docs: REMOVE ghcr note as it has been removedfrom GH

Dockerfile

@@ -1,18 +1,28 @@
 # syntax=docker/dockerfile:1.7
 
 # ============================================================================
-# Build stage: create a self-contained venv with all dependencies
+# Build stage: Debian 12's Python (paths/libs match the distroless runtime)
 # ============================================================================
-FROM python:3.11-slim-bookworm AS builder
+# We deliberately do NOT use python:3.11-slim-bookworm here — that image is
+# Python.org's, which installs Python to /usr/local with an RPATH pointing
+# back into /usr/local/lib. Distroless has libpython under /usr/lib, so the
+# RPATH would break. Debian's apt-installed python3 lives at the same paths
+# as distroless's, so symlinks and libpython all resolve correctly.
+FROM debian:12-slim AS builder
 
 ENV PYTHONDONTWRITEBYTECODE=1 \
     PYTHONUNBUFFERED=1 \
     PIP_NO_CACHE_DIR=1 \
     PIP_DISABLE_PIP_VERSION_CHECK=1
 
-# --copies bundles the Python binary itself into /opt/venv so the runtime
+RUN apt-get update \
-# stage gets a self-contained tree (no symlinks back to /usr/local/bin).
+    && apt-get install -y --no-install-recommends \
-RUN python -m venv --copies /opt/venv
+         python3 python3-pip python3-venv \
+    && rm -rf /var/lib/apt/lists/*
+
+# Default (symlink) venv. /opt/venv/bin/python ends up as a symlink to
+# /usr/bin/python3, which distroless also provides.
+RUN python3 -m venv /opt/venv
 ENV PATH=/opt/venv/bin:$PATH
 
 # Install runtime deps into the venv's site-packages
@@ -22,7 +32,7 @@ RUN pip install \
       redis==5.0.*
 
 # Pre-compile bytecode for faster cold start on a read-only rootfs
-RUN python -m compileall -q /opt/venv
+RUN python3 -m compileall -q /opt/venv
 
 # ============================================================================
 # Runtime stage: distroless Python 3.11, non-root, no shell
@@ -37,7 +47,8 @@ ENV PYTHONDONTWRITEBYTECODE=1 \
 
 WORKDIR /app
 
-# Self-contained venv (its bin/python and site-packages travel together)
+# Venv ships its site-packages; its bin/python symlink resolves against
+# distroless's /usr/bin/python3 and Debian's libpython at /usr/lib/...
 COPY --from=builder --chown=nonroot:nonroot /opt/venv /opt/venv
 
 # Application source (its own layer so source-only changes don't bust dep cache)
@@ -46,7 +57,5 @@ COPY --chown=nonroot:nonroot app.py favicon.ico /app/
 USER nonroot
 EXPOSE 8000
 
-# Invoking the venv's Python directly makes its site-packages discoverable
-# automatically (sys.prefix points inside /opt/venv) — no PYTHONPATH needed.
 ENTRYPOINT ["/opt/venv/bin/python", "-m", "uvicorn"]
 CMD ["app:app", "--host", "0.0.0.0", "--port", "8000"]

README.md

@@ -1,6 +1,6 @@
 # Aukpad
 
-Simple **live collaboration notepad** with websockets and FastAPI.
+Simple **temporary live collaboration notepad** with websockets and FastAPI — pads expire automatically after a configurable retention period.
 
 [Issue tracker](https://git.uphillsecurity.com/cf7/aukpad/issues) | `Libera Chat #aukpad` 
 
@@ -16,23 +16,34 @@ The goal is to keep it simple! For feature-rich solutions please check out [hedg
 ## Features
 
 **Use cases:**
-- shared notepad on multiple machines
+- shared notepad across multiple machines
 - collaboration on the same notepage with multiple people (notes, config, etc)
-- config changes in aukpad > `curl -o app.conf https://aukpad.com/{pad_id}/raw` > change config in aukpad > repeat `curl` command
+- piping configs: `curl -o app.conf https://aukpad.com/{pad_id}/raw` → edit in aukpad → repeat
 
