Add Dockerfile for coulomb-social delivery-lane packaging

Non-root gunicorn image with /healthz check; railiance-apps values still open.

Dockerfile

@@ -0,0 +1,47 @@
+# syntax=docker/dockerfile:1.7
+# coulomb.social — commit-SHA images for the business delivery lane.
+#
+#   docker build -t forgejo.coulomb.social/coulomb/coulomb-social:<git-sha> .
+
+FROM python:3.12-slim-bookworm AS deps
+
+ENV PYTHONDONTWRITEBYTECODE=1 \
+    PYTHONUNBUFFERED=1 \
+    UV_LINK_MODE=copy \
+    UV_PYTHON_DOWNLOADS=never
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        build-essential libpq-dev curl ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY --from=ghcr.io/astral-sh/uv:0.5.11 /uv /usr/local/bin/uv
+
+WORKDIR /app
+COPY pyproject.toml uv.lock ./
+RUN uv sync --frozen --no-dev --no-install-project
+
+FROM python:3.12-slim-bookworm
+
+ENV PYTHONDONTWRITEBYTECODE=1 \
+    PYTHONUNBUFFERED=1 \
+    PATH="/app/.venv/bin:$PATH" \
+    DJANGO_SETTINGS_MODULE=coulomb_social.settings.prod
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        libpq5 ca-certificates \
+    && rm -rf /var/lib/apt/lists/* \
+    && useradd --create-home --uid 10001 appuser
+
+WORKDIR /app
+COPY --from=deps /app/.venv /app/.venv
+COPY manage.py pyproject.toml ./
+COPY coulomb_social ./coulomb_social
+
+RUN chown -R appuser:appuser /app
+USER appuser
+
+EXPOSE 8000
+HEALTHCHECK --interval=30s --timeout=5s --start-period=20s \
+  CMD python -c "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8000/healthz')" || exit 1
+
+CMD ["gunicorn", "coulomb_social.wsgi:application", "--bind", "0.0.0.0:8000", "--workers", "2"]

docs/deploy.md

@@ -19,7 +19,18 @@ railiance01 (same lane as `vergabe-teilnahme`).
 
 - `GET /healthz` → `{"status":"ok"}`
 
+## Build
+
+```bash
+SHA=$(git rev-parse --short HEAD)
+docker build -t forgejo.coulomb.social/coulomb/coulomb-social:$SHA .
+```
+
+Runtime env (no secrets in image): `SECRET_KEY`, `DATABASE_URL`,
+`OIDC_*`, `USER_ENGINE_*`, `DEFAULT_TENANT_ID`, `ALLOWED_HOSTS`.
+
 ## Status
 
-Container packaging and railiance-apps values are **not** finished; local
+- Dockerfile present (gunicorn, non-root, `/healthz` check).
-`runserver` / tests are the current verification path.
+- railiance-apps Helm values / cluster Service **not** yet landed.
+- Local `make run` + `make test` remain the default verification path.

workplans/CSOC-WP-0002-netkingdom-user-management-reestablish.md

@@ -264,6 +264,8 @@ Align with business-app delivery lane without full production cutover:
 **Done when:** image builds in CI or documented local script; deploy notes in
 `docs/deploy.md`.
 
+2026-08-09: `Dockerfile` added (uv sync, gunicorn, non-root, healthcheck). railiance-apps values still open.
+
 ---
 
 ## Sequencing