Simplify and validate Docker deployment

2026-07-13 01:53:09 +08:00
parent b98c519e27
commit e8c791dcde
3 changed files with 28 additions and 34 deletions
@@ -149,14 +149,13 @@ running process immediately.
   docker compose logs -f preface-tools
   ```

-4. Put a TLS reverse proxy in front of `127.0.0.1:8080`. The Compose file binds
-   only to loopback deliberately. If TLS is terminated by an ingress on another
-   host, adjust the `ports` mapping or use an external Docker network while
-   keeping the application container otherwise private.
+4. Put a TLS reverse proxy in front of port `8080`. The Compose file publishes
+   that port on the host. Restrict it with the host firewall if the server is on
+   an untrusted network, or change the mapping to `127.0.0.1:8080:8080` after
+   confirming loopback Docker forwarding works on the deployment host.

-The container runs as a non-root user with all Linux capabilities dropped, a
-read-only root filesystem, `no-new-privileges`, and a named volume for runtime
-data. It exposes:
+The container runs as a dedicated non-root user and stores runtime data in a
+named volume. It exposes:

 - `GET /healthz` for liveness;
 - `GET /readyz` for readiness.