[ThisIs-Developer]

Docker HTTP + HTTPS reliability upgrade

Maintains the merged #292 HTTP fix and existing default http://localhost:8080, while adding optional local HTTPS (https://localhost:8443) and public HTTPS (an owned MDV_DOMAIN hostname behind Caddy).

Changes

• Backward compatibility: docker-compose.yml and the internal Nginx port 80 are unchanged. Users can still map alternative host ports such as 8719:80.
• Optional TLS: docker-compose.https.yml for localhost with Caddy's private CA; docker-compose.https-public.yml for publicly trusted ACME certificates, automatic renewal and HTTPS redirection. The application is exposed only to the private Docker network in HTTPS modes.
• Asset integrity: Include browser-drop-source.js, native-markdown-source.js, preview-worker.js, sample.md, and the linked workspace guide. Correct Service Worker critical precache.
• HTTP correctness: Serve .mjs as JavaScript, 404 for missing script/style assets instead of returning an HTML fallback, and revalidate mutable JS/CSS/MJS. Keep inherited CSP and security headers for static responses.
• Maintainability: Move the Docker-specific Nginx config into docker/nginx.conf; update the existing Docker wiki for HTTPS setup, trust, and existing limitations.
• Regression safety: Extend the Docker publishing workflow so actual HTTP and HTTPS deployment tests gate image publishing.

Verified in CI

Docker workflow #1212 — SUCCESS

• Static build and unit tests: 257 passed, 2 skipped, 0 failed.
• Real default Docker image on HTTP 8080: styled editor, Markdown Preview, local resources, Service Worker activation.
• Real Caddy + Docker on HTTPS 8443: styled editor, Markdown Preview, Service Worker activation.
• Browser-to-Caddy TLS validated with the locally generated Caddy root CA (without disabling verification in the TLS chain check).
• HTTP 8080 and HTTPS 8443 simultaneously without a port conflict.
• Verify all Service Worker precache entries and the Markdown sample and Linked Workspace guide serve their real content.
• JavaScript module MIME types, security headers, cache policy, missing asset 404, HTTP-only CSP.
• Public HTTPS Compose configuration and Caddyfile validation (without live certificate issuance).
• Existing Playwright Chromium smoke: 4 passed.
• Docker image build (publish disabled on PRs).
• HTTP/HTTPS browser screenshots uploaded.

Security remediation: Docker Scout report (2026-11-14)

A maintainer-provided Docker Scout SARIF scan of the existing ghcr.io/thisis-developer/markdown-viewer:latest image found 22 OS-package CVEs (1 Critical, 5 High, 6 Medium, 5 Low, 5 Unspecified) in zlib, musl, libxslt, libxml2, and openssl. The report lists vendor fixes for 11, and no fixed version for the 11 libxml2 findings.

Mitigation added to this PR: Switch the app image to the official nginx:1.31.8-alpine3.24-slim, omit unnecessary packaged modules and their libraries, run apk upgrade --no-cache to install available Alpine security updates, and build the audited image with --pull. All Markdown Viewer assets, Nginx settings, and HTTP/HTTPS behavior remain subject to the existing end-to-end tests.

Fresh build evidence: GitHub Actions Docker workflow #1214 — SUCCESS. Complete Trivy JSON scan artifact reports 0 detected CVEs for the rebuilt markdown-viewer:security-audit image (Alpine 3.24.4, scan timestamp 2026-11-14 16:55 UTC). Trivy's release gate for fixable Critical/High CVEs passed. The 257 passing unit tests, 4 browser smoke tests, and HTTP+HTTPS image integration tests also passed. Windows Native Runtime Demo workflow passed.

Important limits: Trivy and Docker Scout use different advisory databases and may not agree exactly. The new image was not independently rescanned with Docker Scout, and the public latest tag still points to the earlier build until this PR is merged and published. The Caddy proxy is a separate image not covered by the Markdown Viewer image result. Zero known CVEs in one scan does not mean zero security risk, and new CVEs can emerge.

Independent Docker Scout verification: 6 reported findings remaining

After the successful Trivy scan, the maintainer rebuilt PR #294 as markdown-viewer:security-test on linux/amd64 and ran docker scout cves. Docker Scout v1.28.0 reported 6 CVEs across 2 packages (0 Critical, 1 High, 0 Medium, 0 Low, 5 Unspecified), image digest prefix 241b1048f4a7, 26 packages, 7.0 MB. Do not describe the patched image as CVE-free across scanners.

• CVE-2026-107891 — musl 1.2.6-r3: Docker Scout flags it as High and suggests 1.2.6-r6. However the Alpine v3.24 OSV security advisory explicitly lists 1.2.6-r3 as fixed, whereas 1.2.6-r6 is the package on Alpine edge. This is a probable cross-branch false positive. Sources: Alpine OSV and Alpine v3.24 package listing.
• Five OpenSSL findings — openssl 3.5.9-r0: CVE-2026-95692, CVE-2026-95691, CVE-2026-88823, CVE-2026-88822, and CVE-2026-107496. Alpine v3.24 currently lists 3.5.9-r0, while 3.5.9-r1 is available in edge. OpenSSL published its upstream security advisory on November 10, 2026. The Alpine stable branch has not yet published this release update; these remain outstanding vendor-package findings. Sources: Alpine v3.24 openssl, edge openssl, and OpenSSL advisory timeline.
• Remediation posture: Keep apk upgrade --no-cache and the official slim stable base so future stable security backports are picked up on clean rebuild. Do not install edge packages into stable, falsify installed package metadata, or suppress actual OpenSSL findings to reach a misleading zero count. Rebuild and retest once Alpine v3.24 publishes a corrected OpenSSL package; evaluate exposure separately for the Docker HTTP-only Nginx and separately for the optional Caddy TLS proxy.
• Scanning limitation: Trivy CI's zero and the local Docker Scout six are both real reported outcomes from different tools/advisory databases; the CI's fixable Critical/High gate is not a guarantee of zero findings in Docker Scout. The reported OpenSSL CVEs may not be reachable through this static Nginx deployment, but their presence should still be tracked rather than assumed safe.

Status: The new Docker image passed HTTP/HTTPS browser tests and Trivy CI, but Docker Scout is not clean, and a stable vendor OpenSSL update has not yet been verified. Keep this distinction visible during review.

Deployment boundaries and outstanding validation

• Public TLS certificate issuance/renewal requires a real DNS hostname pointing at the deployment and reachable ports 80/443. It cannot be demonstrated on example.com in CI.
• Local HTTPS uses a Caddy private CA; real browsers/devices need its CA certificate trusted. In CI the Chromium browser has a test-only certificate exception for local CA Service Worker fetches, while a separate curl --cacert check verifies the certificate chain.
• TLS terminates at Caddy. The private Caddy-to-Nginx Docker network hop is HTTP; this is not end-to-end TLS on every hop.
• Raspberry Pi/ARM64 hardware, LAN proxies, custom domains and all browser/version combinations have not been physically tested, so zero-bug/enterprise-security guarantees are not claimed.
• main and ghcr.io/...:latest remain unchanged until this PR is merged and the normal publishing workflow runs.

Related to #290; does not reopen/change the already merged minimal PR #292.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
markdown-viewer	Ready	Preview	Nov 14, 2026 4:53pm UTC

[cloudflare-workers-and-pages]

Deploying markdownviewer with    Cloudflare Pages

Latest commit:	a53f742
Status:	✅  Deploy successful!
Preview URL:	https://00645c8b.markdownviewer.pages.dev
Branch Preview URL:	https://feature-docker-http-https-re.markdownviewer.pages.dev

View logs