[kmcginnes]

Summary

The runtime image copied the whole repo from the build stage, including client source, tests, tooling configs, lockfiles, and samples/. It now copies only what the entrypoint and server read.

User-facing: none

 runtime
-  COPY --from=deps  /app ./
-  COPY --from=build /app ./
+  COPY --from=deps  node_modules (root, graph-explorer, proxy-server)
+  COPY --from=build docker-entrypoint.sh process-environment.sh setup-ssl.sh
+                    LICENSE NOTICE THIRD_PARTY_LICENSES.txt
+  COPY --from=build packages/graph-explorer/{.env,dist}
+  COPY --from=build packages/graph-explorer-proxy-server/{package.json,cert-info,src}
+  COPY --from=build packages/shared/{package.json,src}

Gone from /graph-explorer, 1,077 files outside node_modules:

• Client source and build inputs: src, public, index.html, package.json, and .browserslistrc. The server serves only dist.
• Tests: *.test.ts files, test-setup.ts, testing.ts, and shared/src/utils/testing. .dockerignore now leaves tests and their helpers out of the build context, so a test-only edit no longer reruns the client build. No runtime module or client entry imports them.
• Install inputs: root package.json, pnpm-lock.yaml, pnpm-workspace.yaml, .npmrc, and .node-version. Node reads "type" from the proxy server's and shared's own package.json, and resolves through the existing node_modules symlinks.
• Tooling and repo config: tsconfig*.json, vite.config.ts, skills-lock.json, Dockerfile, and the .git* and .docker* files.
• samples/: a contributor compose file.

node_modules is unchanged, with an identical listing. The Docker test build now also checks that /explorer/ returns 200 in all three modes, since a missing dist is the likeliest way a trimmed copy breaks.

Evidence

Before: 3,071 files under /graph-explorer outside node_modules.
After: 1,994 files. The new UI check fails with returned 404 on an image with dist/index.html removed, and passes on this image.

Verified live: I built main and this branch and ran both side by side on Docker 29.5.2. Results were identical:

• docker inspect: same ports, entrypoint, workdir, user, and env.
• Modes: HTTP on 80, notebook on 9250, HTTPS on 443 with HOST, and a SageMaker-style run with --restart always and NEPTUNE_NOTEBOOK=true. All answer /status and serve the UI and its JS. Chrome loads the UI with no console errors.
• Config: a config.json mount (read-write and read-only) and a CONFIGURATION_FOLDER_PATH folder give the same .env, defaultConnection.json, and /defaultConnection.
• Certs: user certs mounted into cert-info serve the same fingerprint, and a generated cert survives docker restart.
• Upgrade: a config folder and a cert volume created by the 3.3.0 image work unchanged.
• Stop: docker stop exits 0 in about 0.13s.
• Content: cert-info hashes the same. The client JS is identical apart from the CSS file name, and the CSS drops 4 unused classes Tailwind had generated from test strings, such as .blur from fireEvent.blur.
• Size and Trivy: 875MB before, 867MB after, and 0 HIGH or CRITICAL on both.

Merge Danger

Door: two-way

Impact: image contents

If the server reads a file at runtime that this list drops, the container fails at startup. The three-mode CI run and the checks above cover every startup path. Anyone who docker execs into the container to read source or tests will no longer find them there.

Related

• Related to [Feature Request] Reduce Docker image size #329

[kmcginnes]

Approved