perf: optimize Dockerfile with uv, cache mounts, and compliance fixes

[mo-radwan1]

Summary

This PR applies comprehensive Dockerfile optimizations based on lessons learned from the enterprise repository, delivering significant build performance improvements while maintaining licensing compliance.

Key Changes

🚀 Performance Optimizations

Build Stage:

• Migrated from pip to uv: 10-100x faster package installation with parallel downloads
• BuildKit cache mounts: Persistent caching across builds for uv and npm
• Optimized layer caching: Install build tools before copying dependency files
• Multi-architecture support: TARGETARCH and TARGETPLATFORM for AMD64 and ARM64

Removed PIP_NO_CACHE_DIR=1:

• Enables caching instead of disabling it
• Works with BuildKit cache mounts for optimal performance

🔒 Licensing & Compliance

Critical compliance fixes based on security review:

Runtime uses pip (not uv):

• Issue: uv has licensing obligations (MIT/Apache-2.0 + hundreds of dependencies)
• Solution: uv ONLY in build stage (discarded), pip in runtime
• Benefit: No uv licensing in final image layers

Layer-level compliance:

• Build stage discarded (no licensing concerns for build tools)
• Runtime stage clean (only pip, which is built-in to Python)

📊 Expected Performance Gains

Scenario	Current	Optimized	Improvement
First build	~180s	~120s	33% faster
Rebuild (code change)	~180s	~40s	78% faster
Rebuild (deps cached)	~180s	~30s	83% faster
Image size	Same	Same	No change

Architecture

Build Stage (Fast)

FROM python:3.11-slim AS base
  - Install build-essential, git, curl, ffmpeg, uv, Node.js

FROM base AS builder
  - Install hatch with uv cache mount ← BEFORE COPY (better caching)
  - Copy dependency files
  - Copy source code
  - Build wheel with uv + npm cache mounts

Runtime Stage (Compliant)

FROM python:3.11-slim AS runtime
  - Install git, ffmpeg (minimal dependencies)
  - Install Playwright with pip (no uv!)
  - Create non-root user
  - Install package with pip (no uv!)
  - NO uv in any runtime layer ✅

Build Commands

Native platform (auto-detect):

docker buildx build -t solace/solace-agent-mesh:latest .

Specific platform:

docker buildx build --platform linux/amd64 -t solace/solace-agent-mesh:latest .

Multi-platform:

docker buildx build --platform linux/amd64,linux/arm64 -t solace/solace-agent-mesh:latest . --push

Testing Checklist

• [ ] Build succeeds on AMD64
• [ ] Build succeeds on ARM64
• [ ] Multi-platform build works
• [ ] Runtime functionality unchanged
• [ ] Playwright still works
• [ ] No uv binary in final image layers
• [ ] Build time improvements verified
• [ ] All dependencies install correctly

Compliance Notes

Licensing:

• ✅ No uv in runtime (no licensing obligations)
• ✅ pip is built-in to Python (no additional licenses)
• ✅ Clean layer history for compliance auditing

Attribution:

• Build stage tools (uv, hatch) are discarded
• Runtime only contains Python stdlib + explicit dependencies

[sonarqube-solacecloud[bot]]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
No data about Duplication

See analysis details on SonarQube

[github-actions[bot]]

WhiteSource Policy Violation Summary

✅︎ No Blocking Whitesource Policy Violations found in solaceai/solace-agent-mesh-pr-446!