Chore: rework devcontainer setup

.devcontainer/Dockerfile

@@ -0,0 +1,3 @@
+FROM mcr.microsoft.com/devcontainers/python:3.11
+
+RUN pip install --upgrade pip setuptools wheel

.devcontainer/devcontainer.json

@@ -1,26 +1,18 @@
 {
-  "name": "trading-runtime devcontainer",
-  "dockerComposeFile": [
-    "../docker-compose.yaml",
-    "../docker-compose.override.yaml"
-  ],
-  "service": "app",
-  "workspaceFolder": "/workspace/trading-runtime",
-  "remoteUser": "root",
+  "name": "Trading Runtime Dev",
+  "build": {
+    "dockerfile": "Dockerfile",
+    "context": ".."
+  },
+
+  "postCreateCommand": "./scripts/post-create.sh",
+
   "customizations": {
     "vscode": {
-      "settings": {
-        "python.defaultInterpreterPath": "/opt/venv/bin/python",
-        "python.testing.pytestEnabled": true,
-        "python.testing.pytestArgs": [
-          "tests"
-        ]
-      },
       "extensions": [
         "ms-python.python",
         "ms-python.debugpy"
       ]
     }
-  },
-  "postCreateCommand": "/bin/bash scripts/post-create.sh"
-}
+  }
+}

Dockerfile

@@ -11,33 +11,38 @@ FROM python:3.11.14-slim-trixie AS build
 
 ARG TRADING_RUNTIME_COMMIT
 
-ENV TRADING_RUNTIME_COMMIT=$TRADING_RUNTIME_COMMIT
-ENV PATH="/install/bin:$PATH"
+ENV TRADING_RUNTIME_COMMIT=${TRADING_RUNTIME_COMMIT}
+ENV PATH="/install/bin:${PATH}"
 ENV PYTHONPATH="/install/lib/python3.11/site-packages"
 
-WORKDIR /workspace/trading-runtime
+WORKDIR /workspaces/trading-runtime
 
+# System dependencies for building Python packages & running tests
 RUN apt-get update && \
     apt-get install -y --no-install-recommends \
         git \
         ca-certificates \
         build-essential && \
     rm -rf /var/lib/apt/lists/*
 
+# Install Python dependencies first (maximizes Docker cache)
 COPY requirements.txt .
 COPY requirements-dev.txt .
 
 RUN pip install --upgrade pip && \
     pip install --prefix=/install -r requirements.txt && \
     pip install --prefix=/install -r requirements-dev.txt
 
+# Copy project files
 COPY pyproject.toml .
 COPY scripts/check.sh .
 COPY trading_runtime/ trading_runtime/
 COPY tests/ tests/
 
+# Install the package itself
 RUN pip install --prefix=/install .
 
+# Run test & quality checks
 RUN chmod +x check.sh && ./check.sh
 
 
@@ -50,18 +55,25 @@ ARG GIT_COMMIT
 ARG GIT_BRANCH
 ARG GIT_DIRTY
 
-ENV GIT_COMMIT=$GIT_COMMIT \
-    GIT_BRANCH=$GIT_BRANCH \
-    GIT_DIRTY=$GIT_DIRTY \
+ENV GIT_COMMIT=${GIT_COMMIT} \
+    GIT_BRANCH=${GIT_BRANCH} \
+    GIT_DIRTY=${GIT_DIRTY} \
     PYTHONUNBUFFERED=1
 
+# Minimal runtime dependencies
 RUN apt-get update && \
-    apt-get install -y --no-install-recommends ca-certificates && \
+    apt-get install -y --no-install-recommends \
+        ca-certificates && \
     rm -rf /var/lib/apt/lists/*
 
+# Create non-root user for production runtime
+RUN adduser --disabled-password --gecos '' appuser
+
+# Copy only installed Python artifacts from build stage
 COPY --from=build /install /usr/local
 
+# Application directory (mostly symbolic now — no source code needed)
 WORKDIR /app
 
-COPY trading_runtime/ trading_runtime/
-COPY pyproject.toml .
+# Drop privileges
+USER appuser

argo/workflowtemplate-backtest.yaml

@@ -20,7 +20,7 @@ spec:
 
       - name: experiment-config
         description: "Path to experiment JSON inside the container"
-        value: /workspace/trading-runtime/strategies/
+        value: /workspaces/trading-runtime/strategies/
 
       - name: scratch-root
         description: "Scratch root inside the container"

scripts/post-create.sh

@@ -1,20 +1,14 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-echo "[post-create] Using venv at /opt/venv"
-# shellcheck disable=SC1091
-source /opt/venv/bin/activate
-
-cd /workspace/trading-runtime
-
 echo "[post-create] Installing dev requirements..."
 
 python -m pip install -r requirements-dev.txt
 
 # If this repo is a Python package, install it in editable mode
 if [ -f pyproject.toml ] || [ -f setup.py ] || [ -f setup.cfg ]; then
   echo "[post-create] Installing trading-runtime in editable mode..."
-  python -m pip install -e .
+  python -m pip install -e .[dev]
 fi
 
 echo "[post-create] Running import-linter..."

trading_runtime/local/local.json

@@ -5,9 +5,9 @@
   "engine": {
     "initial_snapshot": null,
     "data_files": [
-      "/workspace/trading-runtime/tests/data/parts/part-000.npz",
-      "/workspace/trading-runtime/tests/data/parts/part-001.npz",
-      "/workspace/trading-runtime/tests/data/parts/part-002.npz"
+      "/workspaces/trading-runtime/tests/data/parts/part-000.npz",
+      "/workspaces/trading-runtime/tests/data/parts/part-001.npz",
+      "/workspaces/trading-runtime/tests/data/parts/part-002.npz"
     ],
 
     "instrument": "BTC_USDC-PERPETUAL",
@@ -32,8 +32,8 @@
     "roi_lb": 40000,
     "roi_ub": 80000,
 
-    "stats_npz_path": "/workspace/trading-runtime/tests/data/results/stats.npz",
-    "event_bus_path": "/workspace/trading-runtime/tests/data/results/events.json"
+    "stats_npz_path": "/workspaces/trading-runtime/tests/data/results/stats.npz",
+    "event_bus_path": "/workspaces/trading-runtime/tests/data/results/events.json"
   },
 
   "risk": {