Created by ~/deploy/add-wordpress-site.sh <domain> [short-name] [--no-egress] [--force] [--skip-npm-api].
Short name derives from the domain (www.mdsdefense.com → mdsdefense).

Per site:

# Themes / plugins / uploads on the host
ls ~/.local/share/containers/storage/volumes/wp-<name>-content/_data/wp-content/themes/

# wp-config.php reads the DB password from the env at every request — nothing to edit
podman exec site-<name> grep -n DB_PASSWORD /var/www/html/wp-config.php

# PHP upload limit lives in the volume's .htaccess (php_value block), not in the image
podman exec site-<name> cat /var/www/html/.htaccess

MariaDB access (client only exists inside the container):

podman exec -it db-<name> sh -c 'mariadb -uroot -p"$MYSQL_ROOT_PASSWORD"'
podman exec -it db-<name> mariadb -uroot -p'PASSWORD'                 # single quotes: + and =
podman exec -it db-<name> mariadb -uroot -p"$(podman secret inspect --showsecret --format '{{.SecretData}}' <name>-db-root-password)"

SELECT user, host, plugin FROM mysql.user;
ALTER USER 'wordpress'@'%' IDENTIFIED BY 'NEW';   -- global, no USE needed
FLUSH PRIVILEGES;

Dump / restore:

podman exec db-<name> sh -c 'mariadb-dump -uroot -p"$MYSQL_ROOT_PASSWORD" wordpress' > ~/tmp/<name>-$(date +%F).sql
podman exec -i db-<name> sh -c 'mariadb -uroot -p"$MYSQL_ROOT_PASSWORD" wordpress' < ~/tmp/<name>-YYYY-MM-DD.sql

Staging → production migration = DB dump/restore + wp-content copy (incl.
.htaccess) + search-replace of the URL (wp search-replace via WP-CLI or
the Better Search Replace plugin).

What updates where. The image holds only PHP and Apache plus a copy of WordPress that is
used to seed an empty volume. Once the volume exists, WordPress itself lives in the volume and
is updated there; replacing the image does not touch it.

| Part | Lives in | How it is updated |
|

Source: dmz-web-podman-cheatsheet.md v1.8 in the dmz-web-deploy repo (Releases). Edit the wiki and the repo copy together.