management_compose.yaml pins the published Command Center image and the
builder pulls it unconditionally, so a bundle always carries the *released*
admin application. That makes an admin-side change impossible to test on an
air-gapped target until it ships in an image — including the Easy Setup
offline fixes in this branch.
With --use-local-images, an image already in the daemon is bundled as-is.
Anything not present locally is still pulled, so the flag cannot quietly
produce a bundle with a gap in it. It is opt-in because it deliberately does
not verify that a local image resembles the tag it claims.
Bundles built this way record USED_LOCAL_IMAGES=1 in the manifest and carry a
"not for distribution" note in README.txt. The manifest is read key-by-key by
the installer, so the added key needs no format bump.
The docker wrapper forwards the flag through its existing catch-all, and
`docker image inspect` inside the build container resolves against the host
daemon via the mounted socket, so host-built images are visible.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
d5d2301679