… knobs

Make the two env vars from #586 discoverable and scope-warn (host-mode
only) in the authoritative container doc.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

… networking

The host-networking note already warns that --network=host exposes the
container ports on the host; point to the BACKEND_HOST/FRONTEND_HOST env vars
(added in #586) as the loopback-only mitigation, with details in
CONTAINERIZATION.md.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

…ss keep-id

Removes `user=root` from the [supervisord] section in both production and
development supervisord configs, and rewrites the entrypoint comment to
explain why.

Background: under rootless podman + userns_mode: keep-id, container PID 1
runs as the host user (UID 1000) instead of root. The previous design
explicitly forced supervisord to drop privileges to root (`user=root`),
which works under rootful daemons (PID 1 is root, has CAP_SETUID) but
fails under rootless + keep-id — supervisord sees `user=root` in its
config, tries to setuid(0), lacks CAP_SETUID, and exits with
"Error: Can't drop privilege as nonroot user" (per supervisord
options.py: refuses to drop privileges when not running as root).

Fix: omit `user=` from the [supervisord] section so supervisord inherits
PID 1's UID (root in rootful; UID 1000 in rootless + keep-id). The
backend and frontend programs still drop to the unprivileged deeptutor
user via per-program `user=deeptutor` — setuid(1000) works because
either PID 1 is root (rootful) or PID 1 is already UID 1000 (rootless
keep-id, where the setuid is a no-op). /dev/fd/1,2 ownership matches
PID 1's UID in both runtimes, so supervisord's stdout/stderr writes
succeed without an explicit setuid dance.

Verified locally: clean heredoc indentation; supervisord config parses;
both [supervisord] sections confirmed without `user=root`.

Closes the rootless-podman + read-only-rootfs follow-up to PR #577
(reported by the user after #577 + #586 merged).

feat(docker): make BACKEND_HOST and FRONTEND_HOST env-configurable

Two opt-in env vars (default 0.0.0.0, non-breaking) let host-network
deployments pin uvicorn and Next.js to a specific bind address — e.g.
127.0.0.1 to keep both off the host LAN when running network_mode: host.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

… knobs

Make the two env vars from HKUDS#586 discoverable and scope-warn (host-mode
only) in the authoritative container doc.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

… networking

The host-networking note already warns that --network=host exposes the
container ports on the host; point to the BACKEND_HOST/FRONTEND_HOST env vars
(added in HKUDS#586) as the loopback-only mitigation, with details in
CONTAINERIZATION.md.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

…ss keep-id

Removes `user=root` from the [supervisord] section in both production and
development supervisord configs, and rewrites the entrypoint comment to
explain why.

Background: under rootless podman + userns_mode: keep-id, container PID 1
runs as the host user (UID 1000) instead of root. The previous design
explicitly forced supervisord to drop privileges to root (`user=root`),
which works under rootful daemons (PID 1 is root, has CAP_SETUID) but
fails under rootless + keep-id — supervisord sees `user=root` in its
config, tries to setuid(0), lacks CAP_SETUID, and exits with
"Error: Can't drop privilege as nonroot user" (per supervisord
options.py: refuses to drop privileges when not running as root).

Fix: omit `user=` from the [supervisord] section so supervisord inherits
PID 1's UID (root in rootful; UID 1000 in rootless + keep-id). The
backend and frontend programs still drop to the unprivileged deeptutor
user via per-program `user=deeptutor` — setuid(1000) works because
either PID 1 is root (rootful) or PID 1 is already UID 1000 (rootless
keep-id, where the setuid is a no-op). /dev/fd/1,2 ownership matches
PID 1's UID in both runtimes, so supervisord's stdout/stderr writes
succeed without an explicit setuid dance.

Verified locally: clean heredoc indentation; supervisord config parses;
both [supervisord] sections confirmed without `user=root`.

Closes the rootless-podman + read-only-rootfs follow-up to PR HKUDS#577
(reported by the user after HKUDS#577 + HKUDS#586 merged).