FROM ghcr.io/euro-office/documentserver:latest

# Internal-zone apps trust the fleet's own internal CA here (cert copied in,
# then update-ca-certificates run) — the actual cert and paths are kept private.