Drop the ref-docker-base/container-keys mirror copy

Container SSH keys are bind-mounted into web and ssh-reverse-proxy at
runtime and re-mounted into student containers from there. The
base-image Dockerfile no longer copies them in, so the per-deployment
mirror under ref-docker-base/container-keys is unused. Remove the
copy in prepare.py and the test-helper equivalent, drop the
gitignore entry, and refresh docs/CONFIG.md.

Author: Nils Bars

.gitignore

@@ -20,7 +20,6 @@ webapp/venv
 webapp/ref_webapp.egg-info/
 
 ref-docker-base/task-wrapper
-ref-docker-base/container-keys
 
 container-keys/
 

docs/CONFIG.md

@@ -63,8 +63,9 @@ Downstream rendering steps (run in both modes):
    `testing=False` / `bridge_id=""` are the only values still hard-coded in
    `prepare.py`.
 3. `generate_ssh_keys()` creates ed25519 SSH host keys in `container-keys/`
-   if missing (existing keys are left alone) and mirrors them into
-   `ref-docker-base/container-keys/` for the base image build.
+   if missing (existing keys are left alone). At runtime the directory is
+   bind-mounted into `web` and `ssh-reverse-proxy`; `web` in turn mounts the
+   `.pub` files into student containers at `/etc/ssh/master_keys/{user,root}`.
 
 `ctrl.sh` handles the first-run case automatically: if neither
 `settings.yaml` nor `settings.env` exists, it invokes `./prepare.py` before
@@ -262,9 +263,10 @@ config dataclass.
   flag, compose falls back to its default `.env` lookup, finds nothing, and
   every `${VAR:?...}` placeholder fails. Always go through `ctrl.sh`, or
   replicate its `--env-file` / shell-export pattern manually.
-- **`container-keys/` and `ref-docker-base/container-keys/` must stay in
-  sync.** `prepare.py` copies the former into the latter so the base image
-  build picks them up. If you rotate the host keys, re-run `./prepare.py`
-  or rebuild the base image.
+- **`container-keys/` is bind-mounted live into student containers.**
+  Rotating the files on the host takes effect on the next student container
+  start — no image rebuild needed. The `web` container mounts the directory
+  read-only and re-mounts the `.pub` files into each student container at
+  `/etc/ssh/master_keys/{user,root}`.
 - **`settings.yaml` and `settings.env` are mode `0600` by design.** Do not
   loosen the permissions — they contain plaintext secrets.

prepare.py

@@ -15,7 +15,6 @@
 
 import argparse
 import secrets
-import shutil
 import subprocess
 import sys
 from pathlib import Path
@@ -30,7 +29,6 @@
 COMPOSE_TEMPLATE = "docker-compose.template.yml"
 COMPOSE_OUT = REPO_ROOT / "docker-compose.yml"
 CONTAINER_KEYS_DIR = REPO_ROOT / "container-keys"
-DOCKER_BASE_KEYS_DIR = REPO_ROOT / "ref-docker-base" / "container-keys"
 
 SECRET_BYTES = 32
 
@@ -323,8 +321,6 @@ def generate_ssh_keys() -> None:
                 ["ssh-keygen", "-t", "ed25519", "-N", "", "-f", str(key_path)]
             )
 
-    shutil.copytree(CONTAINER_KEYS_DIR, DOCKER_BASE_KEYS_DIR, dirs_exist_ok=True)
-
 
 def parse_args() -> argparse.Namespace:
     parser = argparse.ArgumentParser(description=__doc__)

tests/helpers/ref_instance.py

@@ -472,7 +472,6 @@ def _find_free_subnets(self, count: int) -> List[tuple[str, str]]:
     def _generate_ssh_keys(self):
         """Generate SSH keys needed for container communication."""
         container_keys_dir = self._ref_root / "container-keys"
-        ref_docker_base_keys = self._ref_root / "ref-docker-base" / "container-keys"
 
         container_keys_dir.mkdir(parents=True, exist_ok=True)
 
@@ -485,13 +484,6 @@ def _generate_ssh_keys(self):
                     capture_output=True,
                 )
 
-        # Copy keys to ref-docker-base if it exists
-        if ref_docker_base_keys.parent.exists():
-            ref_docker_base_keys.mkdir(parents=True, exist_ok=True)
-            for key_file in container_keys_dir.iterdir():
-                if key_file.name != ".gitkeep":
-                    shutil.copy2(key_file, ref_docker_base_keys / key_file.name)
-
     def _write_config_files(self):
         """Write the configuration files."""
         # Generate SSH keys if they don't exist