fix(docker): drop the external dockerfile frontend pin

[SupaOhm]

Problem

pnpm docker:build fails before running a single instruction:

ERROR resolve image config for docker-image://docker.io/docker/dockerfile:1
failed to resolve source metadata for docker.io/docker/dockerfile:1:
Head "https://registry-1.docker.io/v2/docker/dockerfile/manifests/1":
net/http: TLS handshake timeout

# syntax=docker/dockerfile:1 tells BuildKit to fetch an external frontend image from Docker Hub before parsing the Dockerfile.

Isolation

• A two-line Dockerfile — the syntax comment plus FROM hello-world — reproduces the failure.
• The same file without the comment builds in 2.3s.
• docker pull node:24-alpine and docker pull hello-world both complete in seconds.

So it is BuildKit's registry path specifically, not general connectivity. Docker Desktop has a proxy configured (http.docker.internal:3128) that normal pulls use.

Fix

Remove the pin. Nothing in this Dockerfile needs the external frontend — it uses only CMD, COPY, ENV, EXPOSE, FROM, RUN, USER, WORKDIR, with no RUN --mount, heredocs, or COPY --link. BuildKit's built-in frontend handles all of it.

Verification

Full docker build now succeeds, and the resulting image was run and exercised:

• container responds HTTP 200
• CSP header present and correct (production variant, with upgrade-insecure-requests — right for Docker, which isn't Vercel)
• stylesheet linked, and fetching it returns 200, 68951 bytes

This is also the first time the pnpm-workspace.yaml fix from #3 has been exercised in a real image build — the frozen install passes.

Caveat — an environment issue remains

This PR removes one mandatory BuildKit registry round-trip, but BuildKit's registry access is still broken on this machine. After removing the directive, the first build still hung at 0/0 steps for ~11 minutes resolving node:24-alpine; it only succeeded once I pulled that image manually so BuildKit could resolve it locally.

So a clean machine, or a node:24-alpine update, will hang again. Worth checking Docker Desktop → Settings → Resources → Proxies. Pre-pulling base images is the practical workaround in the meantime.

🤖 Generated with Claude Code

https://claude.ai/code/session_01BaSzXHiVdswD9rKoVh9Ln4

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
acklab	Ready	Preview	Aug 5, 2026 6:15am

[Copilot]

Pull request overview

Removes the # syntax=docker/dockerfile:1 Dockerfile frontend pin to avoid a mandatory BuildKit registry fetch that can fail/hang in certain network/proxy environments, unblocking pnpm docker:build for this repo’s image build.

Changes:

• Removed the external Dockerfile frontend directive (# syntax=docker/dockerfile:1) so builds rely on the built-in Dockerfile frontend.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.