photoanalyzer/delivery_backlog/E08-container-deployment.md

E08 — Container Deployment

Concept phase: none. This epic is a delivery-format addition on top of the concept: the same application, same safety invariants, packaged as a Docker image and deployed continuously from Gitea Actions instead of being started by hand from a working copy.

It does not change the product scope in INTEGRATED_PIPELINE_CONCEPT.md. SQLite stays the store, one worker stays the writer, the library process lock stays authoritative, and no path outside the configured library roots becomes reachable because the process now runs in a container.

One decision does extend the concept and is made here explicitly: the application may be reached through a reverse proxy under a real hostname, not only over loopback. That requires a configurable trust boundary and an authentication gate, because the loopback-only checks of US07-02 are what currently stand in for authentication.

Stories

1. US08-01 — Make the trust boundary configurable and authenticated
2. US08-02 — Build a reproducible application image
3. US08-03 — Compose the runtime and mount the library safely
4. US08-04 — Publish and deploy from Gitea Actions
5. US08-05 — Automate container deployment acceptance

Epic outcome

A tagged image built from main runs the API and the worker as separate containers against a mounted library and a persistent data volume, is published to the Gitea registry, is redeployed by webhook, survives restart and upgrade with its database and journals intact, and refuses every request that a loopback deployment would have refused.