安装脚本会一次生成数据库密码和认证密钥，并写入权限为 0600 的 .env。升级和重启不会自动轮换。
Kaneo 以官方 UID/GID 1001:1001 运行；PostgreSQL 以 70:70 直接运行，不执行镜像内的 root/gosu 切换路径。
两个容器都丢弃全部 Linux capabilities 并禁止权限提升。PostgreSQL 仅连接内部 Docker 网络，不发布主机端口。
PostgreSQL 数据保存在安装版本目录下的 data/postgres。卸载不会删除该目录；升级前请备份整个数据目录。

Introduction

Kaneo is a lightweight open-source project management platform with boards, tasks, labels, comments, time tracking, live updates, and integrations.

Features

The web port binds to 127.0.0.1 by default. Publish it through the 1Panel reverse proxy with HTTPS.
Set Public URL to the complete HTTP(S) origin used by browsers, such as https://kaneo.example.com. Do not include a path or trailing slash.
The first registered user becomes the instance administrator. After that account works, set Disable Registration to true and restart if public signup is not required.

Installation generates the database password and authentication secret once and stores them in the mode 0600 .env. Restart and upgrade preserve them.
Kaneo runs as the upstream UID/GID 1001:1001. PostgreSQL runs directly as 70:70, bypassing the image's root/gosu identity-switch path.
Both services drop every Linux capability and prevent privilege escalation. PostgreSQL is restricted to an internal Docker network and publishes no host port.
PostgreSQL data is stored in data/postgres below the installed version. Uninstall preserves it. Back up the complete data directory before upgrades.
Kaneo's root filesystem remains writable because the official startup script replaces frontend runtime URLs and nginx discovery metadata in place. The service remains non-root and can write only paths owned by its upstream user.