Docker: a build context that isn't 3.6GB, and health you can see

The all-in-one image builds from the project root, and Docker only reads
.dockerignore from the context root — so the ones under "API Server" and
"Web App" never applied to it and every AIO build shipped the whole tree,
"Phone App/build" included. A root .dockerignore allow-lists the paths that
build actually copies.

The dev split stack passed neither PB_BOOTSTRAP nor the SUPERADMIN vars, so
it created the schema and then no user to log in with. It passes them now,
and .env.example says so.

WEBAPP_URL was never set anywhere, leaving the panel status page probing
localhost:8090 — itself — and always reporting the Web App as down. Each
compose file now points it at wherever the Web App really is, and the BFF
grew a real /healthz instead of letting the SPA fallback answer probes with
index.html and look healthy no matter what.

In the AIO, PocketBase and the API Server drop to an unprivileged user;
only nginx stays root to bind :80. The entrypoint takes ownership of the
two volumes first, so data written by the old root-only image stays
writable. All three images carry a HEALTHCHECK, every compose file declares
one too (so depends_on still gates against an older pulled image), and
web-app waits for the API Server to be serving rather than merely started.

Also: pinned alpine/golang/node and PocketBase 0.39.11, so a rebuild months
from now produces the same image; nginx forwards WebSocket upgrades instead
of stripping them, with the map in http.d where Alpine actually reads it;
and a .gitattributes keeps entrypoint.sh on LF, because a CRLF shebang from
a Windows clone fails at container start with "no such file or directory".

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Web App/Dockerfile

@@ -8,7 +8,7 @@
 #   Build context is the "Web App" directory (see Docker/docker-compose.yml).
 
 # --- Stage 1: build the Vue SPA ---------------------------------------------
-FROM node:22-alpine AS web-build
+FROM node:22-alpine3.24 AS web-build
 WORKDIR /web
 COPY web/package.json web/package-lock.json ./
 RUN npm ci
@@ -23,7 +23,7 @@ ENV VITE_API_BASE=${VITE_API_BASE}
 RUN npm run build -- --outDir dist --emptyOutDir
 
 # --- Stage 2: build the Go BFF, embedding the SPA ---------------------------
-FROM golang:1.26-alpine AS server-build
+FROM golang:1.26-alpine3.24 AS server-build
 WORKDIR /src
 COPY server/go.mod ./
 # go.sum is optional (stdlib-only module today); copy it if present.
@@ -35,7 +35,7 @@ COPY --from=web-build /web/dist ./dist
 RUN CGO_ENABLED=0 GOOS=linux go build -trimpath -ldflags="-s -w" -o /out/web-bff .
 
 # --- Runtime stage ----------------------------------------------------------
-FROM alpine:latest
+FROM alpine:3.24
 RUN apk add --no-cache ca-certificates tzdata \
     && addgroup -S app && adduser -S -G app app
 
@@ -48,4 +48,11 @@ ENV WEB_ADDR=:8090 \
 EXPOSE 8090
 
 USER app
+
+# /healthz is a real route on the BFF (not the SPA fallback), so this fails if
+# the server stops serving. It deliberately does not probe API_BASE: an API
+# Server outage should surface on the panel status page, not kill this container.
+HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
+    CMD wget -qO- http://127.0.0.1:8090/healthz >/dev/null 2>&1 || exit 1
+
 ENTRYPOINT ["/app/web-bff"]

Web App/server/main.go

@@ -55,6 +55,16 @@ func main() {
 
 	mux := http.NewServeMux()
 	mux.Handle("/api/", proxy)
+
+	// Liveness probe. The API Server polls this for the panel status page (see
+	// WEBAPP_URL), and container healthchecks use it. It must be a real route:
+	// without one the SPA catch-all below would answer with index.html, which
+	// looks healthy even when the proxy target is misconfigured.
+	mux.HandleFunc("/healthz", func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "text/plain; charset=utf-8")
+		w.WriteHeader(http.StatusOK)
+		_, _ = w.Write([]byte("ok"))
+	})
 	mux.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
 		// Serve static assets when they exist; otherwise fall back to index.html
 		// so client-side routing works on deep links.