ci: image build needs no outbound net — copy job-installed node_modules; base alpine→slim

Dockerfile

@@ -1,21 +1,14 @@
-# Multi-stage build: bun for installs (fast), node for build + runtime.
-# The bun install steps use a BuildKit cache mount (/root/.bun/install/cache, both stages
-# run as root) so the package cache persists across builds on daemons that keep named
-# caches — notably the CI runner's shared dind daemon; where it doesn't persist it costs nothing.
-FROM oven/bun:1.4.2-alpine AS deps
+# Two-stage build needing ZERO outbound network at image-build time:
+# (a) deps are installed by the CI job / dev host (`bun install`) and copied in via the
+#     build context — the runner's dind daemon has broken outbound DNS for build containers,
+#     so any RUN that fetches packages fails;
+# (b) base images must be glibc (node:22-slim), NOT alpine/musl: native modules (@next/swc-*,
+#     sharp) are prebuilt for the platform that ran `bun install` — CI job and prod host are
+#     x86_64 glibc linux. Building on another platform requires reinstalling node_modules there first.
+FROM node:22-slim AS build
 WORKDIR /app
 COPY package.json bun.lock ./
-RUN --mount=type=cache,target=/root/.bun/install/cache bun install --frozen-lockfile
-
-# Production dependencies only — devDeps (typescript, vitest, @types) are build-time only.
-FROM oven/bun:1.4.2-alpine AS prod-deps
-WORKDIR /app
-COPY package.json bun.lock ./
-RUN --mount=type=cache,target=/root/.bun/install/cache bun install --production --frozen-lockfile
-
-FROM node:22-alpine AS build
-WORKDIR /app
-COPY --from=deps /app/node_modules ./node_modules
+COPY node_modules ./node_modules
 COPY . .
 ENV NEXT_TELEMETRY_DISABLED=1
 RUN npm run build
@@ -23,10 +16,12 @@ RUN npm run build
 # No `output: 'standalone'`: the runtime stage keeps node_modules because
 # /api/mlworker/[file] reads maplibre-gl dist files from disk at runtime, and
 # /api/airports reads data/*.csv — both resolved relative to process.cwd().
-FROM node:22-alpine AS runtime
+FROM node:22-slim AS runtime
 WORKDIR /app
 ENV NODE_ENV=production NEXT_TELEMETRY_DISABLED=1
-COPY --from=prod-deps /app/node_modules ./node_modules
+# Full tree (dev+prod deps): a prod-only slimmed copy would need an extra install step,
+# revisit if image size matters.
+COPY --from=build /app/node_modules ./node_modules
 COPY --from=build /app/.next ./.next
 COPY --from=build /app/package.json ./package.json
 COPY --from=build /app/data ./data