Overhaul docs: fix docker-compose to use env_file, add AWS SSO setup guide, clarify exec -u developer

README.md

@@ -95,6 +95,7 @@ docker compose exec -u developer devbox aws --version
 | `ANTHROPIC_API_KEY` | Anthropic API key | — |
 | `OPENAI_API_KEY` | OpenAI API key | — |
 | `AWS_REGION` | AWS region for Bedrock | `us-east-1` |
+| `AWS_PROFILE` | AWS SSO profile name | `default` |
 | `GIT_USER_NAME` | Git commit author name | — |
 | `GIT_USER_EMAIL` | Git commit author email | — |
 | `WORKSPACE_PATH` | Host path to mount | `.` |
@@ -150,11 +151,40 @@ docker compose build --build-arg OPENCODE_VERSION=1.5.0
 
 ## AWS Bedrock Authentication
 
-When using AWS Bedrock as your LLM provider, you need to authenticate via AWS SSO from inside the container. Since the container runs headless (no browser), use the device-code flow:
+When using AWS Bedrock as your LLM provider, you need:
+
+### 1. AWS config on the host
+
+The container needs access to your `~/.aws/config` with SSO session configuration. If you already have this on another machine, copy it:
 
 ```bash
-# Start the container interactively
-docker compose run --rm devbox bash
+scp -r user@other-machine:~/.aws ~/.aws
+```
+
+Or configure from scratch on the host:
+
+```bash
+aws configure sso
+```
+
+### 2. Mount `~/.aws` into the container
+
+Uncomment the AWS volume mount in `docker-compose.yml`:
+
+```yaml
+- ~/.aws:/home/developer/.aws
+```
+
+Note: do **not** use `:ro` — SSO writes token cache files to this directory.
+
+### 3. Authenticate inside the container
+
+Since the container runs headless (no browser), use the device-code flow:
+
+```bash
+# Start the container
+docker compose up -d
+docker compose exec -u developer devbox bash
 
 # Authenticate — prints a URL and code you open in your local browser
 aws sso login --sso-session <your-sso-session> --use-device-code
@@ -165,7 +195,7 @@ opencode
 
 The `--use-device-code` flag outputs a URL and short code instead of trying to open a browser. Copy the URL into any browser (on your laptop, phone, etc.), enter the code, and complete the 2FA flow. The CLI in the container picks up the session automatically.
 
-SSO sessions typically last 8–12 hours before requiring re-authentication.
+SSO sessions typically last 8–12 hours before requiring re-authentication. Since `~/.aws` is mounted from the host, tokens persist across container restarts.
 
 ## Secret Scanning
 
@@ -201,6 +231,7 @@ Allowlisted paths and rules are in `.gitleaks.toml`. The defaults extend gitleak
 Host Machine
 ├── ~/projects/my-app  ──bind mount──▶  /workspace (container)
 ├── ~/.ssh             ──bind mount──▶  /home/developer/.ssh (ro)
+├── ~/.aws             ──bind mount──▶  /home/developer/.aws (Bedrock SSO)
 └── .env               ──env vars───▶  provider config + API keys
 
 Container (Debian bookworm)
@@ -208,7 +239,7 @@ Container (Debian bookworm)
 ├── AWS CLI v2 (SSO + Bedrock auth)
 ├── git, ssh, ripgrep, fd, jq, curl, fzf
 ├── Node.js (for MCP servers)
-├── entrypoint.sh (SSH perms, git config, provider setup)
+├── entrypoint.sh (UID adjustment, git config, provider setup)
 └── /workspace ← your code lives here
 ```
 
@@ -218,14 +249,12 @@ Container (Debian bookworm)
 |---|---|---|---|
 | `/workspace` | Host bind mount | ✅ Yes | Your project files |
 | `/home/developer/.ssh` | Host bind mount (ro) | ✅ Yes | SSH keys |
+| `/home/developer/.aws` | Host bind mount (if configured) | ✅ Yes | AWS credentials/SSO cache |
 | `/home/developer/.local/share/opencode` | Named volume `devbox-data` | ✅ Yes | Session history, memory |
 | `/home/developer/.config/opencode/opencode.json` | Generated by entrypoint | ❌ No | Provider/model config |
-| `/home/developer/.aws` | Not mounted by default | ❌ No | AWS SSO tokens |
 
 **opencode config** (`opencode.json`) is auto-generated from `OPENCODE_PROVIDER` on each start. It sets provider and model only — no MCP servers. To use MCP servers or custom settings, mount your own config file (see Custom opencode config above).
 
-To persist AWS SSO sessions across restarts, uncomment the `~/.aws` volume mount in `docker-compose.yml`.
-
 ## License
 
 MIT