Enhance Docker configuration and build process

- Updated .gitignore to include new data and results directories.
- Modified docker-compose.yml to improve security with read-only settings and added healthcheck configuration.
- Updated Dockerfile to include a healthcheck binary and ensure proper ownership of data directories.
- Enhanced Makefile with new commands for verification and Docker build processes.
- Updated README and operations documentation to reflect changes in Docker setup and usage instructions.
- Adjusted public site test cases for improved accuracy in expected output.

Author: alexy-os

.github/workflows/ci.yml

@@ -0,0 +1,72 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches: [main, master]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  verify:
+    name: Verify and Docker
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      - name: Set up Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+          cache: npm
+
+      - name: Install make
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y make
+
+      - name: Verify (npm + Go tests + ui8px)
+        run: make verify
+
+      - name: Docker build
+        run: make docker-build
+
+      - name: Compose config
+        run: make compose-config
+
+  kics:
+    name: KICS IaC scan
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      security-events: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Install make
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y make
+
+      - name: Run KICS
+        run: make kics
+
+      - name: Upload KICS SARIF
+        if: always()
+        continue-on-error: true
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: kics-results/results.sarif

.gitignore

@@ -1,5 +1,7 @@
 tmp/
 dist/
+data/
+kics-results/
 node_modules/
 .DS_Store
 .manual/

Dockerfile

@@ -37,22 +37,31 @@ WORKDIR /src
 
 COPY --from=assets /src ./
 RUN CGO_ENABLED=0 GOOS=linux go build -ldflags="-s -w" -o /out/gocms ./cmd/server \
-    && mkdir -p /out/data
+    && CGO_ENABLED=0 GOOS=linux go build -ldflags="-s -w" -o /out/healthcheck ./cmd/healthcheck \
+    && mkdir -p /out/data \
+    && chown -R 65532:65532 /out/data
 
 FROM gcr.io/distroless/static-debian12:nonroot
 
 WORKDIR /app
 
 COPY --from=build /out/gocms /gocms
-COPY --from=build --chown=nonroot:nonroot /out/data /data
+COPY --from=build /out/healthcheck /healthcheck
+COPY --from=build /out/data /data
 COPY --from=assets /src/web/static /app/web/static
 
 ENV APP_BIND=0.0.0.0:8080
 ENV APP_DATA_SOURCE=file:/data/gocms.db
 ENV GOCMS_PRESET=full
 ENV GOCMS_STORAGE_PROFILE=sqlite
 ENV GOCMS_DEPLOYMENT_PROFILE=container
+ENV HEALTHCHECK_URL=http://127.0.0.1:8080/readyz
 
 EXPOSE 8080
 
+USER nonroot:nonroot
+
+HEALTHCHECK --interval=30s --timeout=5s --start-period=15s --retries=3 \
+    CMD ["/healthcheck"]
+
 ENTRYPOINT ["/gocms"]

Makefile

@@ -1,4 +1,4 @@
-.PHONY: run test fmt build deploy docker-ps docker-logs docker-stop
+.PHONY: run test fmt build verify deploy docker-build compose-config kics docker-ps docker-logs docker-stop
 
 run:
 	go run ./cmd/server
@@ -16,7 +16,33 @@ build:
 	npm run build:versioned
 	go build ./cmd/server
 
+verify:
+	npm ci
+	npm run verify
+
+docker-build:
+	docker build -t fastygo/cms:ci .
+
+compose-config:
+	docker compose config
+
+kics:
+	mkdir -p kics-results
+	# On Docker Desktop for Windows, KICS may exit with "download not supported for scheme 'c'"; use WSL or rely on GitHub Actions.
+	docker run --rm \
+		-v "$(CURDIR):/scan:ro" \
+		-v "$(CURDIR)/kics-results:/out" \
+		checkmarx/kics:v2.1.20 scan \
+		-p /scan/Dockerfile \
+		-p /scan/docker-compose.yml \
+		-o /out \
+		--report-formats sarif,json \
+		--silent \
+		--disable-full-descriptions \
+		--fail-on critical,high,medium,low,info
+
 deploy:
+	mkdir -p data
 	docker compose up -d --build cms
 
 docker-ps:

