release: v2.8.1-beta Docker deployment

docs/release-notes.md

@@ -31,3 +31,4 @@ Each body lives in `docs/releases/<tag>.md`. Publish with `tea releases create -
 | `v2.6.2-beta` | v2.6.2-beta - English and French interface |
 | `v2.7.0-beta` | v2.7.0-beta - Markdown and block article bodies |
 | `v2.8.0-beta` | v2.8.0-beta - API keys and API reference |
+| `v2.8.1-beta` | v2.8.1-beta - Docker deployment |

docs/releases/v2.8.1-beta.md

@@ -0,0 +1,36 @@
+This release adds an official Docker deployment, so RenewCMS can run in a container instead of as a binary under systemd, and teaches Settings to guide container installs through updates.
+
+## New
+
+**Docker deployment**
+
+- A container image holds the single RenewCMS binary on Alpine, runs as a non-root user and keeps the database and uploads on one volume. A Compose file starts it with an env file and a health check.
+- Images are published for amd64 and arm64 to the project registry at `git.floriansylvain.fr/fsylvain/renewcms`. Prereleases carry the version tag and a moving `beta` tag, and `latest` is only used for stable releases.
+- Upgrading is `docker compose pull && docker compose up -d`. Your data stays on the volume.
+- A new Docker guide covers the quick start, backups of the data volume, the reverse proxy and TLS, reaching an SMTP server from the container, and building the image from source.
+
+**Update guidance in containers**
+
+- In a container, Settings no longer shows the browser update flow, which cannot work there. It shows the new version, the command to run on the server with a Copy button, and a link to the Docker guide.
+- Download and restart are not offered in a container, and the API refuses them.
+
+## API
+
+- `GET /v1/system/update` has a new `container` boolean. It is `true` when the server runs in a container, and `can_apply` is then always `false`.
+- `POST /v1/system/update/download` and `POST /v1/system/update/restart` answer `409` in a container, as they already do when browser updates are not set up.
+
+## Under the hood
+
+- Add a multi-stage Dockerfile, a Compose file with a separate build override, and tasks to build, run, pull, upgrade and publish the image. Publishing is a maintainer task that refuses to run unless the version is an exact tag on a clean tree.
+- Add the container update guidance and the image publishing specifications and QA procedures to `features/`.
+
+## Upgrading
+
+- Replace the binary. No schema change and no required environment variable.
+- There is one new optional variable, `RENEWCMS_CONTAINER`, which defaults to `false`. The Docker image and the Compose file set it to `true`. Leave it unset on a binary install.
+- Docker users start from the Docker guide. To move an existing binary install to Docker, copy the database and uploads into the volume and keep the same environment variables.
+
+## Known limitations
+
+- Browser updates are not available in a container. Update by pulling a new image.
+- The new container wording in Settings has no design frame yet.