- Split into builder (node:22-bookworm) and runtime (node:22-bookworm-slim)
- Remove VNC/X11 packages (xauth, x11vnc, novnc, websockify) from production
- Install only minimal Chromium runtime libs in slim stage
- Use python3 -m venv instead of --break-system-packages
- npm prune --omit=dev to exclude devDependencies from runtime
- Run as non-root user appuser (uid=1001)
- Use HTTP apt mirrors (OrbStack BuildKit TLS workaround)
- Copy only runtime-needed dirs: src/, config/, node_modules, venv, subservices
- Expected image size: ~800MB-1.2GB (down from ~3.5GB)
yml