build(docker): slim backend image, static frontend image, -docling variant

Backend (arc53/docsgpt): 4.5 GB compressed -> 0.9 GB with both embedding
models and tiktoken baked in.
- torch/transformers gone from the default install (docling extra only).
- Ubuntu 24.04 ships python3.12: no deadsnakes PPA, no software-properties-
  common; every pin is a wheel, so no gcc/g++/rust in the builder.
- COPY --chown and a prefetch that runs as the process user replace the
  trailing chown -R, which duplicated the 600 MB model layer.
- .dockerignore keeps __pycache__, .coverage, local indexes and .env out.
- EXTRAS build arg (INSTALL_DOCLING kept as an alias); the docling variant
  also bakes docling's layout/table/RapidOCR models (DOCLING_ARTIFACTS_PATH)
  and tesseract, and drops only the discovery documents of Google APIs the
  app never builds.
- FLASK_DEBUG env removed (unused); OCI labels added.

Frontend (arc53/docsgpt-fe): 302 MB Vite dev server -> 25 MB static build
behind nginx. VITE_* variables are injected at container start into
/config.js and read through src/env.ts, so the image no longer needs a
rebuild per deployment; docker-compose.yaml keeps hot reload via the dev
target.

Publishing: every release and develop build now pushes a slim tag and a
-docling tag (docling engine + models + tesseract). docker-compose-hub.yaml
takes DOCSGPT_IMAGE_TAG / DOCSGPT_IMAGE_VARIANT; docker-compose-standalone.yaml
runs the stack from pre-built images without a checkout and is attached to
each release. setup.sh selects the -docling variant for OCR instead of
requiring a local build. A new workflow builds the image on PRs that touch
it and runs verify_offline under --network none; lint checks the exported
requirements match uv.lock.

frontend/.dockerignore

@@ -0,0 +1,7 @@
+node_modules/
+dist/
+.env
+.env.*
+Dockerfile
+.dockerignore
+*.log

frontend/Dockerfile

@@ -1,11 +1,52 @@
-FROM node:22-bullseye-slim
+# DocsGPT frontend image: a static production build served by nginx.
+#
+# Vite inlines VITE_* settings at build time, so the old image ran the Vite
+# dev server just to read VITE_API_HOST from the container environment. This
+# image builds once and injects the container's VITE_* variables at start-up
+# instead (docker/40-runtime-env.sh writes them to /config.js, which the app
+# reads before its own bundle; see src/env.ts). Same env vars, same port.
+#
+# Targets:
+#   (default)  nginx serving the built bundle -- what Docker Hub publishes
+#   dev        the Vite dev server with hot reload, for docker-compose.yaml's
+#              bind-mounted frontend (build: target: dev)
 
+FROM node:22-alpine AS deps
 
 WORKDIR /app
 COPY package*.json ./
-RUN npm install
+RUN npm ci --no-audit --no-fund
+
+
+FROM deps AS dev
+
 COPY . .
-
+# vite.config.ts polls the filesystem when DOCKER is set: native fs events do
+# not cross a Windows host into a Linux container.
+ENV DOCKER=1
 EXPOSE 5173
+CMD ["npm", "run", "dev", "--", "--host"]
 
-CMD [ "npm", "run", "dev", "--" , "--host"]
+
+FROM deps AS build
+
+COPY . .
+# Bake nothing deployment-specific; the runtime script supplies it.
+ENV VITE_API_HOST=""
+RUN npm run build && \
+    sed -i 's|<head>|<head><script src="/config.js"></script>|' dist/index.html
+
+
+FROM nginx:1.27-alpine
+
+LABEL org.opencontainers.image.source="https://github.com/arc53/DocsGPT" \
+      org.opencontainers.image.title="DocsGPT frontend" \
+      org.opencontainers.image.licenses="MIT"
+
+COPY docker/nginx.conf /etc/nginx/conf.d/default.conf
+COPY docker/40-runtime-env.sh /docker-entrypoint.d/40-runtime-env.sh
+RUN chmod +x /docker-entrypoint.d/40-runtime-env.sh
+COPY --from=build /app/dist /usr/share/nginx/html
+
+# Same port the dev server used, so compose files and docs keep working.
+EXPOSE 5173

