Implement Ito v1 local teleoperation loop

compose.yaml

@@ -20,7 +20,7 @@ services:
     depends_on:
       - ito-server
     volumes:
-      - ./client:/usr/share/nginx/html:ro
+      - ./client:/usr/share/nginx/html:ro,Z
     ports:
       - "8080:80"
 
@@ -31,14 +31,14 @@ services:
     depends_on:
       - ito-server
     environment:
-      ITO_SERVER_URL: ws://ito-server:8765
+      ITO_SERVER_URL: ws://host.containers.internal:8765
       ITO_MOCK_ROBOT_ID: mock-robot-1
       ITO_MOCK_ROBOT_NAME: Mock Robot
       ITO_MOCK_ROBOT_STATUS_INTERVAL_MS: "1000"
       ITO_MOCK_ROBOT_CAMERA_VIDEO: /data/mock-camera.mp4
       ITO_MOCK_ROBOT_CAMERA_LOOP: "true"
     volumes:
-      - ${ITO_MOCK_ROBOT_CAMERA_VIDEO_HOST:-./fixtures/mock-camera.mp4}:/data/mock-camera.mp4:ro
+      - ${ITO_MOCK_ROBOT_CAMERA_VIDEO_HOST:-./fixtures/mock-camera.mp4}:/data/mock-camera.mp4:ro,Z
 
   ito-droid:
     profiles:
@@ -53,3 +53,8 @@ services:
       ITO_DROID_NAME: ${ITO_DROID_NAME:-Ito Droid}
       ITO_DROID_ROS_CAMERA_TOPIC: ${ITO_DROID_ROS_CAMERA_TOPIC:-/image_raw}
       ITO_DROID_ROS_SERVO_COMMAND_TOPIC: ${ITO_DROID_ROS_SERVO_COMMAND_TOPIC:-/ito_droid/camera_pan/command}
+
+networks:
+  default:
+    name: podman
+    external: true

docs/local-v1.md

@@ -1,6 +1,6 @@
 # Local v1 Operation
 
-This guide covers local Ito v1 operation with Docker Compose. It keeps the
+This guide covers local Ito v1 operation with Docker Compose or Podman Compose. It keeps the
 same boundaries as `docs/v1.md`: the Pilot Client is static web content, the Ito
 Server owns catalog/session/reconstruction authority, and robot drivers connect
 outward over the Ito Protocol WebSocket control plane.
@@ -22,8 +22,20 @@ Build and run the local server, Pilot Client, and Mock Robot:
 
 ```sh
 docker compose up --build
+# or, with Podman Compose:
+podman compose up --build
 ```
 
+The Compose file uses Podman's pre-existing external `podman` network instead of
+a project-created bridge network. This keeps local Podman operation independent
+of `aardvark-dns`/user-bus startup. The Mock Robot reaches the Ito Server through
+`host.containers.internal:8765`; Docker users can still use the same Compose file
+because the server port is published to the host.
+
+Bind mounts use the `Z` SELinux relabel option so rootless Podman containers can
+read files from the user's home directory. Without this, nginx may return
+`403 Forbidden` even though Unix file permissions look readable.
+
 Open `http://localhost:8080/`. The client defaults to the Ito Server control
 WebSocket at `ws://<page-host>:8765`, which is `ws://localhost:8765` for this
 Compose setup.
@@ -32,6 +44,8 @@ Stop and remove local containers:
 
 ```sh
 docker compose down
+# or:
+podman compose down
 ```
 
 ## Mock Robot Video
@@ -42,12 +56,17 @@ different local video file, override `ITO_MOCK_ROBOT_CAMERA_VIDEO_HOST`:
 ```sh
 ITO_MOCK_ROBOT_CAMERA_VIDEO_HOST=/absolute/path/to/mock-camera.mp4 \
   docker compose up --build
+# or:
+ITO_MOCK_ROBOT_CAMERA_VIDEO_HOST=/absolute/path/to/mock-camera.mp4 \
+  podman compose up --build
 ```
 
 Useful log streams while testing acquisition and pilot input:
 
 ```sh
 docker compose logs -f ito-server mock-robot
+# or:
+podman compose logs -f ito-server mock-robot
 ```
 
 The Mock Robot exercises the v1 WebSocket control plane, acquisition/session