feat: optimize compression and production deployment

docker/Dockerfile

@@ -1,4 +1,6 @@
-FROM rust:1.92-bookworm AS builder
+# syntax=docker/dockerfile:1.7
+
+FROM rust:1.92-trixie AS builder
 
 WORKDIR /app
 
@@ -14,35 +16,45 @@ COPY src ./src
 COPY migrations ./migrations
 COPY templates ./templates
 
-RUN cargo build --release
+RUN --mount=type=cache,target=/usr/local/cargo/registry,sharing=locked \
+    --mount=type=cache,target=/app/target,sharing=locked \
+    cargo build --release --locked \
+  && cp /app/target/release/imageforge /app/imageforge
 
-FROM node:20-alpine AS frontend-builder
+FROM node:22-alpine AS frontend-builder
 
 WORKDIR /app/frontend
 COPY frontend/package*.json ./
-RUN npm ci
+RUN --mount=type=cache,target=/root/.npm,sharing=locked npm ci
 COPY frontend ./
 RUN npm run build
 
-FROM debian:bookworm-slim
+FROM debian:trixie-slim
 
 RUN apt-get update && apt-get install -y --no-install-recommends \
     ca-certificates \
-    libdav1d6 \
+    curl \
+    libdav1d7 \
   && rm -rf /var/lib/apt/lists/*
 
+RUN groupadd --system --gid 10001 imageforge \
+  && useradd --system --uid 10001 --gid imageforge --home-dir /app --shell /usr/sbin/nologin imageforge
+
 WORKDIR /app
 
-COPY --from=builder /app/target/release/imageforge ./imageforge
+COPY --from=builder /app/imageforge ./imageforge
 COPY --from=frontend-builder /app/frontend/dist ./static
 COPY migrations ./migrations
 
-RUN mkdir -p uploads
+RUN mkdir -p uploads \
+  && chown imageforge:imageforge uploads
 
 ENV HOST=0.0.0.0
 ENV PORT=8080
 
 EXPOSE 8080
 
+USER 10001:10001
+
 CMD ["./imageforge"]