start project

frontend/Dockerfile

@@ -29,6 +29,9 @@ FROM nginx:1.27-alpine AS runtime
 
 RUN rm -rf /usr/share/nginx/html/* /etc/nginx/conf.d/default.conf
 COPY frontend/nginx.conf /etc/nginx/conf.d/app.conf
+# Included by the location blocks in app.conf - see each file's own comment.
+COPY frontend/security-headers.conf /etc/nginx/conf.d/security-headers.conf
+COPY frontend/proxy-backend.conf /etc/nginx/conf.d/proxy-backend.conf
 COPY --from=builder /app/dist /usr/share/nginx/html
 
 # nginx:alpine already ships an unprivileged "nginx" user; the official
@@ -39,5 +42,7 @@ RUN touch /var/run/nginx.pid \
 USER nginx
 EXPOSE 8080
 
+# 127.0.0.1, not localhost: nginx listens on IPv4 only, and busybox wget
+# resolves localhost to ::1 first without falling back to IPv4.
 HEALTHCHECK --interval=30s --timeout=4s --start-period=10s --retries=3 \
-    CMD wget -q --spider http://localhost:8080/healthz || exit 1
+    CMD wget -q --spider http://127.0.0.1:8080/healthz || exit 1