chore: add node22 bun base image and tune start

Dockerfile.prod

@@ -0,0 +1,29 @@
+# Runtime image with Node 22 + Bun 1.3.2 and build toolchain preinstalled
+FROM node:22-bullseye-slim
+
+ENV BUN_INSTALL=/root/.bun
+ENV PATH="$BUN_INSTALL/bin:$PATH"
+
+RUN apt-get update -y \
+    && apt-get install -y --no-install-recommends \
+       ca-certificates \
+       curl \
+       gnupg \
+       unzip \
+       build-essential \
+       python3 \
+       make \
+       pkg-config \
+       git \
+    && rm -rf /var/lib/apt/lists/*
+
+# Install Bun 1.3.2
+RUN curl -fsSL https://bun.sh/install \
+    | bash -s -- bun-v1.3.2 \
+    && ln -sf /root/.bun/bin/bun /usr/local/bin/bun \
+    && ln -sf /root/.bun/bin/bun /usr/local/bin/bunx
+
+WORKDIR /app
+
+# We'll mount the app code at runtime; image just provides runtimes/toolchains.
+CMD ["bash"]

scripts/start-web.sh

@@ -17,48 +17,56 @@ echo "[start-web] NEXT_PUBLIC_CONVEX_URL=${NEXT_PUBLIC_CONVEX_URL:-}"
 
 # Ensure system deps for native modules (best-effort, idempotent)
 if command -v apt-get >/dev/null 2>&1; then
-  # Ensure curl/gnupg for NodeSource setup
+  if [ "${SKIP_APT_BOOTSTRAP:-false}" = "true" ]; then
-  if ! command -v curl >/dev/null 2>&1; then
+    echo "[start-web] SKIP_APT_BOOTSTRAP=true; skipping apt bootstrap"
-    apt-get update -y || true
+  else
-    apt-get install -y --no-install-recommends curl ca-certificates gnupg || true
+    # Ensure curl/gnupg for NodeSource setup
-  fi
+    if ! command -v curl >/dev/null 2>&1; then
-
+      apt-get update -y || true
-  install_node() {
+      apt-get install -y --no-install-recommends curl ca-certificates gnupg || true
-    local current_node_major=""
-    if command -v node >/dev/null 2>&1; then
-      current_node_major=$(node -v | sed -E 's/^v([0-9]+).*/\1/')
-      if [ -n "$current_node_major" ] && [ "$current_node_major" -ge 20 ]; then
-        return 0
-      fi
     fi
 
-    echo "[start-web] installing Node.js 22.x via NodeSource"
+    install_node() {
-    curl -fsSL https://deb.nodesource.com/setup_22.x | bash - || true
+      local current_node_major=""
-    apt-get update -y || true
+      if command -v node >/dev/null 2>&1; then
-    apt-get install -y --no-install-recommends nodejs || true
+        current_node_major=$(node -v | sed -E 's/^v([0-9]+).*/\1/')
-  }
+        if [ -n "$current_node_major" ] && [ "$current_node_major" -ge 20 ]; then
+          return 0
+        fi
+      fi
 
-  # Base toolchain for native modules
+      echo "[start-web] installing Node.js 22.x via NodeSource"
-  apt-get update -y || true
+      curl -fsSL https://deb.nodesource.com/setup_22.x | bash - || true
-  apt-get install -y --no-install-recommends build-essential python3 make pkg-config || true
+      apt-get update -y || true
+      apt-get install -y --no-install-recommends nodejs || true
+    }
 
-  if ! command -v openssl >/dev/null 2>&1; then
+    # Base toolchain for native modules
-    echo "[start-web] openssl not found; installing via apt-get (requires root)"
     apt-get update -y || true
-    apt-get install -y --no-install-recommends openssl ca-certificates || true
+    apt-get install -y --no-install-recommends build-essential python3 make pkg-config || true
+
+    if ! command -v openssl >/dev/null 2>&1; then
+      echo "[start-web] openssl not found; installing via apt-get (requires root)"
+      apt-get update -y || true
+      apt-get install -y --no-install-recommends openssl ca-certificates || true
+    fi
+    if ! command -v node >/dev/null 2>&1 && [ -x /usr/bin/nodejs ]; then
+      ln -sf /usr/bin/nodejs /usr/bin/node || true
+    fi
+    install_node
   fi
-  if ! command -v node >/dev/null 2>&1 && [ -x /usr/bin/nodejs ]; then
-    ln -sf /usr/bin/nodejs /usr/bin/node || true
-  fi
-  install_node
 else
   echo "[start-web] apt-get unavailable; skipping system deps install" >&2
 fi
 
 # Rebuild native better-sqlite3 bindings for the current Node version
 if command -v npm >/dev/null 2>&1; then
-  echo "[start-web] rebuilding better-sqlite3 for current Node runtime"
+  if [ "${SKIP_SQLITE_REBUILD:-false}" = "true" ]; then
-  (npm rebuild better-sqlite3 >/dev/null 2>&1 && echo "[start-web] better-sqlite3 rebuilt") || echo "[start-web] rebuild skipped (using existing bindings)"
+    echo "[start-web] skipping better-sqlite3 rebuild (SKIP_SQLITE_REBUILD=true)"
+  else
+    echo "[start-web] rebuilding better-sqlite3 for current Node runtime"
+    (npm rebuild better-sqlite3 >/dev/null 2>&1 && echo "[start-web] better-sqlite3 rebuilt") || echo "[start-web] rebuild skipped (using existing bindings)"
+  fi
 fi
 
 # Bun keeps its store in node_modules/.bun by default; ensure it exists and is writable

stack.yml

@@ -3,7 +3,7 @@ version: "3.8"
 
 services:
   web:
-    image: oven/bun:1.3.2
+    image: sistema_web:node22-bun
     # Rodamos como root para permitir apt-get (Node 22, toolchain) no boot
     user: "root"
     working_dir: /app
@@ -31,6 +31,10 @@ services:
       REPORTS_CRON_BASE_URL: "${REPORTS_CRON_BASE_URL}"
       # Mantém o SQLite fora do repositório
       DATABASE_URL: "file:/app/data/db.sqlite"
+      # Evita apt-get na inicialização porque a imagem já vem com toolchain pronta
+      SKIP_APT_BOOTSTRAP: "true"
+      # Desativa rebuild a cada start (já reempacotado para Node 22 na imagem)
+      SKIP_SQLITE_REBUILD: "true"
       # Usado para forçar novo rollout a cada deploy (setado pelo CI)
       RELEASE_SHA: "${RELEASE_SHA:-dev}"
     deploy:
@@ -66,7 +70,7 @@ services:
       interval: 10s
       timeout: 3s
       retries: 5
-      start_period: 30s
+      start_period: 120s
 
   convex_backend:
     image: sistema_convex_backend:1.29.2