ZAKON — Local Docker Build Before Remote Container CI Dispatch

ZAKON — Local Docker Build Before Remote Container CI Dispatch 
 Status: ACTIVE
 Created: 2026-07-28
 Origin: Bilko MC #9616 / Petter Graff Rec #1; MC #9647 local Trivy scan demonstrated faster local feedback.
 Applies to: Bilko, Drop, Tok, and any ALAI task that dispatches a remote container build/deploy pipeline. 
 Rule 
 Before any Cloud Build dispatch, Azure Pipeline deploy stage, GitHub Actions container deploy, or equivalent remote container CI run, the builder MUST run the target Docker build locally using the same Dockerfile, platform, build context, and build args used remotely. 
 No blind pushes to discover container build failures in remote CI. 
 Required Procedure 
 
 Read the repo DEPLOY-MAP.md and pipeline file to identify the canonical remote deploy path. 
 Identify every image affected by the change. 
 Run local Docker build for each affected image using the same production Dockerfile and platform. 
 Capture command, exit code, and final success line in task evidence. 
 Only then push or dispatch remote CI. 
 
 Example for Bilko web: 
 docker buildx build --platform linux/amd64 -f apps/web/Dockerfile \
 --build-arg NEXT_PUBLIC_API_URL=https://api-stage.bilko.cloud/api/v1 \
 -t bilko-web-local-test:$(date +%Y%m%d-%H%M) .
 
 Example for Bilko API: 
 docker buildx build --platform linux/amd64 -f apps/api/Dockerfile \
 -t bilko-api-local-test:$(date +%Y%m%d-%H%M) .
 
 Acceptance Evidence 
 Remote container build/deploy tasks must include: 
 
 Dockerfile path(s). 
 Exact local command(s). 
 Exit code 0 for each local build. 
 Local image tag(s) or image ID(s). 
 If the local build cannot run, an explicit blocker with the missing prerequisite; do not push just to let remote CI test it. 
 
 Blockers 
 Block push/dispatch if: 
 
 Docker is unavailable and no equivalent Linux container builder is available. 
 Build args used locally differ from remote pipeline args. 
 The local build fails. 
 The agent did not read DEPLOY-MAP.md and the relevant pipeline file. 
 
 Why 
 Bilko's MC #9616 review found repeated remote CI cycles that could have been caught locally. Remote CI is slow and expensive in wall-clock time; local builds catch Dockerfile, lockfile, native dependency, and build-context issues before the shared pipeline queue is used. 
 Related Standards 
 
 ~/system/rules/zakon-lockfile-portability.md 
 ~/system/rules/zakon-ci-stub-types-contract.md 
 ~/system/rules/zakon-pi2-deploy-verification.md 
 Bilko BUILD-BLUEPRINT.md §11 and §14