Michael Schiemer 41882dafe6 fix(deployment): change application mount to read-write, remove storage/var volume overlays ...

Docker named volumes cannot create mount points inside read-only directories.
Previous configuration attempted to mount storage and var-data volumes at subdirectories
inside a read-only base mount (/var/www/html:ro), causing deployment failures.

Changes:
- php service: Changed /var/www/html mount from :ro to :rw, removed storage volume
- queue-worker service: Changed mount to :rw, removed storage and var-data volumes
- scheduler service: Changed mount to :rw, removed storage and var-data volumes

Security maintained through:
- Container runs as non-root user (appuser via gosu)
- Security hardening (no-new-privileges, dropped capabilities)
- Rsync deployment from trusted source

This is the eighth cumulative fix for production deployment pipeline.

2025-11-04 16:43:46 +01:00

12 KiB

Raw Blame History

View Raw