perf(images): cache plugin dependency layers

[HOYALIM]

Summary

Keep sandbox plugin dependency installation cached across source-only and blueprint-only image rebuilds. Both builder and runtime dependency layers now depend on package manifests and lockfiles rather than mutable build outputs.

Changes

• Install builder dependencies before copying plugin source.
• Install production dependencies before copying compiled plugin output and blueprint files.
• Preserve the existing policy-boundary verification and runtime dependency ownership checks after mutable outputs are copied.

Verification

• npx vitest run --project integration test/sandbox-provisioning.test.ts (59 passed)
• npm run source-shape:check
• npm run check:diff
• hadolint Dockerfile (via pre-commit)
• Local Docker build: Docker daemon is unavailable; repository image-build CI provides the runtime build proof.

---

Signed-off-by: Ho Lim subhoya@gmail.com

Summary by CodeRabbit

• Chores
  • Improved Docker build-layer organization to increase build cache efficiency.
  • Separated dependency installation, application compilation, and runtime verification steps for clearer and more reliable container builds.
  • Preserved runtime security checks while streamlining production image assembly.
  • Updated sandbox provisioning test expectations to align with the Dockerfile marker used for permission-mode assertions.

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: ba700da9-9892-4264-92df-307abec75466

📥 Commits

Reviewing files that changed from the base of the PR and between cd81401 and a08298f.

📒 Files selected for processing (2)

• Dockerfile
• test/sandbox-provisioning-helper-permissions.test.ts

🚧 Files skipped from review as they are similar to previous changes (2)

• test/sandbox-provisioning-helper-permissions.test.ts
• Dockerfile

---

📝 Walkthrough

Walkthrough

The Dockerfile reorders builder and runtime stages to isolate dependency installation from source, artifact-copy, build, and verification steps. A provisioning test updates its Dockerfile section marker accordingly.

Changes

Docker build layer reordering

Layer / File(s)	Summary
Builder dependency and build layers Dockerfile, test/sandbox-provisioning-helper-permissions.test.ts	Separates npm ci from source copying and defers npm run build; updates the test’s Dockerfile extraction marker.
Runtime dependency and artifact layers Dockerfile	Copies runtime package manifests earlier, installs production dependencies separately, then copies built artifacts and performs verification afterward.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• NVIDIA/NemoClaw#4777: Updates related Dockerfile runtime cleanup helper handling.

Suggested labels: platform: container

Suggested reviewers: cv

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main change: improving image build performance by caching plugin dependency layers.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

E2E Advisor Recommendation

Required E2E: cloud-onboard
Optional E2E: full-e2e

Workflow run

Full advisor summary

E2E Recommendation Advisor

Base: target/main
Head: HEAD
Confidence: high

Required E2E

• cloud-onboard: Required deterministic validation floor: the Dockerfile change can affect clean image construction, pinned runtime dependencies, and successful hosted onboarding to a usable agent.

Optional E2E

• full-e2e: Useful additional cold-path confidence that the reordered image layers still support fresh sandbox build, onboarding, and an initial assistant response.

New E2E recommendations

• None.

[wscurran]

✨ Thanks for the perf work, @HOYALIM. Optimizing plugin dependency layer caching could speed up image rebuilds. Ready for maintainer review.