The lake is one shared warehouse (s3://era5-thermograph/iceberg), so the
environments differ only in where the engine runs: a throwaway docker run
of a small DuckDB image (httpfs + iceberg extensions baked in) on the
target box, locally for LAN dev and over SSH for beta/prod. No daemon, no
listening port, no tunnel, and no container names to resolve.
No catalog service: each table's newest metadata JSON is resolved at call
time and exposed as a view named after its table directory, so reads track
a table that is still being loaded.
Sessions lock themselves down before user SQL runs (allowed_directories
pinned to the lake prefixes, external access disabled, configuration
locked), so writes to backups/ or local files are refused by the engine
itself. Credentials resolve at call time from the target host's env file
or a caller-side sops decrypt, handed over via stdin, never argv.
