[Fix] Docker: Remove Hardcoded Prisma Binary Target For Multi-Arch Builds

[yuneng-berri]

Summary

• PRISMA_CLI_BINARY_TARGETS="debian-openssl-3.0.x" was hardcoded in docker/Dockerfile.non_root by [Feature] Download Prisma binaries at build time instead of at runtime for Security Restricted environments #17695. On a buildx linux/arm64 leg this forces prisma to download the amd64 schema-engine into an arm64 image, so prisma migrate deploy fails at startup with Could not find schema-engine binary (path schema-engine-linux-arm64-openssl-3.0.x).
• Removing the env lets prisma auto-detect per build platform: amd64 builds still resolve to debian-openssl-3.0.x (Wolfi auto-detect falls back to debian — same binary as before, no image-byte change), and arm64 builds now correctly fetch linux-arm64-openssl-3.0.x.
• The offline-cache pre-warm goal of [Feature] Download Prisma binaries at build time instead of at runtime for Security Restricted environments #17695 is preserved — prisma generate + the COPY /app/.cache into runtime + PRISMA_OFFLINE_MODE=true are untouched. Only which binaries fill the cache changes.

Fixes #19458

Test plan

• docker buildx build --platform linux/amd64 -f docker/Dockerfile.non_root . succeeds
• docker buildx build --platform linux/arm64 -f docker/Dockerfile.non_root . succeeds
• On the arm64 image: ls /app/.cache/prisma-python/binaries/node_modules/@prisma/engines/ shows schema-engine-linux-arm64-openssl-3.0.x (not -debian-)
• On the arm64 image: prisma migrate deploy runs without Could not find schema-engine binary
• On the amd64 image: image bytes / behavior unchanged from current main

[greptile-apps]

Greptile Summary

This PR removes the hardcoded PRISMA_CLI_BINARY_TARGETS="debian-openssl-3.0.x" env var from both the builder and runtime stages of docker/Dockerfile.non_root, allowing Prisma to auto-detect the correct binary target for each build platform. The fix is targeted and correct — on amd64 builds, Wolfi auto-detection still resolves to the debian target (no byte change), while arm64 builds now fetch the correct linux-arm64-openssl-3.0.x binary. The offline-cache pre-warm mechanism (PRISMA_OFFLINE_MODE=true, PRISMA_BINARY_CACHE_DIR, and the COPY /app/.cache path) is preserved intact.

Confidence Score: 4/5

Safe to merge — the two-line removal is logically correct and the offline-cache mechanism is untouched.

The fix is minimal and well-justified. Removing the hardcoded env var lets Prisma auto-detect the platform, which is the correct behavior for multi-arch builds. The existing offline-cache infrastructure (PRISMA_OFFLINE_MODE, PRISMA_BINARY_CACHE_DIR, COPY from builder) remains intact. Score is 4 rather than 5 only because all test plan checkboxes are unchecked — no build verification evidence has been provided yet.

No files require special attention beyond confirming schema.prisma does not also hardcode binaryTargets (not changed in this PR).

Important Files Changed

Filename	Overview
docker/Dockerfile.non_root	Removes hardcoded PRISMA_CLI_BINARY_TARGETS="debian-openssl-3.0.x" from both builder and runtime ENV blocks, allowing Prisma to auto-detect the correct binary target per build platform (amd64 or arm64)

_{Reviews (1): Last reviewed commit: "[Fix] Docker: Remove Hardcoded Prisma Bi..." | Re-trigger Greptile}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!