feat(docker): stage per-service runtime trees and lower container image size budgets

.github/workflows/containers.yml

@@ -9,6 +9,7 @@ on:
       - "deploy/docker/**"
       - "starter-memory/**"
       - "Dockerfile"
+      - "package.json"
       - "package-lock.json"
   push:
     branches:
@@ -20,6 +21,7 @@ on:
       - "deploy/docker/**"
       - "starter-memory/**"
       - "Dockerfile"
+      - "package.json"
       - "package-lock.json"
   workflow_dispatch:
 
@@ -44,7 +46,7 @@ jobs:
           - amd64
           - arm64
     runs-on: ubuntu-latest
-    timeout-minutes: 50
+    timeout-minutes: 60
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -71,3 +73,10 @@ jobs:
           node scripts/container-image-size-budget.mjs
           --target "${{ matrix.target }}"
           --image "spaceapp-ci:${{ matrix.target }}-${{ matrix.arch }}"
+
+      - name: Smoke check container image
+        run: >-
+          node deploy/docker/smoke-container-image.mjs
+          --target "${{ matrix.target }}"
+          --image "spaceapp-ci:${{ matrix.target }}-${{ matrix.arch }}"
+          --arch "${{ matrix.arch }}"

CHANGELOG.md

@@ -5,6 +5,10 @@ Semantic Versioning.
 
 ## [Unreleased]
 
+### Container images
+
+- `spaceapp-core`, `spaceapp-browser`, and `spaceapp-cli` each ship only the workspaces and production dependencies that service runs. Image size budgets are 850 MiB (core), 1350 MiB (browser), and 1000 MiB (cli).
+
 ## [1.1.8] - 2026-10-25
 
 Source: sanitized Space app @ 8d5bf21b32 (4948 files). Verifies SpaceApp's image attestations before an

Dockerfile

@@ -1,6 +1,7 @@
 # syntax=docker/dockerfile:1.7
 
 FROM node:22.23.0-trixie-slim@sha256:cfd8f2a5bc50526aee08e88970979f92722828e7dcc6d8983607fb8bff4bdb82 AS build
+ARG TARGETARCH
 WORKDIR /app
 RUN apt-get update \
     && apt-get install -y --no-install-recommends build-essential liblzma5 python3 pkg-config \
@@ -9,7 +10,8 @@ COPY . .
 RUN npm ci --no-audit --no-fund \
     && npm run build \
     && npm prune --omit=dev \
-    && find node_modules -type f \( -name '*.js.map' -o -name '*.mjs.map' -o -name '*.cjs.map' -o -name '*.css.map' \) -delete
+    && find node_modules -type f \( -name '*.js.map' -o -name '*.mjs.map' -o -name '*.cjs.map' -o -name '*.css.map' \) -delete \
+    && node deploy/docker/stage-container-runtime.mjs --source /app --output /app-targets --arch "${TARGETARCH:-}"
 
 FROM node:22.23.0-trixie-slim@sha256:cfd8f2a5bc50526aee08e88970979f92722828e7dcc6d8983607fb8bff4bdb82 AS runtime-base
 ARG TARGETARCH
@@ -54,17 +56,8 @@ RUN npm install --global --ignore-scripts --no-audit --no-fund "npm@${NPM_VERSIO
     && groupadd --gid 10001 spaceapp \
     && useradd --uid 10001 --gid 10001 --create-home --home-dir /var/lib/spaceapp-cli --shell /bin/bash spaceapp
 WORKDIR /app
-COPY --from=build --chown=spaceapp:spaceapp /app/package.json /app/package-lock.json ./
-COPY --from=build --chown=spaceapp:spaceapp /app/node_modules ./node_modules
-COPY --from=build --chown=spaceapp:spaceapp /app/apps ./apps
-COPY --from=build --chown=spaceapp:spaceapp /app/packages ./packages
-COPY --from=build --chown=spaceapp:spaceapp /app/agent-skills ./agent-skills
 COPY --from=build --chown=spaceapp:spaceapp /app/LICENSE /app/NOTICE /app/THIRD_PARTY_NOTICES.md ./
 COPY --from=build --chown=spaceapp:spaceapp /app/THIRD_PARTY_LICENSES ./THIRD_PARTY_LICENSES
-COPY --from=build --chown=spaceapp:spaceapp /app/scripts/reset-owner-password.mjs ./scripts/reset-owner-password.mjs
-COPY --from=build --chown=spaceapp:spaceapp /app/scripts/rotate-owner-setup-token.mjs ./scripts/rotate-owner-setup-token.mjs
-COPY --from=build --chown=spaceapp:spaceapp /app/scripts/portable-backup.mjs ./scripts/portable-backup.mjs
-COPY --from=build --chown=spaceapp:spaceapp /app/scripts/portable-restore.mjs ./scripts/portable-restore.mjs
 COPY --chown=spaceapp:spaceapp deploy/docker ./deploy/docker
 RUN chmod 0755 deploy/docker/core-entrypoint.sh deploy/docker/browser-entrypoint.sh deploy/docker/cli-entrypoint.sh \
     && install -m 0755 deploy/docker/public-cli-wrapper.sh /usr/local/bin/spaceapp-cli-wrapper \
@@ -73,6 +66,9 @@ RUN chmod 0755 deploy/docker/core-entrypoint.sh deploy/docker/browser-entrypoint
        done
 
