rust:1.99-slim build, debian-slim runtime as uid 10001. Only static/ and content/ shipped alongside the binary; DB lives on /data volume. Could not build-verify locally (no Docker daemon); paths checked against ServeDir/include_str usage instead.
