From nanocode.sh

scripts/nanocode.sh was the original host-install script; it is kept in the repo verbatim as a porting reference. What moved where:

nanocode.sh (host install)	here
NVMe layout	opt-in --disk via data-root, no rsync/symlink
Docker	setup.sh step 2
NVIDIA driver + resume	step 3 with --nvidia; reboot and re-run (no resume unit)
NVIDIA Container Toolkit	same step 3, right after docker
code-server systemd unit	compose service
node / aws / gcloud CLIs on host	image
gemini-cli + bashrc hacks	dropped
grc	dropped (re-add to the image if missed)
cloudflared host binary, token in ps	compose service + TUNNEL_TOKEN env

The security fix that motivated most of the move: nanocode.sh passed secrets as CLI flags, which leaked them into shell history, the resume unit and ps aux. Nothing here does that — secrets arrive as container env vars from .env.