deploy: the compose file names its own release, and the cut moves it with the version

docs/how-to/install-with-docker.md

@@ -132,17 +132,17 @@ chmod 0600 deploy/docker/etc-nxdns/config.zon
 ## 3. Run it
 
 ```sh
-NXDNS_VERSION=$VERSION docker compose -f deploy/docker/compose.yaml up -d
+docker compose -f deploy/docker/compose.yaml up -d
 docker compose -f deploy/docker/compose.yaml logs -f
 ```
 
-`compose.yaml` reads the image from two variables: `${NXDNS_IMAGE:-git.mial.net/mokhtar/nxdns:${NXDNS_VERSION:-latest}}`. Set `NXDNS_VERSION` to pin a release; set `NXDNS_IMAGE` to run something else entirely, which is what the build-from-source section at the bottom does.
+`compose.yaml` names the release it was tagged with: its image is `${NXDNS_IMAGE:-git.mial.net/mokhtar/nxdns:${NXDNS_VERSION:-<release>}}`, and `zig build cut` writes `<release>` in the same commit that bumps `build.zig.zon`, so the file from the `v$VERSION` tag runs `$VERSION` with no variable set. Set `NXDNS_VERSION` to run a different release with the same file; set `NXDNS_IMAGE` to run something else entirely, which is what the build-from-source section at the bottom does. Compose files from `v0.0.22` and earlier default to `:latest` instead, so with one of those, set `NXDNS_VERSION=$VERSION` on every command.
 
-> Verified on this host with `docker compose -f deploy/docker/compose.yaml
-> config`, which resolves the variables without contacting a registry: no
-> variables gives `git.mial.net/mokhtar/nxdns:latest`, `NXDNS_VERSION=0.0.1`
-> gives `git.mial.net/mokhtar/nxdns:0.0.1`, and `NXDNS_IMAGE=nxdns` gives
-> `nxdns`.
+> Verified on 2026-10-20 with `docker compose -f deploy/docker/compose.yaml
+> config` on a tree whose `build.zig.zon` declares `0.0.22`, which resolves
+> the variables without contacting a registry: no variables gives
+> `git.mial.net/mokhtar/nxdns:0.0.22`, `NXDNS_VERSION=0.0.21` gives
+> `git.mial.net/mokhtar/nxdns:0.0.21`, and `NXDNS_IMAGE=nxdns` gives `nxdns`.
 
 Every block on this page runs from the repository root, and none of them change directory, so they can be pasted in order. `-f` is what makes that work: Compose resolves the relative paths inside `compose.yaml` — the `etc-nxdns` bind mount — against the directory holding the file, not against your shell, and it takes the project name `docker` from that directory either way, which is why the container is `docker-nxdns-1`.
 

docs/how-to/upgrade.md

@@ -168,20 +168,36 @@ journalctl -u nxdns -f
 
 ### Docker
 
+The compose file names the release it belongs to, so upgrading the image is upgrading the file. A new release's compose file can change more than the image — the `command:` line or a port — so both ways below replace yours: if you edited it by hand, carry your edits over to the new one. To keep your own file as it is, skip the `curl` or the `git checkout` and set `NXDNS_VERSION=$VERSION` on the `pull` and `up` lines instead: it overrides the release the file names. A compose file from `v0.0.22` or earlier defaults to `:latest`, so with one of those the variable is needed on both lines, or `pull` and `up` can land on different images if a release happens between them.
+
+With the single downloaded file of [Install with Docker](install-with-docker.md), fetch the new release's copy over it in its directory, then pull and recreate:
+
 ```sh
-NXDNS_VERSION=$VERSION docker compose -f deploy/docker/compose.yaml pull
-NXDNS_VERSION=$VERSION docker compose -f deploy/docker/compose.yaml up -d
+cd ~/nxdns
+curl -fLO "$BASE/raw/tag/v$VERSION/deploy/docker/compose.yaml"
+docker compose pull
+docker compose up -d
+```
+
+With a checkout of the repository, fetch the tag and move to it, from the repository root:
+
+```sh
+git fetch origin tag "v$VERSION"
+git checkout "v$VERSION"
+docker compose -f deploy/docker/compose.yaml pull
+docker compose -f deploy/docker/compose.yaml up -d
 ```
 
 Compose recreates the container against the same `nxdns-data` volume. What happens to the file in `etc-nxdns` depends on the `command:` in your compose file: with the shipped `run --config=/etc/nxdns/config.zon` the file is the configuration and the restart reconciles onto it; without it, the database in the volume is the configuration and the file is read by nothing.
 
-Set `NXDNS_VERSION` on both lines, or export it. Without it the compose file falls back to `:latest`, and `pull` and `up` could then land on different images if a release happens between them.
-
-> Not run on this host: `pull` needs a published image, and there is none.
-> What was run is `docker compose -f deploy/docker/compose.yaml config`, which
-> resolves the variables without contacting a registry: `NXDNS_VERSION=0.0.1`
-> gave `image: git.mial.net/mokhtar/nxdns:0.0.1`, and no variable at all gave
-> `:latest`.
+> Not run on this host: `pull` and `up` were not run against a new release.
+> What was run on 2026-10-20 is `docker compose -f deploy/docker/compose.yaml
+> config` on a tree whose `build.zig.zon` declares `0.0.22`, which resolves
+> the variables without contacting a registry: no variable gave
+> `image: git.mial.net/mokhtar/nxdns:0.0.22`, and `NXDNS_VERSION=0.0.21` gave
+> `image: git.mial.net/mokhtar/nxdns:0.0.21`.
+> The fetch half was run the same day against `v0.0.22`: the `curl` URL
+> returned 200, and `git fetch --dry-run origin tag v0.0.22` exited 0.
 
 ## 4. Confirm the upgrade