fix(docker): Railway build timeout due to recursive chown in Dockerfile

[leomerida15]

Describe the bug

The Dockerfile at the project root uses RUN chown -R node:node . after copying and building the entire application. On Railway, this step alone takes approximately 17 minutes, followed by a 6-minute image export. The total build exceeds Railway's 30-minute activity heartbeat limit, causing the deployment to time out even though the build itself completes successfully.

To Reproduce

1. Push any change that triggers a Railway build on service 51327026-1a43-4778-9fcc-c40c2d005d1d
2. Observe the build logs
3. The build completes pnpm build successfully
4. The RUN chown -R node:node . step runs for ~17 minutes
5. Image export takes ~6 minutes
6. Deployment times out during image push

Expected behavior

Build should complete well within the 30-minute platform limit by avoiding expensive recursive ownership changes on large directories like node_modules.

Proposed Fix

Use COPY --chown=node:node and pre-create the workdir with correct ownership before switching to the node user. This eliminates the need for chown -R entirely.

Additional context

• Service ID: 51327026-1a43-4778-9fcc-c40c2d005d1d
• Base image: node:20-alpine
• The recursive chown is O(n) over every file in node_modules and build artifacts, which is why it's so slow.

[jshaofa-ui]

🔧 Solution Proposal

Root Cause

RUN chown -R node:node . recursively changes ownership of ALL files including node_modules, build artifacts, and git history. On large monorepos this takes ~17 minutes.

Proposed Fix

Option A — Selective chown (recommended):
Only chown the files that actually need it, excluding node_modules and build artifacts:

# Instead of: RUN chown -R node:node .
# Use:
RUN chown -R node:node /app/src /app/package.json /app/pnpm-lock.yaml /app/prisma /app/packages/*/src

Option B — Use COPY --chown:
Set ownership during COPY instead of a separate chown step:

COPY --chown=node:node package.json pnpm-lock.yaml ./
COPY --chown=node:node packages/ ./packages/
# ... etc

Option C — Run as root during build, switch at runtime:

# Build as root (no chown needed)
RUN pnpm install && pnpm build

# Switch to node user only for runtime
USER node

Option D — Exclude node_modules from chown:

RUN find . -not -path './node_modules/*' -not -path './.git/*' -exec chown node:node {} +

Recommended Approach

Option C is the cleanest — build as root (standard Docker practice), then USER node only for the runtime stage. The chown was likely added as a workaround for a specific permission issue that can be solved more efficiently.

Impact

• Reduces build time from ~17 min to <30 sec
• Enables Railway deployments to complete within 30-minute limit
• Standard Docker best practice