 FROM runtime-base AS core
+# Per-target tree: compiled core workspaces, their production node_modules, agent-skills,
+# and the owner/backup scripts (rotate-owner-setup-token.mjs, reset-owner-password.mjs, portable-backup.mjs, portable-restore.mjs).
+COPY --from=build --chown=spaceapp:spaceapp /app-targets/core/ ./
 COPY --chown=spaceapp:spaceapp starter-memory /opt/spaceapp/starter-memory
 # The Databases tool's SQLite worker (apps/api/src/databases/sqlite-worker.py) needs Python 3.12+ with its sqlite3 module;
 # python3-minimal has no sqlite3 (1.1.7 review: SQLite could not run in public installations).
@@ -91,6 +87,7 @@ HEALTHCHECK --interval=15s --timeout=5s --start-period=45s --retries=5 \
 ENTRYPOINT ["/app/deploy/docker/core-entrypoint.sh"]
 
 FROM runtime-base AS browser
+COPY --from=build --chown=spaceapp:spaceapp /app-targets/browser/ ./
 RUN apt-get update \
     && apt-get install -y --no-install-recommends chromium fonts-liberation liblzma5 \
     && rm -rf /var/lib/apt/lists/* \
@@ -103,6 +100,7 @@ ENV SPACE_BROWSER_CHROME_PATH=/usr/bin/chromium \
 ENTRYPOINT ["/app/deploy/docker/browser-entrypoint.sh"]
 
 FROM runtime-base AS cli
+COPY --from=build --chown=spaceapp:spaceapp /app-targets/cli/ ./
 COPY --chown=root:root starter-memory/AGENTS.md /etc/AGENTS.md
 COPY --chown=root:root starter-memory/installation-guide.md /etc/spaceapp-installation-guide.md
 RUN chmod 0644 /etc/AGENTS.md

PUBLIC_EXPORT_MANIFEST.json

@@ -3,7 +3,7 @@
   "schemaVersion": 2,
   "sourceCommit": "8d5bf21b3228e5ea89557ab56b6a3bee352fc5a5",
   "fileCount": 4948,
-  "transformations": 421,
+  "transformations": 423,
   "files": [
     {
       "path": ".gitignore",
@@ -8570,8 +8570,8 @@
     {
       "path": "apps/api/package.json",
       "sourceObjectId": "676dcd5165796b77548b01df98301f12c6cd6e1d",
-      "sha256": "045fd6412a7f53b0a652ecb12508038b030ef0b69fdcc1413502129852bd41fa",
-      "size": 2078
+      "sha256": "f2f1c41903427c10315a65ecc39514dfe777febf3c8899ed9dc3273a7f75db5f",
+      "size": 2052
     },
     {
       "path": "apps/api/src/__tests__/activity-log.test.ts",
@@ -23540,8 +23540,8 @@
     {
       "path": "package-lock.json",
       "sourceObjectId": "bebd5dbb1bc020651af5b6b60e61823bae5fad6b",
-      "sha256": "2bc219913dd6fe9003169bdc3881b33f25f939510b47f58e7c26c2af85124617",
-      "size": 419142
+      "sha256": "d4d2886596cfa962df4ab63835910b3aafceae39a9962140a504876cafcb1db4",
+      "size": 419112
     },
     {
       "path": "package.json",
@@ -23648,8 +23648,8 @@
     {
       "path": "packages/cli-host/src/node-pty-spawn.ts",
       "sourceObjectId": "47f18bfadd5b4ce8afd1da7c166362e8fcc94640",
-      "sha256": "9040fe7bd0fc4fd6554f071fdf918b3d3600de59607c123fa5546b3c99fd96f6",
-      "size": 726
+      "sha256": "697222c207b1610c6e391aee9a01b5e96909c4235459f73de12e6d3a9322987f",
+      "size": 1205
     },
     {
       "path": "packages/cli-host/src/server.ts",

apps/api/package.json

@@ -42,7 +42,6 @@
     "mammoth": "^1.12.0",
     "mysql2": "^3.24.5",
     "nanoid": "^5.1.6",
-    "node-pty": "^1.1.0",
     "pdfjs-dist": "6.3.289",
     "sanitize-html": "^2.18.1",
     "zod": "^4.6.7"