Fix staging containers failing on Windows Docker builds

Strip CRLF from entrypoint scripts in backend/frontend images, use Docker
DNS in staging nginx config, and wait for healthy app services before nginx.

Co-authored-by: Cursor <cursoragent@cursor.com>

infrastructure/STAGING-DEPLOY.md

@@ -249,6 +249,8 @@ On the Windows host, from repo `infrastructure/`:
 | Port 8088 unreachable | Windows firewall rule; confirm nginx container is up |
 | Backend restart loop | JWT secrets still placeholder; fix `backend.staging.env` |
 | Backend DB auth error | `DATABASE_URL` password ≠ `POSTGRES_PASSWORD` |
+| `dumb-init docker-entrypoint.sh: No such file or directory` | Windows CRLF in shell scripts — fixed in Dockerfiles (rebuild images). |
+| `nginx: host not found in upstream "backend:3000"` | Backend/frontend not running yet — fix entrypoint/env first; nginx config uses Docker DNS resolver. |
 
 **Logs:**
 

infrastructure/docker-compose.registry.yml

@@ -85,8 +85,10 @@ services:
     image: nginx:alpine
     container_name: dyolink_nginx_staging
     depends_on:
-      - backend
-      - frontend
+      backend:
+        condition: service_healthy
+      frontend:
+        condition: service_healthy
     ports:
       - "${STAGING_HTTP_PORT:-8088}:80"
     volumes:

infrastructure/docker-compose.staging.yml

@@ -87,8 +87,10 @@ services:
     image: nginx:alpine
     container_name: dyolink_nginx_staging
     depends_on:
-      - backend
-      - frontend
+      backend:
+        condition: service_healthy
+      frontend:
+        condition: service_healthy
     ports:
       - "${STAGING_HTTP_PORT:-8088}:80"
     volumes:

infrastructure/nginx/http-only.conf

@@ -1,15 +1,10 @@
 # HTTP only — local dev and IP-based staging (no TLS).
 # Use with: docker compose and map host port e.g. 8080:80 or 8088:80
+#
+# Dynamic proxy_pass via Docker DNS (127.0.0.11) so nginx starts even if
+# backend/frontend containers are not up yet (static upstream blocks fail at boot).
 
-upstream dyolink_backend {
-    server backend:3000;
-    keepalive 32;
-}
-
-upstream dyolink_frontend {
-    server frontend:3000;
-    keepalive 32;
-}
+resolver 127.0.0.11 valid=10s ipv6=off;
 
 server {
     listen 80;
@@ -19,7 +14,8 @@ server {
     client_max_body_size 50M;
 
     location / {
-        proxy_pass http://dyolink_frontend;
+        set $frontend_upstream http://frontend:3000;
+        proxy_pass $frontend_upstream;
         proxy_http_version 1.1;
         proxy_set_header Upgrade $http_upgrade;
         proxy_set_header Connection 'upgrade';
@@ -33,7 +29,8 @@ server {
     }
 
     location /api {
-        proxy_pass http://dyolink_backend;
+        set $backend_upstream http://backend:3000;
+        proxy_pass $backend_upstream;
         proxy_http_version 1.1;
         proxy_set_header Upgrade $http_upgrade;
         proxy_set_header Connection 'upgrade';