[ThisIs-Developer]

What fixes #290

The reporter's Nginx log contains HTTP 400 responses to TLS ClientHello traffic (\\x16\\x03). The Docker image was sending Content-Security-Policy: upgrade-insecure-requests on its HTTP-only port 80, causing browsers accessing a LAN host to request styles/scripts over HTTPS. Changing the Compose mapping from 8080:80 to 8719:80 is valid and was not the root cause.

Code and packaging changes

• Remove upgrade-insecure-requests only from the Docker/Nginx HTTP CSP. Keep Cloudflare Pages' HTTPS policy intact; TLS for self-hosted public deployments belongs at the reverse proxy.
• Copy four required web files: browser-drop-source.js, native-markdown-source.js, preview-worker.js, and sample.md. Permit the sample via .dockerignore.
• Precache the native reader in the Service Worker alongside the other assets.
• Serve .mjs files with application/javascript (the stock Nginx image returned application/octet-stream, breaking ES modules with nosniff).
• Revalidate mutable JS/CSS/module paths rather than advertising year-long immutable caching; bound unversioned image caching.
• Update Docker documentation for LAN HTTP and public HTTPS proxying.

Verification — actual Docker image built in GitHub Actions

Latest successful run: Build and Push Docker Image #1202 on PR head 19685671d03decbeaff0ca33f03b7d60921c212b.

• Docker image builds, Nginx starts
• HTTP resources have valid status, non-HTML body, and correct content types including .mjs
• CSS, icon CSS, JS modules, preview Worker, native reader, and Markdown sample exist in image
• HTTP Docker CSP has no HTTPS auto-upgrade, and mutable styles are revalidated
• Chromium loads and styles the UI, edits Markdown, and renders the changed live Preview
• Chromium explicitly registers and activates the packaged Service Worker
• Static build and 257/257 Node unit tests pass
• Existing Playwright Chromium smoke suite 4/4 passes
• Screenshot captured and saved as docker-ui-smoke artifact
• Reporter/manual confirmation using http://<server-ip>:8719 on Raspberry Pi / another LAN machine
• GHCR published image validation after merging (PR tests build locally; PR workflow uses push: false)

Reproduce and inspect

docker compose build --no-cache
docker compose up -d
# with ports: ["8719:80"]
# open http://<server-ip>:8719
docker compose logs --tail=80

We deliberately have not merged or published :latest. Docker tests cover the container and Playwright smoke; the complete non-Docker E2E suite and physical Raspberry Pi browser retest have not been executed here.

Fixes #290.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
markdown-viewer	Ready	Preview	Nov 14, 2026 11:30am UTC

[cloudflare-workers-and-pages]

Deploying markdownviewer with    Cloudflare Pages

Latest commit:	1968567
Status:	✅  Deploy successful!
Preview URL:	https://ce627e2e.markdownviewer.pages.dev
Branch Preview URL:	https://fix-290-docker-http-assets-s.markdownviewer.pages.dev

View logs