+# Custom builds on hackolade/studio: docker-compose.yml + doc/getting-started.md
 
 services:
   # Run a CLI command (defaults to version).
@@ -28,15 +31,17 @@ services:
   #     --model '/data/models/MongoDB/Yelp Challenge dataset.hck.json' \
   #     --doc /data/output/doc-test --jsonSchema
   hck-cli: &hck-cli
-    image: hackolade/hck-cli:8.9.2
+    image: hackolade/hck-cli:8.12.7
     command: ["version"]
     restart: 'no'
     # network_mode: 'none'
     volumes:
-      # Mandatory: license state, logs, output, settings, and options live under /data.
+      # Persistent state — license, logs, models, output (see doc/getting-started-hck-cli.md).
       - hackolade-studio-data:/data
-      # Models from the host; remove this line to keep models on the named volume instead.
       - ${PWD}/models:/data/models
+    tmpfs:
+      # Ephemeral scratch — same consolidated layout as compose.hardened.yml and k8s/.
+      - /tmp:rw,size=1g,mode=1777
 
   showComputerIdForOfflineValidation:
     extends: hck-cli

Studio/doc/custom-certificates.md

@@ -32,7 +32,7 @@ Use PEM format — the file starts with `-----BEGIN CERTIFICATE-----`. A single
 ```yaml
 services:
   hck-cli:
-    image: hackolade/hck-cli:8.9.2
+    image: hackolade/hck-cli:8.12.7
     command: ["version"]
     read_only: true
     user: "1000:1001"
@@ -60,7 +60,7 @@ Reverse-engineering connectors and Git integration that use OpenSSL rather than
 
 ```bash
 mkdir -p certificates
-docker run --rm --entrypoint cat hackolade/hck-cli:8.9.2 \
+docker run --rm --entrypoint cat hackolade/hck-cli:8.12.7 \
   /etc/ssl/certs/ca-certificates.crt > certificates/ca-bundle.crt
 cat certificates/internal-ca.crt >> certificates/ca-bundle.crt
 ```
@@ -85,7 +85,7 @@ Mount the CA from a `ConfigMap` or `Secret` and set the variable. No init contai
 spec:
   containers:
     - name: hck-cli
-      image: hackolade/hck-cli:8.9.2
+      image: hackolade/hck-cli:8.12.7
       env:
         - name: NODE_EXTRA_CA_CERTS
           value: /certs/internal-ca.crt