# GCP Debian Docker VM recipe

This recipe provisions a Debian VM, installs Docker, and can mint a bounded
one-hour registry token for the configured workload. Terraform state persists
in `/lemc/private`.

The publication-safe [cookbook.yaml](cookbook.yaml) declares
`GOOGLE_CREDENTIALS` by name only. The immutable Cookbook author stores its
write-only value on the Web **User > Secrets** page. Run the recipe through the
authenticated server path. Local `lemcli dev run` refuses this secret-bearing
recipe.

Build the local image with `make build`. For remote publication, create a
cookbook, set `COOKBOOK_UUID`, and run `make publish`. The image is pushed
through LEMC and the remote cookbook is rewritten to its immutable managed
digest.