refactor: Update Dockerfile to use glibc-based images for frontend and backend builds, and implement a minimal distroless runtime for improved security and efficiency. Enhance CI workflow with cleanup of old Docker images.

Dockerfile.fast

@@ -1,63 +1,47 @@
 # syntax=docker/dockerfile:1.6
-# Stage 1: Build React frontend
-FROM node:20-alpine AS frontend-builder
+
+# Stage 1: Build React frontend on glibc
+FROM node:20-bookworm-slim AS frontend-builder
 WORKDIR /app/frontend
 
-# Install build dependencies for native modules
-RUN apk add --no-cache python3 make g++
-
-# Set npm config for better performance
+ENV NODE_ENV=production
 RUN npm config set registry https://registry.npmjs.org/ \
-    && npm config set fetch-timeout 300000 \
-    && npm config set fetch-retry-mintimeout 20000 \
-    && npm config set fetch-retry-maxtimeout 120000
+ && npm config set fetch-timeout 300000 \
+ && npm config set fetch-retry-mintimeout 20000 \
+ && npm config set fetch-retry-maxtimeout 120000
 
-# Copy package files first for better caching
 COPY frontend/package*.json ./
-
-# Install dependencies with cache (lockfile может отличаться после overrides/optional deps)
 RUN --mount=type=cache,target=/root/.npm npm install --no-audit --no-fund
 
-# Copy source code (only what's needed for build)
 COPY frontend/src/ ./src/
 COPY frontend/public/ ./public/
 COPY frontend/index.html ./
 COPY frontend/vite.config.js ./
 COPY frontend/eslint.config.js ./
 
-# Build the application with optimized settings
 ENV ROLLUP_SKIP_NODEJS_NATIVE=1
 ENV ROLLUP_NO_NATIVE=1
 RUN npm run build
 
-# Stage 2: Setup Node.js backend and serve everything
-FROM node:20-alpine
+# Stage 2: Install backend deps on glibc
+FROM node:20-bookworm-slim AS backend-builder
 WORKDIR /app
-
-# Set npm config for better performance
+ENV NODE_ENV=production
 RUN npm config set registry https://registry.npmjs.org/ \
-    && npm config set fetch-timeout 300000
+ && npm config set fetch-timeout 300000
 
-# Copy package files first for better caching
 COPY backend/package*.json ./
-
-# Install production dependencies only with optimized flags
 RUN --mount=type=cache,target=/root/.npm npm ci --only=production --no-audit --no-fund
 
-# Copy backend source code (only what's needed)
-COPY backend/server.js ./
+# Stage 3: Minimal runtime (distroless)
+FROM gcr.io/distroless/nodejs20-debian12:nonroot
+WORKDIR /app
 
-# Copy built frontend assets from the previous stage
+# Copy runtime files
+COPY --from=backend-builder /app/node_modules ./node_modules
+COPY backend/server.js ./server.js
 COPY --from=frontend-builder /app/frontend/dist ./public
 
-# Create non-root user for security
-RUN addgroup -g 1001 -S nodejs
-RUN adduser -S nodejs -u 1001
-RUN chown -R nodejs:nodejs /app
-USER nodejs
-
-# The port the backend runs on
 EXPOSE 3001
-
-# Start the server
-CMD ["node", "server.js"] 
+USER nonroot
+CMD ["server.js"]