erm

docker/php/Dockerfile

@@ -90,7 +90,6 @@ CMD ["php-fpm"]
 # -----------------------------------------------------------------------------
 FROM base AS prod
 ARG APP_ENV=prod
-ARG BUILD_APP_SECRET=build-secret
 ENV APP_ENV=${APP_ENV}
 ENV APP_DEBUG=0 \
     DATABASE_DRIVER=sqlite \
@@ -112,10 +111,7 @@ COPY . /var/www/html
 # Finalize install & warm cache
 RUN if [ -f bin/console ]; then \
       set -ex; \
-      export APP_SECRET="${BUILD_APP_SECRET}"; \
       composer dump-autoload --no-dev --optimize; \
-      php bin/console cache:clear --no-warmup; \
-      php bin/console cache:warmup; \
       mkdir -p var var/data public/uploads; \
       chown -R www-data:www-data var public/uploads; \
     fi

docker/prod/entrypoint.sh

@@ -1,6 +1,17 @@
 #!/bin/sh
 set -eu
 
+require_app_secret() {
+    if [ -z "${APP_SECRET:-}" ]; then
+        echo "APP_SECRET environment variable is required at runtime" >&2
+        exit 1
+    fi
+}
+
+if [ -f bin/console ]; then
+    require_app_secret
+fi
+
 if [ "${RUN_MIGRATIONS_ON_START:-1}" = "1" ] && [ -f bin/console ]; then
     if [ "${DATABASE_DRIVER:-sqlite}" = "sqlite" ]; then
         SQLITE_PATH="${DATABASE_SQLITE_PATH:-/var/www/html/var/data/database.sqlite}"
@@ -15,5 +26,11 @@ if [ "${RUN_MIGRATIONS_ON_START:-1}" = "1" ] && [ -f bin/console ]; then
     su-exec www-data php bin/console doctrine:migrations:migrate --no-interaction --allow-no-migration
 fi
 
+if [ -f bin/console ]; then
+    su-exec www-data php bin/console cache:clear --no-warmup
+    su-exec www-data php bin/console cache:warmup
+    chown -R www-data:www-data var
+fi
+
 exec "$@"