Image
A multi-stage build tests the source and produces a non-root runtime image with Uvicorn, static assets, and health checks.
FRAME DOCUMENTATION
Container deployment
The public website is built, tested, shipped, and operated as an immutable Docker image.
TLS
The runtime reads host-managed Let’s Encrypt certificates from a read-only bind mount and serves TLS directly.
State
Rate limits and audit state live in one explicitly writable host directory. The remainder of the container filesystem is read-only.
Delivery
GitLab builds the image, pushes exact commit tags to both registries, verifies a candidate container, and performs rollback-aware production cutover.