docker: optimize backend/frontend images for #1335 (non-root, healthc…

[Nishant-S-Bhardwaj]

Description

Optimizes backend and frontend Docker images for size, security (non-root), and adds native healthchecks, per #1335.

Type of Change

• ⚡ Performance improvement
• 🔧 Refactoring (no functional changes)

Related Issues

Relates to #1335 (size targets not fully met — see notes below, with evidence)

Changes Made

Backend (backend/Dockerfile):

• Installs prod deps as non-root node user (previously ran as root)
• Cleans npm cache in the same layer as install — was leaking ~640MB of dead weight into the final image
• Added native HEALTHCHECK probing /health (no curl/wget needed)
• Result: 1.58GB → 726MB
• Did not hit the 150MB target. @prisma/client (a real prod dependency) has prisma as a peer dependency, which pulls in @prisma/dev and typescript regardless of --omit=dev. These are needed at runtime because .github/workflows/ci.yml runs npx prisma db push against this exact container as part of its health-check step. Tested --omit=peer — gets much closer to target but breaks npx prisma db push (confirmed via docker run ... npx prisma --version failing once peers were omitted). Flagging for maintainer input: accept 726MB as evidence-backed, or move prisma db push out of the runtime image into a separate CI-only step so --omit=peer becomes safe.

Frontend (frontend/Dockerfile, frontend/next.config.ts, frontend/src/app/health/route.ts):

• Added output: 'standalone' to next.config.ts
• New multi-stage Dockerfile using standalone output
• Non-root node user, native HEALTHCHECK
• No /health route existed anywhere in the frontend before this PR — added a minimal one returning { status: "ok" }
• Result: 248MB reported by docker images, but actual in-container filesystem size (du -sh /) is ~179MB. Gap persisted after a full build-cache prune and clean rebuild with --provenance=false, so it doesn't appear to be attestation/cache bloat — likely Docker's size-reporting overhead on this Docker version. Both numbers disclosed for transparency.

Both:

• Used npm install instead of npm ci: repo uses npm workspaces with a single root-level lockfile; npm ci fails from a workspace subdirectory. Switching would require restructuring the build context to the repo root (affects both Dockerfiles + docker-compose.yml) — flagging as a follow-up, kept out of scope here.
• Added .dockerignore for both services

Known gap: docker-compose.yml was not updated (frontend has no healthcheck wired there yet). Happy to add if maintainers want it in this PR rather than a follow-up.

Testing

Test Steps

1. Backend: docker run --rm <image> sh -c "whoami && npx prisma --version" — confirmed running as node, prisma CLI functional
2. Backend healthcheck: ran via docker compose up, confirmed docker inspect --format='{{json .State.Health}}' reports "Status":"healthy" with real 200 responses logged
3. Frontend: confirmed /health returns 200 {"status":"ok"} locally before building it into the image
4. Frontend size: cross-checked docker images against du -sh / inside a running container, re-verified after docker builder prune -af + fresh build

Test Coverage

• Manual testing performed

Additional Notes

Reporting both measured sizes rather than only the target numbers, since 150MB/120MB weren't fully achievable without either breaking a CI-required step (backend) or an unresolved Docker size-reporting discrepancy (frontend). Open to guidance on trade-offs above.

[Nishant-S-Bhardwaj]

Update

Updated the PR to include:

• Docker Compose healthcheck integration
• Backend and frontend /health endpoints
• Successful docker compose up validation

Docker Compose validation:

Final Docker image sizes:

[K1NGD4VID]

resolve conflict on this issue @Nishant-S-Bhardwaj

[Nishant-S-Bhardwaj]

resolve conflict on this issue @Nishant-S-Bhardwaj

Conflict Resolved @K1NGD4VID