HEL-270: 验收物料——非root加固、备份/巡检脚本、运维手册、修复 reminders 布局冒烟测试

Co-authored-by: multica-agent <github@multica.ai>

deploy/Dockerfile

@@ -1,23 +1,32 @@
-FROM python:3.12-slim
+FROM python:3.12-slim-bookworm
+
+ENV PYTHONDONTWRITEBYTECODE=1 \
+    PYTHONUNBUFFERED=1 \
+    PYTHONPATH=/app/src \
+    APP_HOST=0.0.0.0 \
+    APP_PORT=4173 \
+    APP_DB_PATH=/app/data/app.db \
+    APP_STORAGE_DIR=/app/data/files
 
 WORKDIR /app
 
-COPY requirements.txt .
-RUN pip install --no-cache-dir -r requirements.txt
+RUN groupadd --system --gid 10001 app \
+    && useradd --system --uid 10001 --gid app --home-dir /app --shell /usr/sbin/nologin app \
+    && mkdir -p /app/data \
+    && chown -R app:app /app
 
-COPY server.py ./
-COPY src ./src
-COPY web ./web
+COPY --chown=app:app requirements.txt ./
+RUN python -m pip install --no-cache-dir --requirement requirements.txt
 
-ENV PYTHONPATH=/app/src
-ENV APP_HOST=0.0.0.0
-ENV APP_PORT=4173
-ENV APP_DB_PATH=/app/data/app.db
-ENV APP_STORAGE_DIR=/app/data/files
+COPY --chown=app:app server.py ./
+COPY --chown=app:app src ./src
+COPY --chown=app:app web ./web
+
+USER app
 
 EXPOSE 4173
 
-HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
-  CMD python -c "import urllib.request; urllib.request.urlopen('http://127.0.0.1:4173/', timeout=4)"
+HEALTHCHECK --interval=15s --timeout=3s --start-period=10s --retries=5 \
+    CMD ["python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:4173/', timeout=2)"]
 
 CMD ["python", "server.py"]