- Split into builder (node:22-bookworm) and runtime (node:22-bookworm-slim)
- Remove VNC/X11 packages (xauth, x11vnc, novnc, websockify) from production
- Install only minimal Chromium runtime libs in slim stage
- Use python3 -m venv instead of --break-system-packages
- npm prune --omit=dev to exclude devDependencies from runtime
- Run as non-root user appuser (uid=1001)
- Use HTTP apt mirrors (OrbStack BuildKit TLS workaround)
- Copy only runtime-needed dirs: src/, config/, node_modules, venv, subservices
- Expected image size: ~800MB-1.2GB (down from ~3.5GB)
- Create deploy/docker/backend-dev.Dockerfile: single-stage, root,
includes xauth, x11vnc, novnc, websockify, xvfb, Playwright+chromium,
Python3+pip+ocr-worker (--break-system-packages)
- Use HTTP (not HTTPS) for apt mirrors per BuildKit TLS note
- Update docker-compose.dev.yml backend to point to backend-dev.Dockerfile
- .dockerignore unchanged (no issues found)
yml