Fix Glama container build

[chriswu727]

What changed

• install Playwright and only the Chromium system dependencies in one supported command
• install Argus as a regular wheel instead of an editable package
• remove apt metadata after installation
• exclude local environments, reports, caches, tests, and other non-runtime files from Docker build context
• add a release metadata regression test for the Chromium-only Docker contract

Root cause

The Dockerfile ran playwright install-deps without a browser argument. With the current Playwright release this installed dependencies for Chromium, Firefox, and WebKit: 392 Debian packages and an approximately 2.27 GB uncompressed build layer. The resulting cold build took about 136 seconds locally and likely exceeded Glama's build time or image limits.

Validation

• 244 passed in 133.57s
• 5 passed in 0.31s for release metadata after adding the regression test
• clean fixed-image build completed successfully; build time dropped from about 136s to 79s and compressed image size from about 817 MB to 625 MB
• MCP container smoke test passed: initialize, 30-tool list, Chromium start_session against Example Domain, and end_session

No provider credentials or environment files are included.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f2ac6fa1e2

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Keep local environment secrets out of Docker builds

When this image is built from a developer checkout that has a gitignored .env with provider keys, COPY . . will still send it into the Docker context and bake it into /app, because this new ignore list only excludes .venv and not .env/.env.*. That undermines the container hardening goal and can leak credentials from local builds; please mirror the repo’s secret/environment ignores here.

Useful? React with 👍 / 👎.