Slim Docker runtime image

docker/Dockerfile

@@ -53,7 +53,13 @@ ENV APP_SOURCE_REPO=${APP_SOURCE_REPO}
 RUN npm run build
 
 # ============================================
-# Stage 3: Production Runner
+# Stage 3: Production Dependencies
+# ============================================
+FROM deps AS prod-deps
+RUN npm prune --omit=dev && npm cache clean --force
+
+# ============================================
+# Stage 4: Production Runner
 # ============================================
 FROM node:22-alpine AS runner
 RUN apk add --no-cache libc6-compat openssl netcat-openbsd wget
@@ -99,8 +105,8 @@ COPY --from=builder /app/public ./public
 COPY --from=builder --chown=nextjs:nodejs /app/.next/standalone ./
 COPY --from=builder --chown=nextjs:nodejs /app/.next/static ./.next/static
 
-# Copy node_modules from builder (includes ALL dependencies)
-COPY --from=builder --chown=nextjs:nodejs /app/node_modules ./node_modules
+# Copy pruned runtime dependencies
+COPY --from=prod-deps --chown=nextjs:nodejs /app/node_modules ./node_modules
 
 # Copy drizzle migrations, config, and schema (needed for migrations)
 COPY --from=builder --chown=nextjs:nodejs /app/drizzle ./drizzle

package.json

@@ -21,23 +21,12 @@
   },
   "dependencies": {
     "@aws-sdk/client-s3": "^3.972.0",
-    "@tailwindcss/postcss": "^4",
-    "@types/bcryptjs": "^2.4.6",
-    "@types/node": "^20.19.30",
-    "@types/pg": "^8.16.0",
-    "@types/react": "^19",
-    "@types/react-dom": "^19",
-    "@types/uuid": "^10.0.0",
     "@upstash/redis": "^1.34.3",
     "bcryptjs": "^2.4.3",
     "crypto-js": "^4.2.0",
     "dotenv": "^17.2.3",
-    "dotenv-cli": "^11.0.0",
     "drizzle-kit": "^0.31.8",
     "drizzle-orm": "^0.44.1",
-    "eslint": "^9",
-    "eslint-config-next": "16.1.4",
-    "fast-check": "^4.5.3",
     "jose": "^6.0.11",
     "libsodium-wrappers-sumo": "^0.8.2",
     "lucide-react": "^0.562.0",
@@ -47,11 +36,24 @@
     "pg": "^8.17.2",
     "react": "19.2.3",
     "react-dom": "19.2.3",
+    "uuid": "^11.1.0",
+    "zod": "^4.3.5"
+  },
+  "devDependencies": {
+    "@tailwindcss/postcss": "^4",
+    "@types/bcryptjs": "^2.4.6",
+    "@types/node": "^20.19.30",
+    "@types/pg": "^8.16.0",
+    "@types/react": "^19",
+    "@types/react-dom": "^19",
+    "@types/uuid": "^10.0.0",
+    "dotenv-cli": "^11.0.0",
+    "eslint": "^9",
+    "eslint-config-next": "16.1.4",
+    "fast-check": "^4.5.3",
     "tailwindcss": "^4",
     "tsx": "^4.21.0",
     "typescript": "^5",
-    "uuid": "^11.1.0",
-    "vitest": "^4.0.18",
-    "zod": "^4.3.5"
+    "vitest": "^4.0.18"
   }
 }

scripts/docker-publish.sh

@@ -8,6 +8,7 @@ BUILDER="${BUILDER:-colima}"
 PLATFORMS="${PLATFORMS:-linux/amd64,linux/arm64}"
 DATE_PREFIX="${DATE_PREFIX:-$(date -u +%Y.%m.%d)}"
 SOURCE_REPO="${SOURCE_REPO:-https://github.com/GnosysLabs/Synapsis}"
+PRUNE_BUILD_CACHE="${PRUNE_BUILD_CACHE:-1}"
 
 require_command() {
     if ! command -v "$1" >/dev/null 2>&1; then
@@ -79,3 +80,9 @@ echo "✅ Published:"
 echo "  ${IMAGE_REPO}:latest"
 echo "  ${IMAGE_REPO}:${APP_VERSION}"
 echo "  ${IMAGE_REPO}:${CURRENT_SHA}"
+
+if [ "${PRUNE_BUILD_CACHE}" = "1" ]; then
+    echo ""
+    echo "🧹 Pruning BuildKit cache"
+    docker buildx prune --builder "${BUILDER}" -af >/dev/null
+fi