Two of these were regressions the previous round introduced.
- The backup root no longer gates startup. Adding it to the mandatory
mkdir + writability preflight broke a supported configuration:
docker-compose.production.yml does not mount /backup, so a hardened non-root
deployment would fail `mkdir -p /backup` against a root-owned / and refuse to
boot over a directory it never needed. It is now adopted only when BACKUP_DIR
is explicitly set (as this image sets it), and the subdirectory creation is
guarded on the root existing.
- Runtime data can no longer leak into the image. Dockerfile.aio builds from the
repository root and Docker reads only the root .dockerignore — backend/
.dockerignore is never consulted — so the unprefixed data/*.db, logs/* and
storage/* rules missed backend/data, backend/logs and backend/storage
entirely. A checkout that had been used to run PicPeak would bake its
database, photos, logs and SETUP_TOKEN into a published layer. This is not
hypothetical: an earlier build in this PR silently picked up a stray
backend/logs the same way.
- HEALTHCHECK follows $PORT. The docs advertise PORT as configurable, and a
hard-coded 3000 marked an otherwise healthy container unhealthy forever the
moment anyone changed it.
- --max-http-header-size=32768 matches nginx's large_client_header_buffers
4 32k. Requests reach Node directly here and its 16 KiB default would reject
a guest carrying several per-gallery JWT cookies before Express saw them.
Verified: clean image carries no /app/data/*.db, /app/logs or /app/storage;
default container healthy; PORT=8080 container healthy with the probe following
it; pid 1 shows the header flag in place.
Paul Nothaft
4111d3234f