Load frontend configuration at container startup

README.md

@@ -36,11 +36,11 @@ npm run build
 Build and run the static production app with Nginx:
 
 ```bash
-cp .env.example .env
-# Edit .env with the real deployment and legal values.
-docker build --secret id=vite_env,src=.env -t plimi:local .
+docker build -t plimi:local .
 
-docker run --rm -p 8080:80 --name plimi plimi:local
+docker run --rm -p 8080:80 --name plimi \
+  --env-file .env \
+  plimi:local
 ```
 
 Or use Docker Compose:
@@ -67,11 +67,13 @@ configured to exclude URL search parameters and hashes and honor Do Not Track.
 The privacy page is available at `/privacy`; deployers must replace all example
 controller and hosting values before publishing.
 
-Docker mounts `.env` as a BuildKit secret only while Vite builds the static
-bundle. The file is ignored by Git and excluded from the regular Docker context.
-Remember that `VITE_*` values are public build-time configuration and can be
-read from the resulting browser JavaScript; do not put passwords or API secrets
-in them.
+The Docker image is environment-independent. At container startup, its entrypoint
+generates `/config.js` from `.env`, so the same image can be promoted between
+environments without rebuilding. The file is ignored by Git and excluded from
+the Docker build context.
+
+These values are public browser configuration even though they are supplied at
+deploy time. Do not put passwords, private keys, or API secrets in them.
 
 ---