fix: build and permissions

Dockerfile

@@ -1,4 +1,4 @@
-# ---------- 1) Build Composer deps (no scripts; avoids artisan during build) ----------
+# -------- 1) Composer deps (no scripts; avoids artisan during build) --------
   FROM composer:2 AS vendor
   ARG COMPOSER_NO_DEV=1
   WORKDIR /app
@@ -9,15 +9,15 @@
         composer install --prefer-dist --no-progress --no-interaction --no-scripts; \
       fi
   
-  # ---------- 2) Bring in app sources ----------
+  # -------- 2) App source --------
   FROM alpine:3.20 AS app_src
   WORKDIR /app
   COPY . ./
   
-  # ---------- 3) Final image: Nginx + PHP-FPM + PGSQL ----------
+  # -------- 3) Final: Nginx + PHP-FPM + PGSQL drivers --------
   FROM php:8.4-fpm-alpine
   
-  # System deps (build + runtime)
+  # Build + runtime deps (incl. oniguruma for mbstring, GD runtime libs)
   RUN set -eux; \
       apk add --no-cache --virtual .build-deps \
           $PHPIZE_DEPS icu-dev libzip-dev postgresql-dev \
@@ -26,14 +26,10 @@
       && apk add --no-cache \
           icu-libs libzip libpq tzdata bash git curl \
           nginx supervisor \
-          oniguruma \
-          freetype libjpeg-turbo libpng \
-      # PHP extensions
+          oniguruma freetype libjpeg-turbo libpng \
       && docker-php-ext-configure intl \
       && docker-php-ext-configure gd --with-freetype --with-jpeg \
-      && docker-php-ext-install -j"$(nproc)" \
-          intl opcache zip bcmath mbstring gd pdo pdo_pgsql pgsql \
-      # Cleanup
+      && docker-php-ext-install -j"$(nproc)" intl opcache zip bcmath mbstring gd pdo pdo_pgsql pgsql \
       && apk del .build-deps \
       && rm -rf /var/cache/apk/* /tmp/*
   
@@ -54,27 +50,39 @@
         echo "opcache.max_accelerated_files=20000"; \
       } > /usr/local/etc/php/conf.d/laravel.ini
   
-  # Prepare dirs
+  # Dirs
   RUN mkdir -p /run/php /run/nginx /var/log/supervisor /var/www/html /etc/nginx/http.d
   
-  # Copy app and vendor
+  # Copy app + vendor
   COPY --from=app_src /app /var/www/html
   COPY --from=vendor /app/vendor /var/www/html/vendor
   
-# Copy configs
-COPY deploy/nginx/default.conf        /etc/nginx/http.d/default.conf
-COPY deploy/supervisord.conf          /etc/supervisord.conf
-COPY deploy/php-fpm/zz-socket.conf    /usr/local/etc/php-fpm.d/zz-socket.conf
-COPY deploy/entrypoint.sh             /usr/local/bin/entrypoint.sh
-
-# Ensure executable
-RUN chmod +x /usr/local/bin/entrypoint.sh
-
-# Healthcheck and ports (unchanged)
-EXPOSE 80
-HEALTHCHECK --interval=30s --timeout=5s --retries=5 \
-  CMD curl -fsS http://localhost/healthz || exit 1
-
-# Use the entrypoint to run artisan warmups, then exec supervisord
-ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
-CMD ["/usr/bin/supervisord", "-c", "/etc/supervisord.conf"]
+  # Nginx, PHP-FPM socket, Supervisor, entrypoint
+  COPY deploy/nginx/default.conf        /etc/nginx/http.d/default.conf
+  COPY deploy/php-fpm/zz-socket.conf    /usr/local/etc/php-fpm.d/zz-socket.conf
+  COPY deploy/php-fpm/zz-logging.conf /usr/local/etc/php-fpm.d/zz-logging.conf
+  COPY deploy/supervisord.conf          /etc/supervisord.conf
+  COPY deploy/entrypoint.sh             /usr/local/bin/entrypoint.sh
+  RUN chmod +x /usr/local/bin/entrypoint.sh
+  
+  WORKDIR /var/www/html
+  
+  # Never ship stale compiled caches
+  RUN rm -rf bootstrap/cache/*.php || true
+  
+  # Laravel write perms
+  RUN set -eux; \
+      mkdir -p storage bootstrap/cache; \
+      chown -R www-data:www-data storage bootstrap/cache; \
+      find storage -type d -exec chmod 775 {} \; ; \
+      find storage -type f -exec chmod 664 {} \; ; \
+      chmod -R 775 bootstrap/cache
+  
+  EXPOSE 80
+  HEALTHCHECK --interval=30s --timeout=5s --retries=5 \
+    CMD curl -fsS http://localhost/healthz || exit 1
+  
+  # Default: just start services; artisan is opt-in via env
+  ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
+  CMD ["/usr/bin/supervisord", "-c", "/etc/supervisord.conf"]
+