- Drop --init so the image supervisor stays namespace PID 1, as the
runtime handoff requires; add --memory-swap=1g and nosuid,nodev tmpfs
options to match the runtime's tested launch flags.
- Mount only frontend css/, js/ and vendor/ at the root origin so
index.html's relative asset paths resolve; dev/tests are not exposed.
- Add X-Content-Type-Options: nosniff to every response.
- Add CONFLUENCE_WEB_CONFLUENCE_PROXY (socks5/http, Confluence only) and
CONFLUENCE_WEB_MODEL_TIMEOUT_SECONDS; disable environment proxy
inheritance for both upstream clients; add socksio dependency.
Artur Mukhamadiev
45e6487831