4 commits

Author	SHA1	Message	Date
catborise	57cbe5b63b	fix(docker): the database, secret key and settings are private to the app user in the container	2026-10-07 18:48:28 +03:00
catborise	d9112b797f	fix(console): fix novncd startup in container and prevent double slashes in websocket url	2026-09-25 23:11:52 +03:00
catborise	7435d66492	fix(security): resolve reviewer findings on secret key baking, host symlinks, and injection safety ... - Prevent baking SECRET_KEY into Docker image during collectstatic - Persist runtime SECRET_KEY in data/secret_key volume or read from environment - Remove sed-based injection of CSRF_TRUSTED_ORIGINS in favor of native os.getenv - Avoid overwriting system python3 symlink on SUSE; auto-detect python 3.10+ binaries - Make /etc/hosts entry in installer idempotent - Add security notice regarding compute node VNC/SPICE port firewall isolation	2026-09-25 22:06:16 +03:00
catborise	b1a843e846	feat(docker): modernize Dockerfile, add runit init script, and provide docker-compose setup ... - Add python3-libvirt to apt and configure --system-site-packages for zero-compilation build - Introduce 10_webvirtcloud_init.sh to handle container startup, migrations, and SQLite persistence - Exclude host settings.py in .dockerignore for clean builds from settings.py.template - Add docker-compose.yml with persistent data and SSH volume mounts - Document Docker Compose deployment in README.md	2026-09-25 21:58:19 +03:00