feat: use host bind mounts for persistent data

2026-06-25 10:12:41 +02:00
parent c66dd7e511
commit 0a590989bb
12 changed files with 232 additions and 42 deletions
@@ -21,6 +21,9 @@
 - Containers are not privileged and do not use host networking or the Docker socket.
  WordPress/Apache retains the capabilities needed by the official image internally,
  but no WordPress port is published.
+- Persistent state uses host-based bind mounts. Keep those paths outside the public web
+  root, restrict host access, never make them world-writable, and run
+  `./scripts/prepare-host-volumes.sh` when paths or image user IDs change.
 - WordPress/Apache access logs are disabled to avoid duplicate client metadata and
  healthcheck noise; NGINX remains the single request log and PHP warnings/errors stay
  visible.