- Require ADMIN_PASSWORD and the database password to be provided explicitly
(no implicit fallback).
- Default TRUST_PROXY to false.
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Two related operator-facing docs gaps, both surfaced by #7819:
1. settings.json on disk is a *template*; env-var substitution happens
at load time in memory only. Operators repeatedly mistake the
templated file for a stale config because the docs never spell out
that the on-disk file is intentionally unchanged by env vars.
2. The default docker-compose.yml puts settings.json in the container's
writable layer with no host mount, which means admin /settings edits
are silently lost on `docker compose down && up`, `pull`, or
watchtower — but preserved across plain `restart`. Operators don't
reliably know which compose verbs recreate the container.
Adds two prose sections to doc/docker.md (explaining both gotchas, with
a recreate-vs-restart table) and a commented-out `./settings.json:…`
bind mount in both docker-compose.yml and the README compose example.
Bind mount is opt-in so existing setups behave identically.
No runtime change.
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Change the Docker Compose user from "0:0" (root) to "5001:0" (etherpad user)
to follow security best practices and the principle of least privilege.
The Dockerfile already creates a non-root user 'etherpad' with UID 5001
and GID 0, so this change aligns the docker-compose.yml configuration
with the Dockerfile's security model.
Benefits:
- Reduces attack surface by not running as root
- Follows Docker security best practices
- Aligns with the Dockerfile's existing non-root user setup
- Compatible with OpenShift and other platforms that restrict root containers
- Maintains group permissions (GID 0) for volume access
Fixes#7134
* fix bin folder and workflows as far its possible
cleanup of dockerfile
changed paths of scripts
add lock file
fix working directory for workflows
fix windows bin
fix travis (is travis used anyway?)
fix package refs
remove pnpm-lock file in root as these conflicts with the docker volume setup
optimize comments
use install again
refactor prod image call to run
fix --workspace can only be used inside a workspace
correct comment
try fix pipeline
try fix pipeline for upgrade-from-latest-release
install all deps
smaller adjustments
save
update dockerfile
remove workspace command
fix run test command
start repair latest release workflow
start repair latest release workflow
start repair latest release workflow
further repairs
* remove test plugin from docker compose
