A configuration API exposes the application’s current runtime settings as JSON. It helps diagnose problems when configuration comes from several layers, but the endpoint itself must be protected. section 18.3
Build the endpoint with three safeguards:
- Return only selected settings; never expose secrets. section 18.3
- Restrict access to authorized users. section 18.3
- Make the feature configurable so it can be enabled or disabled. section 18.3
Inspecting container configuration
Run the container, then request its endpoint with curl: `docker run -d -p 8087:80 diamol/ch18-image-gallery:2e` followed by `curl http://localhost:8087/config`. A second run mounts a development override directory, allowing the response to show merged configuration.
