Add Docker image pre-pull to deploy script

Pre-pulling the base Docker image in the deploy script prevents
potential TLS certificate errors during the `docker build` process. This
ensures a smoother deployment by leveraging the cached image layer.

canary/.dockerignore

@@ -0,0 +1,17 @@
+# Keep the build context small. The HF model cache lives at
+# /opt/stacks/doctate-canary/models/ on Minerva — without this exclude,
+# `docker build` ships ~6 GB to the daemon on every run.
+models/
+
+# Not needed inside the image.
+deploy.sh
+*.md
+.git/
+.gitignore
+
+# Python local artifacts.
+__pycache__/
+*.pyc
+*.pyo
+.venv/
+venv/

canary/deploy.sh

@@ -14,8 +14,13 @@ rsync -av \
   "$LOCAL_DIR/" "$HOST:$REMOTE_DIR/"
 
 echo ">>> Rebuilding + restarting on $HOST"
+# Pre-pull the base image with the Docker engine before `docker build`.
+# Docker's legacy builder hits a TLS cert error on the pull path; pulling
+# first means the build finds the layer in cache and skips that step.
+# Keep this tag in sync with the FROM line in the Dockerfile.
 ssh "$HOST" "cd $REMOTE_DIR && \
   docker compose down && \
+  docker pull nvidia/cuda:12.6.1-devel-ubuntu22.04 && \
   docker build -t doctate-canary . && \
   docker compose up -d"