perf(deploy): 瘦身镜像 2.85G→2.18G——剥离 .next 构建缓存、消除 chown 重复层

- 构建后 rm -rf apps/web/.next/cache：189M webpack/swc 缓存仅 next build/dev 使用，next start 不读
- .next 改用 COPY --chown=node:node：拷入即定属主，免去末尾递归 chown 复制整层
- 末层只 chown 空目录(output/HOME/webpack 缓存) + 仅 chmod 777 .remotion 目录；
  chrome 文件靠默认 umask 022 已是 a+rx，node 可读可执行，无需递归 chown（原 chown -R 在 overlayfs 下复制了 ~470M）

Co-Authored-By: Claude <noreply@anthropic.com>

Dockerfile

@@ -31,7 +31,11 @@ RUN pnpm config set registry https://registry.npmmirror.com && \
 FROM deps AS build
 
 COPY . .
-RUN pnpm build
+# `next start` only reads .next/{server,static,types,*.json}; the 189MB
+# .next/cache is a webpack/swc build cache used solely by `next build`/dev.
+# Drop it here so it never enters the runtime COPY (and never gets re-duplicated
+# by the writable-dirs step below).
+RUN pnpm build && rm -rf apps/web/.next/cache
 
 # Stage 3: Runtime — fresh prod install with hoisted layout
 FROM node:22-bookworm-slim AS runtime
@@ -77,7 +81,7 @@ RUN mkdir -p node_modules/@pipeline && \
 
 # Copy build artifacts (dist, .next, template src for Remotion entry, etc.)
 COPY --from=build /app/apps/cli/dist apps/cli/dist/
-COPY --from=build /app/apps/web/.next apps/web/.next/
+COPY --from=build --chown=node:node /app/apps/web/.next apps/web/.next/
 COPY --from=build /app/apps/web/next.config.mjs apps/web/
 COPY --from=build /app/apps/web/src apps/web/src/
 COPY --from=build /app/packages/shared/dist packages/shared/dist/
@@ -119,23 +123,23 @@ RUN set -eux; \
     printf '%s' "$VERSION" > "$CACHE/VERSION"
 
 # Run as the non-root `node` user (uid/gid 1000, shipped in the base image) so
-# the image is Pod Security "restricted"-friendly. Only the writable paths are
-# chowned to keep the layer small: the PVC-backed output, Next.js' .next cache,
-# and a HOME for Remotion's browser / faster-whisper model download cache.
+# the image is Pod Security "restricted"-friendly. We only chown the SMALL,
+# empty runtime-writable dirs (output, HOME, webpack cache). We deliberately do
+# NOT `chown -R` over .next or the Remotion chrome tree: in overlayfs a
+# recursive chown copies every touched file into a fresh layer, which here
+# duplicated ~470MB (.next + chrome) for no functional benefit.
+#   - .next is already node-owned via `COPY --chown` above.
+#   - The Remotion chrome under .remotion is root-owned but world a+rx (default
+#     umask 022 plus the explicit `chmod +x` on the binary), so the node user
+#     can read and execute it. We only chmod the .remotion *directory* 777 so a
+#     stray write (none expected once chrome is pre-placed) can still succeed.
 ENV HOME=/home/node
-# Remotion downloads its headless Chrome into <projectRoot>/node_modules/.remotion
-# (see @remotion/renderer browser/get-download-destination.js — it walks up to the
-# nearest package.json, here /app, then uses node_modules/.remotion), and the
-# bundler's webpack writes a cache to packages/templates/node_modules/.cache. Both
-# node_modules trees are root-owned from the build, but the container runs as the
-# non-root `node` user, so these runtime-writable cache dirs must be pre-created
-# and chowned — otherwise rendering aborts with
-# `EACCES: permission denied, mkdir '/app/node_modules/.remotion'`.
 RUN mkdir -p /app/output /home/node \
       /app/node_modules/.remotion \
       /app/packages/templates/node_modules/.cache && \
-    chown -R node:node /app/output /home/node /app/apps/web/.next \
-      /app/node_modules/.remotion /app/packages/templates/node_modules/.cache
+    chown -R node:node /app/output /home/node \
+      /app/packages/templates/node_modules/.cache && \
+    chmod 777 /app/node_modules/.remotion
 USER node
 
 EXPOSE 3000