build(docker): optimize production build with bun runtime

Use pre-built database package dist files and existing bun user from
oven/bun image. Remove npm dependency, fix migration path to use compiled
JavaScript, and ensure drizzle artifacts are included in production build.

Author: eduardez

.dockerignore

@@ -43,7 +43,6 @@ modules.config.local.ts
 
 # Local dev files
 logs/
-drizzle/
 .npm/
 turbo/
 

Dockerfile

@@ -51,16 +51,15 @@ WORKDIR /app
 # and wget for healthcheck
 RUN apt-get update && apt-get install -y --no-install-recommends \
     nodejs \
-    npm \
     wget \
     && rm -rf /var/lib/apt/lists/*
 
 # Copy built application from builder
 COPY --from=builder /app/build ./build
 COPY --from=builder /app/node_modules ./node_modules
 COPY --from=builder /app/package.json ./
-COPY --from=builder /app/packages/database ./packages/database
-COPY --from=builder /app/drizzle ./drizzle
+COPY --from=builder /app/packages/database/drizzle ./packages/database/drizzle
+COPY --from=builder /app/packages/database/dist ./packages/database/dist
 COPY --from=builder /app/modules ./modules
 COPY --from=builder /app/scripts/entrypoint.sh ./scripts/entrypoint.sh
 
@@ -79,10 +78,9 @@ ENV MOLOS_MODULE_DATA_DIR=/data/modules
 # Expose port SvelteKit runs on
 EXPOSE 4173
 
-# Security hardening - run as non-root user
-RUN useradd -m -u 1000 appuser && \
-    chown -R appuser:appuser /app /data
-USER appuser
+# Security hardening - run as non-root user (bun user already exists in oven/bun image)
+RUN chown -R bun:bun /app /data
+USER bun
 
 # Use the entrypoint script to handle migrations and start the server
 ENTRYPOINT ["/app/scripts/entrypoint.sh"]

scripts/entrypoint.sh

@@ -56,7 +56,7 @@ fi
 
 # Run database migrations
 log "Running database migrations..."
-if npx tsx packages/database/src/migrate-unified.ts; then
+if bun /app/packages/database/dist/migrate-unified.js; then
   log "Database migrations completed successfully."
 else
   error "Database migrations failed. Cannot proceed without a properly initialized database."

scripts/link-modules.ts

@@ -252,6 +252,7 @@ async function registerModuleIfNeeded(moduleId: string, modulePath: string): Pro
  */
 async function recordLinkResult(moduleId: string, result: ModuleLinkResult): Promise<void> {
 	try {
+		await loadDatabase();
 		if (result.skipped) {
 			// Record validation failures in the database for tracking
 			if (result.validation && !result.validation.canProceed) {