Borrow the running app's image for the password step

The script defaulted to menu-admin:latest and refused to run on monoco, where the
image is registry.tanshu.com/menu-admin:<tag>. It now reads the image off the
container the app is already running, deriving the container name the way the
playbook does, and only asks for an explicit image when there is no container to
borrow one from. The failure message names the exact command either way.

scripts/provision-site-env.sh

@@ -27,7 +27,7 @@ if [[ -z "$DATA_ROOT" || "$DATA_ROOT" == "-h" || "$DATA_ROOT" == "--help" ]]; th
 fi
 shift || true
 
-IMAGE="menu-admin:latest"
+IMAGE=""
 FORCE=0
 for argument in "$@"; do
   case "$argument" in
@@ -48,11 +48,30 @@ if ! command -v docker >/dev/null 2>&1; then
   exit 1
 fi
 
-if ! docker image inspect "$IMAGE" >/dev/null 2>&1; then
-  echo "image $IMAGE is not present; pull or build it first" >&2
+# The image is only needed to borrow node for hashing, so take the one the app
+# is already running rather than guessing a name. The playbook names the
+# container menu-app.<domain> for the web address menu.<domain>.
+if [[ -z "$IMAGE" ]]; then
+  for candidate in "menu-app.${DATA_ROOT##*/menu.}" "menu-app.${DATA_ROOT##*/}"; do
+    IMAGE="$(docker inspect --format '{{.Config.Image}}' "$candidate" 2>/dev/null || true)"
+    [[ -n "$IMAGE" ]] && break
+  done
+fi
+
+if [[ -z "$IMAGE" ]]; then
+  echo "could not tell which image to use: no running app container to borrow one from." >&2
+  echo "Pass it explicitly: $0 $DATA_ROOT registry.tanshu.com/menu-admin:<tag>" >&2
   exit 1
 fi
 
+if ! docker image inspect "$IMAGE" >/dev/null 2>&1; then
+  echo "image $IMAGE is not present on this host." >&2
+  echo "Pass the one the app runs: $0 $DATA_ROOT registry.tanshu.com/menu-admin:<tag>" >&2
+  exit 1
+fi
+
+echo "hashing with the app's image: $IMAGE"
+
 read -r -s -p "Admin password: " PASSWORD
 echo
 read -r -s -p "Repeat password: " REPEAT