Static non-root alpine image; tunneld must own host ports 443/80 directly since visitor TLS is SNI-routed and never proxy-terminated.
HTTP API per the recorded contract, bridge WebSocket, SNI relay with pass-through tunnel TLS, local CA issuance, JSON store. Verified end-to-end with the official opentunnel CLI.