-**Available**:
+**Editor:**
-- live collab notepad
+- real-time WebSocket collaboration with cursor preservation across remote edits
-- line numbers
+- per-pad password protection (PBKDF2-SHA256), with a built-in password generator in the UI
-- custom path `{pad_id}` for more privacy (1–64 chars, `[a-zA-Z0-9_-]`)
+- line numbers; Tab inserts 4 spaces
-- optional caching with valkey/redis
+- dark / light mode (auto-detects system preference, manual toggle)
-- pad creation with HTTP post requests with curl (see *Usage*)
+- copy-to-clipboard and "new pad" buttons, live peer count in the header
-- `{pad_id}/raw` HTTP endpoint 
-- optional password protection (HTTP endpoint accessible with GET /{pad_id}/raw?pw=mysecurepasswordhunter2)
 
-**Ideas**:
+**Endpoints:**
+- custom pad path `{pad_id}` (1–64 chars, `[a-zA-Z0-9_-]`); auto-generated IDs are 8-char `[a-z0-9]`
+- `POST /` — create a pad from request body (curl-friendly, see *Usage*)
+- `GET /{pad_id}/raw` — raw text (auth via `?pw=…` for protected pads)
+- `GET /system/info` — instance configuration page
+- WebSocket `/ws/{pad_id}` — live collaboration
+
+**Deployment:**
+- optional Valkey/Redis cache for cross-restart persistence
+- configurable text-size, connection, room, and retention limits
+- per-IP rate limiting (pad creation + failed password attempts), reverse-proxy aware
+- distroless, non-root, read-only-rootfs container image
+
+**Ideas:**
 [Check out the open feature requests](https://git.uphillsecurity.com/cf7/aukpad/issues?q=&type=all&sort=&state=open&labels=12&milestone=0&project=0&assignee=0&poster=0&archived=false)
 
-**Not planned**:
+**Not planned:**
 - accounts / RBAC
 
 ---
@@ -61,10 +72,6 @@ ip -br a | curl -X POST https://aukpad.com --data-binary @-   # command output
 
 Open `127.0.0.1:8000`
 
-Alternative, use Github Container Repository:
-
-`ghcr.io/caffeinefueled1/aukpad:latest`
-
 **Adv. example with Podman**
 
 ```bash
@@ -93,7 +100,6 @@ podman run -d --name aukpad-app \
     --tmpfs /tmp \
     --security-opt no-new-privileges:true \
     --cap-drop ALL \
-    --user 1000:1000 \
     -e USE_VALKEY=true \
     -e VALKEY_URL=redis://:xeZNopyIeMMncqDFPHtJQwMwIathgMWo@localhost:6379 \
     -e MAX_TEXT_SIZE=5 \
@@ -130,12 +136,6 @@ For security concerns or reports, please contact via `hello a t uphillsecurity d
 
 ---
 
-## Notes
-
-- [Github Mirror available](https://github.com/CaffeineFueled1/aukpad)
-
----
-
 ## License
 
 **Apache License**

app.py

@@ -590,6 +590,18 @@ def get_system_info():
   <div class="info-section">
     <h2>Instance</h2>
     <p>{DESCRIPTION}</p>
+    <p>Simple <strong>temporary live collaboration notepad</strong> with websockets and FastAPI — pads expire automatically after a configurable retention period.</p>
+  </div>
+
+  <div class="info-section">
+    <h2>Features</h2>
+    <ul>
+      <li>real-time WebSocket collaboration with cursor preservation across remote edits</li>
+      <li>per-pad password protection (PBKDF2-SHA256), with a built-in password generator in the UI</li>
+      <li>line numbers; Tab inserts 4 spaces</li>
+      <li>dark / light mode (auto-detects system preference, manual toggle)</li>
+      <li>copy-to-clipboard and "new pad" buttons, live peer count in the header</li>
+    </ul>
   </div>
 
   <div class="info-section">