perf(ci): build the app image on 16 vCPU, pin node-gyp, and keep the toolchain out of the runtime image

.github/workflows/ci.yml

@@ -155,15 +155,20 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          # Only the app image needs the paid 8-core/32 GB runner: next build
-          # exhausts the free 16 GB one (exit 137). The others build in <5 min.
-          # bs_runner mirrors that per-image sizing on Blacksmith — a single
-          # pinned tier put every image on 8 vCPU, where the non-app builds idle
-          # at 12-15% CPU and under 10% memory.
+          # Only the app image needs a large runner: next build exhausts the free
+          # 16 GB one (exit 137). The others build in <5 min and idle at 12-15%
+          # CPU on 8 vCPU, so they stay on the smaller tiers.
+          #
+          # 16 vCPU on Blacksmith because this build is the critical path to a
+          # deploy — nothing ships until the image is pushed — and its two
+          # dominant steps both scale with cores (`bun install` ~300-400s, `next
+          # build` ~260s). The same `next build` runs on 16 vCPU in the separate
+          # Build App verification job, which does not gate anything; this one
+          # was doing comparable work on half the cores.
           - dockerfile: ./docker/app.Dockerfile
             ecr_repo_secret: ECR_APP
             gh_runner: linux-x64-8-core
-            bs_runner: blacksmith-8vcpu-ubuntu-2404
+            bs_runner: blacksmith-16vcpu-ubuntu-2404
           - dockerfile: ./docker/db.Dockerfile
             ecr_repo_secret: ECR_MIGRATIONS
             gh_runner: ubuntu-latest
@@ -278,7 +283,7 @@ jobs:
             ghcr_image: ghcr.io/simstudioai/simstudio
             ecr_repo_secret: ECR_APP
             gh_runner: linux-x64-8-core
-            bs_runner: blacksmith-8vcpu-ubuntu-2404
+            bs_runner: blacksmith-16vcpu-ubuntu-2404
           - dockerfile: ./docker/db.Dockerfile
             ghcr_image: ghcr.io/simstudioai/migrations
             ecr_repo_secret: ECR_MIGRATIONS

apps/sim/package.json

@@ -263,6 +263,7 @@
     "@types/three": "0.177.0",
     "@vitejs/plugin-react": "^6.0.5",
     "@vitest/coverage-v8": "^4.1.0",
+    "node-gyp": "12.4.0",
     "postcss": "^8",
     "react-email": "6.9.0",
     "tailwindcss": "^3.4.1",

docker/app.Dockerfile

@@ -1,23 +1,42 @@
 # ========================================
-# Base Stage: Debian-based Bun with Node.js 24
+# Base Stage: runtime-only dependencies (inherited by the final image)
 # ========================================
 FROM oven/bun:1.3.14-slim AS base
 
-# Install Node.js 24 (Active LTS) and common dependencies once in base stage.
+# Install Node.js 24 (Active LTS) and the runtime dependencies once in base.
 # Node runs only the isolated-vm sandbox worker (the app itself runs under Bun);
 # the version is kept in lockstep with the `isolated-vm` pin in
 # apps/sim/package.json — Node 24 (ABI 137) requires isolated-vm 6.x.
+#
+# Only what the running container needs belongs here. ffmpeg backs the
+# `fluent-ffmpeg` serverExternalPackage; python3 is the node-gyp interpreter and
+# is kept because build-base inherits from this stage. The compiler toolchain
+# lives in build-base so the runner does not ship it.
 RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
     --mount=type=cache,target=/var/lib/apt,sharing=locked \
     apt-get update && apt-get install -y --no-install-recommends \
-    python3 python3-pip python3-venv make g++ curl ca-certificates bash ffmpeg \
+    python3 curl ca-certificates bash ffmpeg \
     && curl -fsSL https://deb.nodesource.com/setup_24.x | bash - \
     && apt-get install -y nodejs
 
+# ========================================
+# Build Base: adds the native toolchain the isolated-vm rebuild needs
+# ========================================
+FROM base AS build-base
+
+# The compiler toolchain, needed only to build isolated-vm against Node. The
+# runner copies the finished binary from deps, so shipping these would inflate
+# every ECS task pull for nothing: measured 1.21 GB for base against 1.6 GB for
+# build-base, so ~390 MB stays out of the final image.
+RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
+    --mount=type=cache,target=/var/lib/apt,sharing=locked \
+    apt-get update && apt-get install -y --no-install-recommends \
+    python3-pip python3-venv make g++
+
 # ========================================
 # Pruner Stage: Emit a minimal monorepo subset that sim depends on
 # ========================================
-FROM base AS pruner
+FROM build-base AS pruner
 WORKDIR /app
 
 RUN bun install -g turbo@2.9.6
@@ -29,7 +48,7 @@ RUN turbo prune sim --docker
 # ========================================
 # Dependencies Stage: Install Dependencies
 # ========================================
-FROM base AS deps
+FROM build-base AS deps
 WORKDIR /app
 
 # Pruned manifests from the pruner stage. This layer only invalidates when
@@ -44,15 +63,22 @@ COPY --from=pruner /app/bun.lock ./bun.lock
 # Install all dependencies (including devDependencies — tailwindcss/postcss are
 # devDeps but required at build time). Then rebuild isolated-vm against Node.js.
 # JOBS=4 caps node-gyp parallelism — higher values OOM isolated-vm (laverdet/isolated-vm#428).
+#
+# node-gyp comes from the lockfile, not `npx`. It is a devDependency of apps/sim
+# purely so `turbo prune sim` keeps it: the only other copy is transitive through
+# `@electron/rebuild`, which belongs to apps/desktop and is pruned away. `npx`
+# resolved it from the registry at build time, which pulled a different major
+# (13.x vs the pinned 12.4.0) and bypassed the `minimumReleaseAge` supply-chain
+# gate in bunfig.toml on every production image build.
 RUN --mount=type=cache,id=bun-cache,target=/root/.bun/install/cache \
     --mount=type=cache,id=npm-cache,target=/root/.npm \
     HUSKY=0 bun install --ignore-scripts --linker=hoisted && \
-    cd node_modules/isolated-vm && JOBS=4 npx node-gyp rebuild --release
+    cd node_modules/isolated-vm && JOBS=4 /app/node_modules/.bin/node-gyp rebuild --release
 
 # ========================================
 # Builder Stage: Build the Application
 # ========================================
-FROM base AS builder
+FROM build-base AS builder
 ARG TARGETPLATFORM
 WORKDIR /app