README.md

@@ -91,6 +91,15 @@ Format source:
 gofmt -w ./cmd ./internal
 ```
 
+## Docker
+
+Build and run with Compose (SQLite data under `./data`; see [Operations — Docker Compose](./docs/operations.md#docker-compose-local-and-ssh-hosts) for host permissions and session keys):
+
+```bash
+mkdir -p data
+docker compose up -d --build cms
+```
+
 ## Documentation Map
 
 - [CMS capability overview](./docs/cms-capabilities.md)

cmd/healthcheck/main.go

@@ -0,0 +1,36 @@
+// Package main implements a minimal HTTP client for container HEALTHCHECK.
+// It defaults to the readiness endpoint used by GoCMS in container deployments.
+package main
+
+import (
+	"fmt"
+	"net/http"
+	"os"
+	"strings"
+	"time"
+)
+
+const defaultURL = "http://127.0.0.1:8080/readyz"
+
+func main() {
+	url := strings.TrimSpace(os.Getenv("HEALTHCHECK_URL"))
+	if url == "" {
+		url = defaultURL
+	}
+
+	client := &http.Client{
+		Timeout: 4 * time.Second,
+	}
+
+	resp, err := client.Get(url)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "healthcheck: request failed: %v\n", err)
+		os.Exit(1)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		fmt.Fprintf(os.Stderr, "healthcheck: %s returned %s\n", url, resp.Status)
+		os.Exit(1)
+	}
+}

docker-compose.yml

@@ -5,6 +5,13 @@ services:
     image: fastygo/cms:local
     container_name: fastygo-cms
     restart: unless-stopped
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
+    read_only: true
+    tmpfs:
+      - /tmp
     environment:
       APP_BIND: 0.0.0.0:8080
       APP_DATA_SOURCE: file:/data/gocms.db
@@ -13,10 +20,14 @@ services:
       GOCMS_STORAGE_PROFILE: sqlite
       GOCMS_DEPLOYMENT_PROFILE: container
       GOCMS_SEED_FIXTURES: ${GOCMS_SEED_FIXTURES:-true}
+      HEALTHCHECK_URL: http://127.0.0.1:8080/readyz
     ports:
       - "127.0.0.1:18055:8080"
     volumes:
-      - gocms-data:/data
-
-volumes:
-  gocms-data:
+      - ${GOCMS_DATA_DIR:-./data}:/data
+    healthcheck:
+      test: ["CMD", "/healthcheck"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 25s

docs/operations.md

@@ -103,3 +103,18 @@ SQLite is the first full provider for this pass. Future MySQL/Postgres/Bolt adap
 - audit persistence
 
 Details: [migrations.md](./migrations.md), [cms-capabilities.md](./cms-capabilities.md).
+
+---
+
+## Docker Compose (local and SSH hosts)
+
+The default [`docker-compose.yml`](../docker-compose.yml) binds SQLite data to **`./data`** on the host (`GOCMS_DATA_DIR` overrides the host path). The runtime image uses the distroless **non-root** user (**UID/GID 65532**).
+
+Before the first `docker compose up` on a server:
+
+1. Create the data directory: `mkdir -p ./data` (or your `GOCMS_DATA_DIR`).
+2. Ensure the container user can write the database file: `sudo chown -R 65532:65532 ./data`.
+
+Set a strong **`APP_SESSION_KEY`** in production; do not rely on the development default.
+
+Docker **`HEALTHCHECK`** and Compose **`healthcheck`** call the **`/healthcheck`** helper, which requests **`/readyz`** inside the container (override with **`HEALTHCHECK_URL`** if needed).

internal/infra/features/cms/publicsite_test.go

@@ -122,7 +122,7 @@ func TestPublicSiteUsesRussianAsDefaultWhenAcceptLanguageOmitted(t *testing.T) {
 		}
 		t.Fatalf("expected html lang=ru, body head: %s", head)
 	}
-	for _, want := range []string{"Опубликованная запись", "Новости", "Блог", "Публичный сайт на GoCMS."} {
+	for _, want := range []string{"Опубликованная запись", "Новости", "Блог", "Смотри, что умеет админка GoCMS"} {
 		if !strings.Contains(body, want) {
 			t.Fatalf("expected home to contain %q", want)
 		}
@@ -157,8 +157,8 @@ func TestPublicSiteEnglishLocalePrefixRendersEnglishCopy(t *testing.T) {
 		}
 		t.Fatalf("expected English fixture strings on /en/ home, excerpt: %s", head)
 	}
-	if !strings.Contains(body, "Public site powered by GoCMS.") {
-		t.Fatalf("expected English public fixture home hero headline on /en/")
+	if !strings.Contains(body, "See what GoCMS admin can do") {
+		t.Fatalf("expected English public fixture home intro on /en/")
 	}
 }
 

scripts/check-css-apply-only.mjs

@@ -5,7 +5,7 @@ const roots = ["web/static/css"];
 const bannedDeclaration = /^\s*[a-z-]+\s*:/i;
 let failed = false;
 
-const rawCSSExceptions = new Set(["editor.css"]);
+const rawCSSExceptions = new Set(["editor.css", "tweakcn.css"]);
 
 for (const file of walk(roots)) {
   if (!file.endsWith(".css")) continue;