simplifying docker workflow

internal/deploy/manager.go

@@ -68,6 +68,10 @@ func (m *Manager) Deploy(ctx context.Context, username, project string, r io.Rea
 		return "", fmt.Errorf("failed to extract tarball: %w", err)
 	}
 
+	if err := m.lockdownPermissions(releasePath); err != nil {
+		return "", fmt.Errorf("failed to set read-only permissions: %w", err)
+	}
+
 	deployPath := filepath.Join(m.deployRoot, username, project)
 	deployParentDir := filepath.Dir(deployPath)
 	if err := os.MkdirAll(deployParentDir, 0755); err != nil {
@@ -178,6 +182,26 @@ func validateTarPath(path string) error {
 	return nil
 }
 
+func (m *Manager) lockdownPermissions(root string) error {
+	return filepath.Walk(root, func(path string, info os.FileInfo, err error) error {
+		if err != nil {
+			return err
+		}
+
+		if info.IsDir() {
+			if err := os.Chmod(path, 0550); err != nil {
+				return fmt.Errorf("failed to chmod directory %s: %w", path, err)
+			}
+		} else {
+			if err := os.Chmod(path, 0440); err != nil {
+				return fmt.Errorf("failed to chmod file %s: %w", path, err)
+			}
+		}
+
+		return nil
+	})
+}
+
 func (m *Manager) cleanupOldReleases(username, project string) error {
 	releasesDir := filepath.Join(m.releaseRoot, username, project)