[costajohnt]

Summary

The runner-base stage copies the standalone build as root and then runs RUN chown -R node:node /app. On overlayfs a chown rewrites every file it touches into the new layer, so the published image carries the ~2 GB standalone tree twice. docker history diegosouzapw/omniroute:latest shows it directly:

2.04GB  RUN /bin/sh -c chown -R node:node /app
16.4kB  COPY /app/scripts/dev/healthcheck.mjs ./healthcheck.mjs
28.1MB  COPY /app/node_modules/better-sqlite3 ./node_modules/better-sqlite3
2.03GB  COPY /app/.build/next/standalone ./

This PR sets --chown=node:node on the three COPY --from=builder lines, removes the recursive chown, and hands /app and /app/data to node non-recursively next to the existing mkdir -p /app/data (/app itself is created root-owned by WORKDIR /app in the base stage, and the runtime user still needs to create entries under it and write /app/data when no volume is mounted). runner-web and runner-cli are untouched; they already switch back to root for their own COPYs after this point.

Related Issues

• Closes [BUG] Docker image stores the app twice (~2 GB) because of RUN chown -R node:node /app #13990

Validation

• Change type: build-deploy
• Focused tests and category gates from the golden path: node --import tsx/esm --test tests/unit/dockerfile-*.test.ts tests/unit/docker-build-memory-budget.test.ts (22 pass), npm run check:build-scope, npm run check:changelog-integrity
• npm run lint
• Reconciled with the current active release base; focused checks rerun afterward
• Production-code changes include a new or updated automated test in this PR
• hadolint --failure-threshold error Dockerfile (the CI lint) exits 0 before and after with the same warning set.

Image size

CI does not build the image on PRs, so this was measured locally by rebuilding the runner-base COPY/chown sequence against the real /app tree from diegosouzapw/omniroute:latest (root-owned source files, same node:26-trixie-slim base, linux/arm64). Same content and same instructions as the Dockerfile, without the 10+ minute Next.js build.

	docker history layers	docker image inspect --format '{{.Size}}'
before (COPY + RUN chown -R)	COPY 2.04 GB + chown -R 2.04 GB, 4.38 GB total	1,220,846,106
after (COPY --chown)	COPY --chown 2.04 GB, 2.34 GB total	655,117,142

Runtime check on the fixed image

$ docker run --rm omniroute:after id
uid=1000(node) gid=1000(node) groups=1000(node)
$ docker run --rm omniroute:after ls -ld /app /app/data
drwxr-xr-x 1 node node 4096 /app
drwxr-xr-x 2 node node 4096 /app/data

find /app ! -user node returns only /app/check-permissions.sh (root-owned, mode 755, same as today). Writing to /app/data works without a volume. The server starts and node healthcheck.mjs exits 0.

Tests Added Or Updated

• tests/unit/dockerfile-copy-chown-13990.test.ts: every COPY --from=builder in runner-base carries --chown=node:node, no RUN chown -R in that stage, and /app plus /app/data are still chowned to node. Fails on the current Dockerfile, passes with this change.

Coverage Notes

• No changes under src/, open-sse/, electron/, or bin/.

Reviewer Notes

COPY --chown works on the classic builder too (Docker 17.09+); BuildKit is already required by the existing RUN --mount and COPY --chmod lines.

• The pull for existing users gets smaller too: one ~565 MB compressed layer disappears from the manifest.

[diegosouzapw]

Thanks @costajohnt — merging via the release merge-train. Validated in local merge-train (.claude/worktrees/merge-train-20260918-111718-suite.log) on the devbox @ train tip 7bb373fba5e241964c0ffb17bd03a804700839bb, boarded with 55 sibling PRs: typecheck:core, file-size, complexity, cognitive-complexity, changelog-integrity green; 747/747 changed-area node:test cases + 476/476 vitest green (fast parity mode — the full suite ran today on the release tip via the base-red train and runs again on the 3b train). Merged --admin per merge-gates §7.