sync: update from private repo (e62f5c7)

Dockerfile

@@ -16,10 +16,17 @@ RUN npm --prefix ui ci --ignore-scripts
 # npm の @novnc/novnc は lib のみで vnc.html を含まないため、
 # Browser タブの iframe 用に GitHub から tarball を取得する。
 ARG NOVNC_VERSION=1.6.0
+# Pinned SHA256 of the v${NOVNC_VERSION} source tarball. Verify the integrity of
+# the download before extracting so a compromised/MITM'd tarball can't inject
+# code into the image. To bump NOVNC_VERSION, recompute via:
+#   curl -fSL "https://github.com/novnc/noVNC/archive/refs/tags/v<ver>.tar.gz" | sha256sum
+ARG NOVNC_SHA256=5066103959ef4e9b10f37e5a148627360dd8414e4cf8a7db92bdbd022e728aaa
 RUN apk add --no-cache --virtual .novnc-fetch curl tar \
     && mkdir -p /app/vendor/noVNC \
-    && curl -fSL "https://github.com/novnc/noVNC/archive/refs/tags/v${NOVNC_VERSION}.tar.gz" \
-        | tar -xz -C /app/vendor/noVNC --strip-components=1 \
+    && curl -fSL "https://github.com/novnc/noVNC/archive/refs/tags/v${NOVNC_VERSION}.tar.gz" -o /tmp/novnc.tar.gz \
+    && echo "${NOVNC_SHA256}  /tmp/novnc.tar.gz" | sha256sum -c - \
+    && tar -xz -C /app/vendor/noVNC --strip-components=1 -f /tmp/novnc.tar.gz \
+    && rm -f /tmp/novnc.tar.gz \
     && test -f /app/vendor/noVNC/vnc.html \
     && apk del .novnc-fetch
 
@@ -104,8 +111,14 @@ COPY config.yaml.example ./config.yaml
 RUN mkdir -p /app/data /workspaces \
     && chown -R node:node /app/data /workspaces config.yaml
 
+# HOST=0.0.0.0 is required INSIDE the container so the published port is
+# reachable. This is safe because docker-compose maps it to 127.0.0.1:9876 on
+# the host — the container is not exposed to the LAN unless the operator changes
+# that mapping. The app's own default (when HOST is unset, e.g. bare-metal) is
+# 127.0.0.1; see createCoreServer in src/bridge/server.ts.
 ENV NODE_ENV=production \
     PORT=9876 \
+    HOST=0.0.0.0 \
     DB_PATH=/app/data/maestro.db
 
 EXPOSE 9876