perf(cli): split deployed image dependencies and code into separate layers

The final image stage copied all of /app in one layer, so node_modules
was re-pushed and re-pulled on every deploy even when dependencies were
unchanged. Copy node_modules as its own layer and the bundled code
(via a stage that strips node_modules) separately, so unchanged
dependencies produce an identical blob that registries and workers
already have.

Author: myftija

.changeset/split-image-dependency-layers.md

@@ -0,0 +1,5 @@
+---
+"trigger.dev": patch
+---
+
+Deployed images now ship dependencies and bundled task code as separate layers. Repeat deploys with unchanged dependencies push and pull far less data, making deploys and worker image pulls faster.

packages/cli-v3/src/deploy/buildImage.test.ts

@@ -25,4 +25,32 @@ describe("generateContainerfile", () => {
 
     expect(containerfile).toContain(`FROM ${image} AS base`);
   });
+
+  it.each(["node", "bun"] as BuildRuntime[])(
+    "splits node_modules and app code into separate layers for %s",
+    async (runtime) => {
+      const containerfile = await generateContainerfile({
+        runtime,
+        build: {},
+        image: undefined,
+        indexScript: "index.js",
+        entrypoint: "entrypoint.js",
+      });
+
+      const user = runtime === "bun" ? "bun:bun" : "node:node";
+
+      expect(containerfile).toContain("FROM build AS code");
+      expect(containerfile).toContain("RUN rm -rf node_modules");
+      expect(containerfile).toContain(
+        `COPY --from=build --chown=${user} /app/node_modules ./node_modules`
+      );
+      expect(containerfile).toContain(`COPY --from=code --chown=${user} /app ./`);
+      // The final stage must not copy all of /app from the build stage anymore,
+      // or node_modules would be duplicated across two layers
+      expect(containerfile).not.toContain(`COPY --from=build --chown=${user} /app ./`);
+
+      // node_modules must exist even for projects with zero external dependencies
+      expect(containerfile).toContain("mkdir -p node_modules");
+    }
+  );
 });

packages/cli-v3/src/deploy/buildImage.ts

@@ -772,14 +772,20 @@ ${buildArgs}
 ${buildEnvVars}
 
 COPY --chown=bun:bun package.json ./
-RUN bun install --production --no-save
+# mkdir guards against bun not creating node_modules when there are no dependencies
+RUN bun install --production --no-save && mkdir -p node_modules
 
 # Now copy all the files
 # IMPORTANT: Do this after running npm install because npm i will wipe out the node_modules directory
 COPY --chown=bun:bun . .
 
 ${postInstallCommands}
 
+# App files without node_modules, so the final stage can layer them separately
+FROM build AS code
+
+RUN rm -rf node_modules
+
 FROM build AS indexer
 
 USER bun
@@ -831,8 +837,12 @@ ENV TRIGGER_PROJECT_ID=\${TRIGGER_PROJECT_ID} \
     NODE_EXTRA_CA_CERTS=\${NODE_EXTRA_CA_CERTS} \
     NODE_ENV=production
 
-# Copy the files from the build stage
-COPY --from=build --chown=bun:bun /app ./
+# Dependencies as their own layer: unchanged deps produce an identical blob
+# that registries and workers already have, so repeat deploys skip it
+COPY --from=build --chown=bun:bun /app/node_modules ./node_modules
+
+# Copy the app files (without node_modules) from the code stage
+COPY --from=code --chown=bun:bun /app ./
 
 # Copy the index.json file from the indexer stage
 COPY --from=indexer --chown=bun:bun /app/index.json ./
@@ -877,7 +887,8 @@ ENV NODE_ENV=production
 ENV NPM_CONFIG_UPDATE_NOTIFIER=false
 
 COPY --chown=node:node package.json ./
-RUN npm i --no-audit --no-fund --no-save --no-package-lock
+# mkdir guards against npm not creating node_modules when there are no dependencies
+RUN npm i --no-audit --no-fund --no-save --no-package-lock && mkdir -p node_modules
 
 # Now copy all the files
 # IMPORTANT: Do this after running npm install because npm i will wipe out the node_modules directory
@@ -888,6 +899,11 @@ ${postInstallCommands}
 # IMPORTANT: Doing this again to fix an issue with prisma generate removing the files in node_modules/trigger.dev for some reason...
 COPY --chown=node:node . .
 
+# App files without node_modules, so the final stage can layer them separately
+FROM build AS code
+
+RUN rm -rf node_modules
+
 FROM build AS indexer
 
 USER node
@@ -941,8 +957,12 @@ ENV TRIGGER_PROJECT_ID=\${TRIGGER_PROJECT_ID} \
     NODE_EXTRA_CA_CERTS=\${NODE_EXTRA_CA_CERTS} \
     NODE_ENV=production
 
-# Copy the files from the install stage
-COPY --from=build --chown=node:node /app ./
+# Dependencies as their own layer: unchanged deps produce an identical blob
+# that registries and workers already have, so repeat deploys skip it
+COPY --from=build --chown=node:node /app/node_modules ./node_modules
+
+# Copy the app files (without node_modules) from the code stage
+COPY --from=code --chown=node:node /app ./
 
 # Copy the index.json file from the indexer stage
 COPY --from=indexer --chown=node:node /app/index.json ./