frontend/docker/40-runtime-env.sh

@@ -0,0 +1,23 @@
+#!/bin/sh
+# Expose the container's VITE_* environment to the static bundle.
+#
+# nginx's entrypoint runs everything in /docker-entrypoint.d before serving.
+# The generated /config.js is loaded by index.html ahead of the app bundle and
+# read by src/env.ts, so VITE_API_HOST and friends can differ per deployment
+# without rebuilding the image.
+set -eu
+
+out=/usr/share/nginx/html/config.js
+{
+  printf 'window.__DOCSGPT_ENV__ = {'
+  first=1
+  env | grep -E '^VITE_[A-Za-z0-9_]+=' | while IFS='=' read -r key value; do
+    # JSON-escape backslashes and double quotes; values are plain URLs/ids.
+    escaped=$(printf '%s' "$value" | sed 's/\\/\\\\/g; s/"/\\"/g')
+    if [ "$first" -eq 1 ]; then first=0; else printf ','; fi
+    printf '"%s":"%s"' "$key" "$escaped"
+  done
+  printf '};\n'
+} > "$out"
+
+echo "runtime-env: wrote $(grep -o 'VITE_[A-Za-z0-9_]*' "$out" | wc -l | tr -d ' ') VITE_* values to /config.js"

frontend/docker/nginx.conf

@@ -0,0 +1,25 @@
+server {
+    listen 5173;
+    server_name _;
+    root /usr/share/nginx/html;
+    index index.html;
+
+    gzip on;
+    gzip_types text/plain text/css application/javascript application/json image/svg+xml;
+
+    # Hashed bundle assets are immutable; index.html and config.js are not.
+    location /assets/ {
+        add_header Cache-Control "public, max-age=31536000, immutable";
+        try_files $uri =404;
+    }
+
+    location = /config.js {
+        add_header Cache-Control "no-store";
+    }
+
+    # Single-page app: every unknown path renders index.html.
+    location / {
+        add_header Cache-Control "no-cache";
+        try_files $uri $uri/ /index.html;
+    }
+}

frontend/src/App.tsx

@@ -1,3 +1,4 @@
+import { envVar } from '@/env';
 import './locale/i18n';
 
 import { useState } from 'react';
@@ -108,8 +109,8 @@ export default function App() {
     const saved = localStorage.getItem('showNotification');
     return saved ? JSON.parse(saved) : true;
   });
-  const notificationText = import.meta.env.VITE_NOTIFICATION_TEXT;
-  const notificationLink = import.meta.env.VITE_NOTIFICATION_LINK;
+  const notificationText = envVar('VITE_NOTIFICATION_TEXT');
+  const notificationLink = envVar('VITE_NOTIFICATION_LINK');
   // Hide the changelog banner on public share routes — those pages are
   // embedded / shared externally and shouldn't carry product chrome.
   const isPublicShareRoute =

frontend/src/agents/agentPreviewSlice.ts

@@ -1,3 +1,4 @@
+import { envVar } from '@/env';
 import { createAsyncThunk, createSlice, PayloadAction } from '@reduxjs/toolkit';
 
 import {
@@ -26,7 +27,7 @@ const initialState: ConversationState = {
   conversationId: null,
 };
 
-const API_STREAMING = import.meta.env.VITE_API_STREAMING === 'true';
+const API_STREAMING = envVar('VITE_API_STREAMING') === 'true';
 
 let abortController: AbortController | null = null;
 export function handlePreviewAbort() {

frontend/src/api/client.ts

@@ -1,7 +1,8 @@
+import { envVar } from '@/env';
 import { withThrottle, type FetchLike } from './throttle';
 
 export const baseURL =
-  import.meta.env.VITE_API_HOST || 'https://docsapi.arc53.com';
+  envVar('VITE_API_HOST') || 'https://docsapi.arc53.com';
 
 const getHeaders = (
   token: string | null,

frontend/src/components/GoogleDrivePicker.tsx

@@ -1,3 +1,4 @@
+import { envVar } from '@/env';
 import React, { useState, useEffect } from 'react';
 import { useTranslation } from 'react-i18next';
 import drivePickerImport from 'react-google-drive-picker';
@@ -121,9 +122,9 @@ const GoogleDrivePicker: React.FC<GoogleDrivePickerProps> = ({
     }
 
     try {
-      const clientId: string = import.meta.env.VITE_GOOGLE_CLIENT_ID;
+      const clientId: string = envVar('VITE_GOOGLE_CLIENT_ID');
       const developerKey: string =
-        import.meta.env.VITE_GOOGLE_PICKER_API_KEY ?? '';
+        envVar('VITE_GOOGLE_PICKER_API_KEY') ?? '';
 
       // Derive appId from clientId (extract numeric part before first dash)
       const appId = clientId ? clientId.split('-')[0] : null;

frontend/src/components/MessageInput.tsx

@@ -1,3 +1,4 @@
+import { envVar } from '@/env';
 import {
   useCallback,
   useEffect,
@@ -63,7 +64,7 @@ const LIVE_TRANSCRIPTION_TIMESLICE_MS = 1000;
 const LIVE_CAPTURE_SAMPLE_RATE = 16000;
 const LIVE_CAPTURE_MAX_BUFFER_SECONDS = 20;
 const LIVE_SILENCE_RMS_THRESHOLD = 0.015;
-const ENABLE_VOICE_INPUT = import.meta.env.VITE_ENABLE_VOICE_INPUT === 'true';
+const ENABLE_VOICE_INPUT = envVar('VITE_ENABLE_VOICE_INPUT') === 'true';
 
 type AudioContextWindow = Window &
   typeof globalThis & {
@@ -526,7 +527,7 @@ export default function MessageInput({
       if (supported.length === 0) return;
       const files = supported;
 
-      const apiHost = import.meta.env.VITE_API_HOST;
+      const apiHost = envVar('VITE_API_HOST');
 
       if (files.length > 1) {
         const formData = new FormData();

frontend/src/conversation/ConversationBubble.tsx

@@ -1,3 +1,4 @@
+import { envVar } from '@/env';
 import 'katex/dist/katex.min.css';
 
 import { Pencil } from 'lucide-react';
@@ -37,7 +38,7 @@ import ResearchProgress from './ResearchProgress';
 import { ToolCallsType } from './types';
 import { wikiWriteActionKey, wikiWritePath } from './wikiToolCall';
 
-const DisableSourceFE = import.meta.env.VITE_DISABLE_SOURCE_FE || false;
+const DisableSourceFE = envVar('VITE_DISABLE_SOURCE_FE') || false;
 
 const ConversationBubble = forwardRef<
   HTMLDivElement,

frontend/src/conversation/conversationSlice.ts

@@ -1,3 +1,4 @@
+import { envVar } from '@/env';
 import {
   createAsyncThunk,
   createListenerMiddleware,
@@ -90,8 +91,8 @@ const initialState: ConversationState = {
   conversationId: null,
 };
 
-const API_STREAMING = import.meta.env.VITE_API_STREAMING === 'true';
-const USE_V1_API = import.meta.env.VITE_USE_V1_API === 'true';
+const API_STREAMING = envVar('VITE_API_STREAMING') === 'true';
+const USE_V1_API = envVar('VITE_USE_V1_API') === 'true';
 
 let abortController: AbortController | null = null;
 export function handleAbort() {

frontend/src/conversation/sharedConversationSlice.ts

@@ -1,3 +1,4 @@
+import { envVar } from '@/env';
 import { createSlice } from '@reduxjs/toolkit';
 import type { PayloadAction } from '@reduxjs/toolkit';
 import store from '../store';
@@ -12,7 +13,7 @@ import {
   clearAttachments,
 } from '../upload/uploadSlice';
 
