Fix Docker build layout.

docs/storage-transfer.md

@@ -117,23 +117,12 @@ STS_AGENT_POOL=my-agents
 HOSTNAME=agent-host
 ```
 
-The image of Google lacks the shared glibc libraries that the `cryptography` package needs for certificate-based authentication. The agent launcher is statically linked with GRTE v5, the Google Run Time Environment based on glibc 2.27, which loads shared libraries from `/usr/grte/v5/lib64`. The libraries must come from the same GRTE build, because GRTE changes internal structures of the dynamic loader. `sts-agent/build-grte.sh` builds them from the GRTE v5 source at `https://third-party-mirror.googlesource.com/GRTEv5` in a temporary `ubuntu:18.04` container, and `sts-agent/Dockerfile` adds them to the image.
-
-Build the GRTE v5 libraries into `sts-agent/grte`:
-
-```bash
-cd sts-agent
-docker run --rm --security-opt apparmor=unconfined \
-    -v "$PWD/build-grte.sh:/build-grte.sh:ro" \
-    -v "$PWD/grte:/out" \
-    ubuntu:18.04 /build-grte.sh
-```
-
-`--security-opt apparmor=unconfined` is needed only where Docker cannot load its AppArmor profile, for example inside an LXC container.
+The image of Google lacks the shared glibc libraries that the `cryptography` package needs for certificate-based authentication. The agent launcher is statically linked with GRTE v5, the Google Run Time Environment based on glibc 2.27, which loads shared libraries from `/usr/grte/v5/lib64`. The libraries must come from the same GRTE build, because GRTE changes internal structures of the dynamic loader. The first stage of `sts-agent/Dockerfile` builds them from the GRTE v5 source at `https://third-party-mirror.googlesource.com/GRTEv5` on `ubuntu:18.04`, and the second stage adds them to the image of Google.
 
 Build the image and start the agent:
 
 ```bash
+cd sts-agent
 docker compose build
 docker compose up -d
 ```