sync: update from private repo (402599f)

Dockerfile

@@ -2,7 +2,6 @@ FROM node:22-alpine AS builder
 
 WORKDIR /app
 
-# 依存関係のインストール
 COPY package.json package-lock.json* ./
 COPY ui/package.json ui/package-lock.json* ./ui/
 RUN npm ci --ignore-scripts
@@ -19,14 +18,12 @@ RUN apk add --no-cache --virtual .novnc-fetch curl tar \
     && test -f /app/vendor/noVNC/vnc.html \
     && apk del .novnc-fetch
 
-# TypeScript ビルド
 COPY tsconfig.json ./
 COPY src ./src
 COPY ui ./ui
 RUN npm run build:server
 RUN npm run build:ui
 
-# --- ランタイムステージ ---
 FROM node:22-alpine AS runtime
 
 RUN apk add --no-cache \
@@ -36,7 +33,8 @@ RUN apk add --no-cache \
     bash \
     bubblewrap \
     python3 \
-    py3-pip
+    py3-pip \
+    && apk add --no-cache --virtual .native-build-deps build-base
 
 # Pre-bake python packages into the system site-packages (read-only bind-mounted
 # into every bash sandbox). Runtime `pip install` is intentionally unsupported.
@@ -46,22 +44,22 @@ RUN pip3 install --no-cache-dir --break-system-packages -r /tmp/python-requireme
 
 WORKDIR /app
 
-# 本番依存のみインストール
 COPY package.json package-lock.json* ./
-RUN npm ci --omit=dev --ignore-scripts
+RUN npm ci --omit=dev \
+    && npm cache clean --force \
+    && apk del .native-build-deps
 
-# ビルド済み成果物をコピー
 COPY --from=builder /app/dist ./dist
 COPY --from=builder /app/ui/dist ./ui/dist
 COPY --from=builder /app/vendor ./vendor
-# schema.sql は dist に含まれないため個別コピー
-COPY src/db/schema.sql ./dist/db/schema.sql
+COPY pieces ./pieces
+COPY docs ./docs
 
-# デフォルト設定
-COPY config.yaml ./
+# Ship a runnable default while still allowing a read-only config mount.
+COPY config.yaml.example ./config.yaml
 
-# データ永続化ディレクトリ
-RUN mkdir -p /data /workspaces
+RUN mkdir -p /data /workspaces \
+    && chown -R node:node /data /workspaces
 
 ENV NODE_ENV=production \
     PORT=9876 \
@@ -69,4 +67,6 @@ ENV NODE_ENV=production \
 
 EXPOSE 9876
 
-CMD ["node", "dist/index.js"]
+USER node
+
+CMD ["node", "dist/main.js"]