Docker: a build context that isn't 3.6GB, and health you can see

The all-in-one image builds from the project root, and Docker only reads
.dockerignore from the context root — so the ones under "API Server" and
"Web App" never applied to it and every AIO build shipped the whole tree,
"Phone App/build" included. A root .dockerignore allow-lists the paths that
build actually copies.

The dev split stack passed neither PB_BOOTSTRAP nor the SUPERADMIN vars, so
it created the schema and then no user to log in with. It passes them now,
and .env.example says so.

WEBAPP_URL was never set anywhere, leaving the panel status page probing
localhost:8090 — itself — and always reporting the Web App as down. Each
compose file now points it at wherever the Web App really is, and the BFF
grew a real /healthz instead of letting the SPA fallback answer probes with
index.html and look healthy no matter what.

In the AIO, PocketBase and the API Server drop to an unprivileged user;
only nginx stays root to bind :80. The entrypoint takes ownership of the
two volumes first, so data written by the old root-only image stays
writable. All three images carry a HEALTHCHECK, every compose file declares
one too (so depends_on still gates against an older pulled image), and
web-app waits for the API Server to be serving rather than merely started.

Also: pinned alpine/golang/node and PocketBase 0.39.11, so a rebuild months
from now produces the same image; nginx forwards WebSocket upgrades instead
of stripping them, with the map in http.d where Alpine actually reads it;
and a .gitattributes keeps entrypoint.sh on LF, because a CRLF shebang from
a Windows clone fails at container start with "no such file or directory".

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Docker-AIO/docker-compose.yml

@@ -12,9 +12,11 @@ services:
       dockerfile: Docker-AIO/Dockerfile
       args:
         # Empty -> bundle uses same-origin "/api", proxied internally by nginx.
-        VITE_API_BASE: "${VITE_API_BASE:-}"
-        # Optional: pin PocketBase; empty fetches the latest release at build.
-        PB_VERSION: "${PB_VERSION:-}"
+        - VITE_API_BASE=${VITE_API_BASE:-}
+        # Bare name = pass through only when set in the environment, so an unset
+        # PB_VERSION leaves the Dockerfile pin in place instead of overriding it
+        # with an empty string (which would resolve "latest" at build time).
+        - PB_VERSION
     image: drivervault-aio
     container_name: drivervault-aio
     restart: unless-stopped
@@ -24,6 +26,9 @@ services:
       PB_ADMIN_PASSWORD: "${PB_ADMIN_PASSWORD:?set PB_ADMIN_PASSWORD in .env}"
       # Match CORS to the web origin (only used if a browser calls the API directly).
       CORS_ALLOW_ORIGINS: "${CORS_ALLOW_ORIGINS:-http://localhost:8090}"
+      # Probed by the panel status page. nginx serves the Web App on port 80
+      # inside this container, so the default (localhost:8090) would never answer.
+      WEBAPP_URL: "http://127.0.0.1:80"
       # Schema + super-admin bootstrap on boot (idempotent). Set PB_BOOTSTRAP=false
       # to skip once the database is established.
       PB_BOOTSTRAP: "${PB_BOOTSTRAP:-true}"
@@ -44,6 +49,14 @@ services:
       - pb_data:/pb/pb_data
       # plugins.json + the .env the panel writes back.
       - api_data:/data
+    healthcheck:
+      # All three processes must answer. Declared here as well as in the image so
+      # the check is visible, and works against an older pulled image.
+      test: ["CMD-SHELL", "wget -qO- http://127.0.0.1:8070/api/health >/dev/null && wget -qO- http://127.0.0.1:8080/healthz >/dev/null && wget -qO- http://127.0.0.1:80/healthz >/dev/null || exit 1"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 60s
 
 volumes:
   pb_data: