fixing broken puppeteer providers in docker caused by alpine chromium 146 crashing / switched to debian slim with puppeteer's own chrome for testing / dropped 2-stage build / run as non-root / purge build tools after install, improve docker-test.sh to verify it all works. That's it. ;)

Dockerfile

@@ -1,70 +1,59 @@
-# ================================
-# Stage 1: Build stage
-# ================================
-FROM node:22-alpine AS builder
+FROM node:22-slim
 
-WORKDIR /build
-
-# Install build dependencies needed for native modules (better-sqlite3)
-RUN apk add --no-cache python3 make g++
-
-# Copy package files first for better layer caching
-COPY package.json yarn.lock ./
-
-# Install all dependencies (including devDependencies for building)
-RUN yarn config set network-timeout 600000 \
-  && yarn --frozen-lockfile
-
-# Copy source files needed for build
-COPY index.html vite.config.js ./
-COPY ui ./ui
-COPY lib ./lib
-
-# Build frontend assets
-RUN yarn build:frontend
-
-# ================================
-# Stage 2: Production stage
-# ================================
-FROM node:22-alpine
+# System deps for Chrome for Testing + build tools for native modules (better-sqlite3)
+# Must run as root
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    curl ca-certificates fonts-liberation libasound2 \
+    libatk-bridge2.0-0 libatk1.0-0 libcups2 libdbus-1-3 \
+    libdrm2 libgbm1 libgtk-3-0 libnspr4 libnss3 \
+    libx11-xcb1 libxcomposite1 libxdamage1 libxrandr2 xdg-utils \
+    python3 make g++ \
+  && rm -rf /var/lib/apt/lists/* \
+  && mkdir -p /db /conf /fredy \
+  && chown node:node /db /conf /fredy
 
 WORKDIR /fredy
 
-# Install Chromium and curl (for healthcheck)
-# Using Alpine's chromium package which is much smaller
-RUN apk add --no-cache chromium curl
+# Everything from here runs as the built-in non-root node user (UID 1000)
+USER node
 
 ENV NODE_ENV=production \
-    IS_DOCKER=true \
-    PUPPETEER_SKIP_CHROMIUM_DOWNLOAD=true \
-    PUPPETEER_EXECUTABLE_PATH=/usr/bin/chromium-browser
+    IS_DOCKER=true
 
-# Install build dependencies for native modules, then remove them after yarn install
-COPY package.json yarn.lock ./
+COPY --chown=node:node package.json yarn.lock ./
 
-RUN apk add --no-cache --virtual .build-deps python3 make g++ \
-  && yarn config set network-timeout 600000 \
-  && yarn --frozen-lockfile --production \
-  && yarn cache clean \
-  && apk del .build-deps
+# Install dependencies and purge build tools (only needed to compile better-sqlite3)
+RUN yarn config set network-timeout 600000 \
+  && yarn --frozen-lockfile \
+  && yarn cache clean
 
-# Copy built frontend from builder stage
-COPY --from=builder /build/ui/public ./ui/public
+# Install Chrome for Testing in a separate layer — it's ~150MB and rarely changes,
+# so keeping it separate avoids re-downloading on every code/dependency change
+RUN npx puppeteer browsers install chrome
 
-# Copy application source (only what's needed at runtime)
-COPY index.js ./
-COPY index.html ./
-COPY lib ./lib
+# Purge build tools now that native modules are compiled
+USER root
+RUN apt-get purge -y python3 make g++ \
+  && apt-get autoremove -y \
+  && rm -rf /var/lib/apt/lists/*
+USER node
 
-# Prepare runtime directories and symlinks for data and config
-RUN mkdir -p /db /conf \
-  && chown 1000:1000 /db /conf \
-  && chmod 777 /db /conf \
-  && ln -s /db /fredy/db \
+COPY --chown=node:node index.html vite.config.js ./
+COPY --chown=node:node ui ./ui
+COPY --chown=node:node lib ./lib
+
+RUN yarn build:frontend
+
+COPY --chown=node:node index.js ./
+
+RUN ln -s /db /fredy/db \
   && ln -s /conf /fredy/conf
 
 EXPOSE 9998
 VOLUME /db
 VOLUME /conf
 
+HEALTHCHECK --interval=30s --timeout=10s --start-period=30s --retries=3 \
+  CMD curl -f http://localhost:9998/ || exit 1
+
 CMD ["node", "index.js"]