Go's MIME table has no .webmanifest entry, so http.FileServer sniffed the PWA web
app manifest as text/plain. mime.AddExtensionType at package load makes TypeByExtension
authoritative. A correctness nit (the manifest spec parses by content and nosniff does
not reject manifests), but a PWA server should label its manifest correctly.
- Cache-Control per file: no-cache for index.html + service workers, immutable 1y for
content-hashed assets, 1h for the rest (Vite/CRA/Angular). Closes the stale-release
trap at the HTTP layer that the v1.6.0 image fix closed at the container layer.
- SPA fallback scoped to navigation: a missing asset (path w/ extension) or a non-HTML
Accept now returns 404 instead of index.html (no more HTML-as-JS 'Unexpected token <').
- X-Content-Type-Options: nosniff on every response.
- Image runs as a non-root 'spa' user.
- README: caching table, fallback contract, and the Angular dist/<project>/browser/ note.
VOLUME ["/srv/www"] created an anonymous volume that docker compose reuses across
container recreation, shadowing a freshly COPY'd SPA bundle with the previous build
— up -d --build exited 0 while serving the old bundle (and poisoned the PWA service
worker's ngsw.json). A child image cannot un-declare an inherited VOLUME, so it must
not be declared: removing it makes the COPY case deterministic and leaves the runtime
bind-mount case unaffected. Also refreshed the README FROM tag v1.0.0 -> v1.6.0.
Rene Nochebuena