From the Docker demo to the first live site

This entry page is for administrators who want to run Workspace locally from the Docker bundle and publish their first CMS site. It connects the existing guides in the intended order. Follow the linked pages for commands, prerequisites, and troubleshooting details.

The journey is complete when the bound storefront domain serves the deliberately published site release over trusted TLS and operations readiness reports no blockers.

Follow the journey

Start the Docker demo. Download the version-matched bundle and SHA256SUMS, verify the checksum, and follow Start the Docker demo. Continue only after ./start.sh doctor succeeds and /health/ready returns HTTP 200.
Complete first system access. Trust data/nucleus.crt in the intended browser and sign in with the locally protected bootstrap credentials. If Workspace displays the EULA, an authorized representative must review and accept it in the browser. See Understand the EULA and commercial host status for the legal and technical boundary.
Create the business tenant. Confirm the System Tenant in the app footer and follow Create a tenant. Wait for provisioning status succeeded, switch explicitly to the new tenant, and confirm the active context again.
Prepare the local storefront. Set up the site, CoreDNS, local CA, DNS TXT verification, and domain binding in the business tenant with Set up a local storefront domain. HTTP 404 is expected before the first live release when DNS, TLS, and domain binding are ready.
Review and publish the site. Initialize and edit the site, redeem the preview handoff in its intended browser, and follow Review and publish a CMS site. Build and publish remain separate steps. Publish only the reviewed release.

Load the matching agent skill

nucli ships agent instructions with the installed binary. Load the matching skill before each phase:

Phase	Skill	Purpose
Installation and TLS	`nucli skills show deployment`	Classifies the bundle, readiness, first access, TLS, and the storefront overlay.
Tenant creation	`nucli skills show tenant-administration`	Checks System Tenant context, discovery, scopes, idempotency, and provisioning.
Domain, preview, and release	`nucli skills show sites`	Separates domain verification, preview, build, publish plan, and publication.

MCP clients expose the same contracts through nucleus_deployment_skill, nucleus_tenant_administration_skill, and nucleus_sites_skill. Mutating MCP tools require their documented explicit approval. An agent must not accept the EULA or copy bootstrap passwords, session tokens, raw DNS verification tokens, or preview links into logs or chat messages.

Verify the complete result

The full journey has succeeded when:

the Docker demo and storefront overlay pass their doctor checks,
the app footer shows the intended business tenant,
the tenant domain is verified and bound to the correct site,
the preview handoff was redeemed only in the intended browser,
the reviewed site release is marked live, and
the live domain returns HTTP 200 with the expected content over trusted TLS.