-const API_STREAMING = import.meta.env.VITE_API_STREAMING === 'true';
+const API_STREAMING = envVar('VITE_API_STREAMING') === 'true';
 interface SharedConversationsType {
   queries: Query[];
   apiKey?: string;

frontend/src/env.ts

@@ -0,0 +1,24 @@
+/**
+ * Runtime-overridable build settings.
+ *
+ * Vite inlines `import.meta.env.VITE_*` at build time, which forced the
+ * Docker image to run the dev server so `VITE_API_HOST` could change per
+ * deployment. The production image serves a static build instead and writes
+ * the container's `VITE_*` environment into `window.__DOCSGPT_ENV__` (see
+ * frontend/docker/40-runtime-env.sh). That object wins over the build-time
+ * value; outside Docker nothing sets it and the build-time value applies.
+ */
+
+declare global {
+  interface Window {
+    __DOCSGPT_ENV__?: Record<string, string | undefined>;
+  }
+}
+
+export function envVar(name: string): string {
+  const runtime =
+    typeof window !== 'undefined' ? window.__DOCSGPT_ENV__?.[name] : undefined;
+  if (runtime !== undefined && runtime !== '') return runtime;
+  const buildTime = (import.meta.env as Record<string, unknown>)[name];
+  return typeof buildTime === 'string' ? buildTime : '';
+}

frontend/src/modals/AgentDetailsModal.tsx

@@ -1,3 +1,4 @@
+import { envVar } from '@/env';
 import { useEffect, useState } from 'react';
 import { useTranslation } from 'react-i18next';
 import { useSelector } from 'react-redux';
@@ -13,7 +14,7 @@ import { ActiveState } from '../models/misc';
 import { selectToken } from '../preferences/preferenceSlice';
 import ConfirmationModal from './ConfirmationModal';
 
-const baseURL = import.meta.env.VITE_BASE_URL;
+const baseURL = envVar('VITE_BASE_URL');
 
 type AgentDetailsModalProps = {
   agent: Agent;

frontend/src/upload/Upload.tsx

@@ -1,3 +1,4 @@
+import { envVar } from '@/env';
 import { useCallback, useEffect, useState } from 'react';
 import { nanoid } from '@reduxjs/toolkit';
 import { useDropzone } from 'react-dropzone';
@@ -575,7 +576,7 @@ function Upload({
       JSON.stringify(optionsToConfig(retrievalOptions)),
     );
 
-    const apiHost = import.meta.env.VITE_API_HOST;
+    const apiHost = envVar('VITE_API_HOST');
     const xhr = new XMLHttpRequest();
 
     dispatch(
@@ -706,7 +707,7 @@ function Upload({
 
     formData.append('data', JSON.stringify(configData));
 
-    const apiHost: string = import.meta.env.VITE_API_HOST;
+    const apiHost: string = envVar('VITE_API_HOST');
     const endpoint =
       ingestor.type === 'local_file'
         ? `${apiHost}/api/upload`

frontend/src/upload/types/ingestor.ts

@@ -1,3 +1,4 @@
+import { envVar } from '@/env';
 import CrawlerIcon from '../../assets/crawler.svg';
 import FileUploadIcon from '../../assets/file_upload.svg';
 import UrlIcon from '../../assets/url.svg';
@@ -146,7 +147,7 @@ export const IngestorFormSchemas: IngestorSchema[] = [
     icon: DriveIcon,
     heading: 'Upload from Google Drive',
     validate: () => {
-      const googleClientId = import.meta.env.VITE_GOOGLE_CLIENT_ID;
+      const googleClientId = envVar('VITE_GOOGLE_CLIENT_ID');
       return !!googleClientId;
     },
     fields: [
@@ -208,7 +209,7 @@ export const IngestorFormSchemas: IngestorSchema[] = [
     icon: SharePoint,
     heading: 'Upload from Share Point',
     validate: () => {
-      const sharePointClientId = import.meta.env.VITE_SHARE_POINT_CLIENT_ID;
+      const sharePointClientId = envVar('VITE_SHARE_POINT_CLIENT_ID');
       return !!sharePointClientId;
     },
     fields: [
@@ -226,7 +227,7 @@ export const IngestorFormSchemas: IngestorSchema[] = [
     icon: ConfluenceIcon,
     heading: 'Upload from Confluence',
     validate: () => {
-      const confluenceClientId = import.meta.env.VITE_CONFLUENCE_CLIENT_ID;
+      const confluenceClientId = envVar('VITE_CONFLUENCE_CLIENT_ID');
       return !!confluenceClientId;
     },
     fields: [