mailgoserver/docker-deploy/optional-AIO-Docker.md

Implemented for real 2026-08-16 — see docker-deploy/:

• Dockerfile.aio + entrypoint-aio.sh — mailgoserver + rspamd + redis in one container (redis backs rspamd's Bayes classifier + greylisting; mailgoserver itself has no use for redis, it's a single-instance app already backed by SQLite).
• docker-compose.yml's all-in-one profile: docker compose --profile all-in-one up -d --build
• Single volume everywhere now (server_data/) — settings.ini, TLS certs, DKIM/mailstore keys, the SQLite DB, rspamd's dbdir, and redis's RDB snapshot all live under it (see internal/config/config.go + main.go's server_data-relative defaults).
• Nothing runs as root — each process (mailgoserver, rspamd, redis) has its own unprivileged user; mailgoserver's binary gets just CAP_NET_BIND_SERVICE via setcap instead of the whole container running as root.
• Auto-updating installed packages on a schedule inside the running container was considered and left out (see docker-deploy/README.md's "Keeping the base image and packages patched" section) — rebuilding the image periodically is the recommended approach instead; happy to build a scheduled rebuild/CI job if wanted.

The draft supervisord/Alpine sketch that used to be here is superseded by the above.