[Danidapena]

Adds lightning-containers: push Docker images to a teamspace's private litcr.io registry with lightning container, run them as jobs, deployments and sandboxes or pull them with plain docker, and list, check and clean up registry images. Also adds the skill to the README table and .claude-plugin/plugin.json.

Tested against

Prod lightning.ai, lightning-sdk 2026.10.13, teamspace lightningai-engineering/general. Everything pushed or launched was deleted afterwards.

Step	Result
container upload / list --json	pushed a 2 MB busybox image; listed as {"repository":"skilltest-cr","latest_tag":"v1",...}
docker login litcr.io (username + API key), docker pull	Login Succeeded, pulled and ran the image
lightning job run --image litcr.io/lit-container/.../skilltest-cr:v1 --machine CPU	Completed, with no image credentials passed
Artifacts API, delete by digest	location matches the pushed URL; deleting v1 by digest kept v2
container delete -y	removed every tag of the repository

Gotchas found while testing

These look like SDK bugs; the skill documents workarounds for now.

• A failed container upload exits 0. A missing image only prints Error: Container <name>:<tag> does not exist on the progress line.
• container download fails for any tag other than latest: it pulls the image, then retags <url> with no tag, which means :latest, and exits 1 with ImageNotFound: 404.
• docker pull right after a successful upload is refused as unauthorized, because the CLI's login stays inside its own process.
• GET .../lit-registry/<repo>/artifacts returns the newest version only in latestArtifact, not in artifacts.

Not live-tested

These are taken from the grid backend and SDK code:

• Deployments pull litcr.io images with automatic credentials. This matches feat(deployments): teamspace storage, the teamspace registry, and replicas that never start #44.
• Sandboxes need a SECRET_TYPE_DOCKER_REGISTRY secret; the payload shape comes from external_secret.go. Creating a sandbox here needed a teamspace-scoped key.
• container list without --cloud-account lists the default cloud account's registry when that account is BYOC.

_{— Claude Opus 5.5, on direct instruction; text not reviewed}