v0.24.5

docs/CONTAINER.md

@@ -0,0 +1,43 @@
+# Container / OCI deployment
+
+RustProxy ships a baseline multi-stage `Dockerfile`. It compiles the locked Rust
+release and runs it as the unprivileged `rustproxy` user (UID 10001). The core image does
+not mount the Docker socket. Docker discovery uses the separate `docker-agent/` process on
+each Docker host, so the proxy container never needs Docker-socket access. See
+[Docker discovery](DOCKER_DISCOVERY.md).
+
+Build locally with a normal OCI builder:
+
+```bash
+docker build -t rustproxy:0.22.3 .
+```
+
+Persist `/var/lib/rustproxy`; it contains the SQLite database, certificates and the
+optional cold-cache tier. The default container proxy listener is `0.0.0.0:8080`.
+Administration remains `127.0.0.1:9090` inside the container and is intentionally
+not remotely reachable by merely publishing port 9090.
+
+```bash
+docker volume create rustproxy-data
+docker run --rm -d --name rustproxy \
+  -p 8080:8080 \
+  -v rustproxy-data:/var/lib/rustproxy \
+  rustproxy:0.22.3
+
+docker exec rustproxy rust-proxy admin setup-token
+```
+
+To expose administration, first enable administration HTTPS in the persisted
+RustProxy configuration and choose a certificate, then bind the administration
+listener to a non-loopback address. Publish the admin port only after HTTPS is
+active. Plain remote HTTP keeps the legacy explicit risk gate.
+
+The runtime image includes Python, Certbot and OpenSSL for the built-in HTTP-01
+certificate helper. Provider-specific Certbot DNS plugins are not installed in the
+baseline image; extend the image with the required plugin package before using a DNS
+provider.
+
+For access-log files, prefer a writable path under `/var/lib/rustproxy` or mount a
+separate writable log volume. The built-in JSON file sink is disabled by default.
+Low ports such as 80/443 require an explicit container capability or host port
+mapping; the image itself does not run as root.