fix(docker): optimize image size — .dockerignore, drop dev deps, split build layers

[thedavidweng]

What

Three targeted changes to shrink the Docker image and speed up rebuilds:

1. .dockerignore — exclude ~69 MB of non-runtime content

The existing .dockerignore already excluded node_modules and .git (~1.6 GB). This PR adds the remaining directories that are never needed inside the container:

Directory	Size	Why exclude
apps/	17 MB	Tauri desktop app source — never installed in Docker
tests/	22 MB	Test suite
website/	26 MB	Docusaurus docs site source
docs/	252 KB	Supplementary documentation
infographic/	1.2 MB	README banner assets
plugins/hermes-achievements/docs/	2.8 MB	Plugin-level docs
nix/ + flake.*	156 KB	Nix packaging
plans/ + .plans/	52 KB	Design docs
packaging/	16 KB	Homebrew/AUR metadata
assets/, acp_registry/	32 KB	README assets, ACP manifest
Dotfiles	44 KB	.env.example, .envrc, .hadolint.yaml, .mailmap, .gitattributes

Impact: ~69 MB less build context transferred to the Docker daemon, and ~69 MB less content surviving into the final image via COPY . ..

2. pyproject.toml — new [docker] extra (drops [dev])

[all] includes [dev], which pulls in debugpy, pytest, pytest-asyncio, pytest-timeout, ty, ruff, and setuptools — none needed in the published image. The new [docker] extra is [all] - [dev].

Impact: ~30–50 MB fewer Python packages in the image.

3. Dockerfile — use --extra docker + split COPY for layer caching

• uv sync --extra all → uv sync --extra docker
• Frontend build (web/ + ui-tui/) now has its own COPY layer, cached independently from Python source changes. A Python-only commit no longer triggers a redundant web/TUI rebuild.

What is NOT included (future work)

The build-only apt packages (gcc, python3-dev, libffi-dev, libolm-dev) remain in the final image. Removing them requires a true multi-stage build (builder → runtime), which is a larger refactor because the runtime code uses Path(__file__).parent.parent to locate optional-mcps/ and .hermes_build_sha — the editable install and full source tree must survive into the runtime stage.

Estimated total impact

Metric	Before	After	Reduction
Build context	~82 MB	~13 MB	84%
Image content (from COPY . .)	includes apps/tests/website	excluded	~69 MB
Python packages	includes dev tools	docker extra	~30–50 MB

[austinpickett]

Hermes Agent Review — 🔴 Request Changes (the new [docker] extra is a no-op duplicate of [all]; the rest is good)

Two of the three changes are genuinely useful. The new dependency extra, however, rests on a false premise.

✅ Keep

• .dockerignore additions — excluding apps/, tests/, website/, docs/, nix/, packaging/, acp_registry/, etc. meaningfully shrinks the build context. Correct (none of those are read by the container runtime).
• Frontend-build layer reordering — copying web/ + ui-tui/ and building them before COPY . . so Python-only source changes don't invalidate the slow web/ui-tui build layer is a real caching win. Good.

🔴 Blocking — the [docker] extra duplicates [all] verbatim

The PR's rationale is that [docker] is "[all] minus [dev]". But [all] on current origin/main does not contain [dev] — there was a deliberate 2026-05-12 policy change (documented in the [all] comment) that already restricts [all] to non-lazy-installable extras only. [all] today is exactly:

cron, cli, pty, mcp, homeassistant, sms, acp, google, web, youtube

…and your new [docker] extra is that same list, member-for-member. So uv sync --extra docker resolves to identical deps as --extra all — the Dockerfile swap changes nothing dependency-wise. What it does add is a second extra that must be kept in lockstep with [all] forever: the moment [all] gains a member, [docker] silently won't, and the image quietly loses a production dep. That's a maintenance/drift hazard for zero benefit.

Ask: drop the [docker] extra from pyproject.toml and revert the Dockerfile back to --extra all (keeping your other --extra anthropic/bedrock/azure-identity/hindsight args, which are unchanged). Keep the .dockerignore and layer-reordering changes — those are the real improvements and I'd approve them on their own.

(If the intent is to guarantee [dev] can never leak into the image, note [all] already excludes it; a regression guard test asserting dev ∉ all would express that intent without a duplicate extra.)

Reviewed by Hermes Agent (diffed the new [docker] extra against [all] on origin/main — identical membership).

[thedavidweng]

@austinpickett Addressed your review — removed the redundant extra and reverted to . The extra now matches main exactly (no added). Kept the additions and frontend build layer reordering. Ready for re-review.

Requested change addressed: the author removed the redundant [docker] extra (commit dc5751f) and reverted to --extra all, exactly as this review asked. Verified against current origin/main — [all] already excludes [dev] (2026-05-12 policy), so the surviving changes are just the .dockerignore additions + frontend-build layer reorder, both of which this review explicitly approved. Built the image on amd64 + arm64 (qemu): clean build, dashboard/TUI assets ship, gateway imports, pytest/ruff correctly absent. Dismissing the stale block.