Work with nate to improve the makefile

[gvegayon]

This pull request includes updates to the Docker setup and documentation for building and running container images. The most important changes include updating the Dockerfile-dependencies, modifying the Makefile to add new targets and environment variables, and adding a new section in the README.md to document the container images and their usage.

Changes to Docker setup:

• Dockerfile-dependencies: Updated the base image reference to include the full path docker.io/rocker/geospatial:4.4.1.

• Makefile: Added new targets (deps, tag, interactive) and environment variables (TAG, REGISTRY) for building and managing container images.

Documentation updates:

• README.md: Added a new section to document the container images, including instructions for building and running the images locally and using the Makefile targets.

[natemcintosh]

I'll wait for Zack to give the ok, but I think is otherwise ready to go

[zsusswein]

Sorry meant to post this comment with the review.

I like all the functionality that's here. A couple of additional things to think through:

1. Can you add a pull recipe to get the image from ACR? We have secrets in key vault accessible in the NNH cli if they're needed.
2. Can you think about the pros/cons of defaulting to podman locally and docker in CI? I'm a little uncomfortable with it, but want to talk about any benefits you may be seeing.

[natemcintosh]

I pushed a few changes. One was to replace the -v format for bind mounting with the --mount format; slightly longer, but also more explicit

[natemcintosh]

Can you add a pull recipe to get the image from ACR? We have secrets in key vault accessible in the NNH cli if they're needed.

Yea, are you thinking just the deps image? The main image? both?

Can you think about the pros/cons of defaulting to podman locally and docker in CI? I'm a little uncomfortable with it, but want to talk about any benefits you may be seeing.

Hmmm, we might have to ask @gvegayon for his experience with this so far. George, you have used this pattern of using podman locally and docker in CI before, correct? In my personal experience so far, it has been fine.

Laying out a few scenarios I can imagine:

1. Best case scenario. No issues at all, everything runs fine forever.
2. Meh case scenario. We notice some differences fairly quickly, and change the default in the Makefile to docker.
3. Worst case scenario. There are near invisible differences in the images and/or behavior of the two. This goes on for some time before we notice the differences. This seems unlikely, but perhaps not impossible.
   1. In the best case for this scenario, our production runs were always done using image built in CI with docker, so all of our production runs are consistent. We discovered the issue because our local/prod runs weren't matching perfectly. We change the Makefile to use docker.
   2. In the worst case for this scenario, we had some production days where we had to make some quick bug fixes locally, and then pushed our podman-built image to be run, and the differences make it into our production runs.

Scenario 3ii seems highly unlikely, but would be a huge PITA. I'd probably put that scenario at a "Medium" on the risk matrix: rare, but critical in severity. Since the fix for this would be to simply use docker in the Makefile, I think we should go with that.

[zsusswein]

Yea, are you thinking just the deps image? The main image? both?

For sure the deps image -- maybe both?

Meh case scenario. We notice some differences fairly quickly, and change the default in the Makefile to docker.

This has been my experience. I had to work around podman being unable to access ACR without a password login. Which we can now do (https://github.com/cdcent/nnh-cli-tools/pull/9). Not a big deal, but hitting a difference almost immediately doesn't make me confident it's truly a "drop in replacement"