CSS: hero h1 used `(100vw - 48px) / 7` on mobile and `-64px / 7` on
tablet — the wider gutter assumption left 12-16px of unused white
space inside the 16px hero padding. Tightened both to `(100vw - 32px)
/ 7` so the wordmark spans the actual hero content area. Divisor 7
preserves the safety margin for the wider "Kammergut" wordmark.
Compose: dropped the `image: kammergut:0.1.0` field. Older Portainer
Compose runtimes (pre-v2.20) ignore `pull_policy: build` and still
ran `compose pull` against the image name, hitting "pull access
denied". Without an image name there's nothing for compose pull to
attempt; build runs during `up`.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Portainer's git-stack deploy runs `docker compose pull` before `up`,
which tried to fetch kammergut:0.1.0 from a registry and got
"pull access denied". The image only exists locally — `pull_policy:
build` tells Compose to build from the Dockerfile instead.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Multi-stage Dockerfile: node:22.13.1-alpine3.21 builds the Vite
bundle, nginx:1.27.4-alpine3.21-slim serves dist/ on container :80.
Compose maps host :4422 to container :80 with a wget healthcheck
and unless-stopped restart policy.
nginx.conf serves Vite's content-addressed /assets/ as immutable,
caches images for 30d, falls back to index.html for SPA routes,
and sets X-Frame-Options / X-Content-Type-Options / Referrer-Policy
/ Permissions-Policy headers. Server tokens off.
.dockerignore keeps the build context lean (no node_modules, dist,
.git, archive, or compose files).
Pin to image digests in Portainer's stack editor for full lock.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
