ROADMAP-20 — P2 — Container polish: layer caching, image slimming, pinning, log rotation, dev/prod split #112

Series: ROADMAP — filed from the 2026-10-27 whole-project assessment · Backlog task: M16-T07 · Priority: P2 · Effort: medium

Problem

Container/infra polish gaps:

1. pip install . re-installs all dependencies on every code change: agentkit/ is copied into the builder before install, defeating layer caching (Dockerfile:17–20)
2. The runtime stage copies the whole venv including pip/setuptools/wheel + build tools stay installed
3. Images pinned to major tags only (python:3.12-slim, postgres:16-alpine, redis:7-alpine) — no digests or minor pins
4. No log rotation options, no mem_limit/cpus; default json-file logs grow unbounded
5. One compose file wears both dev and prod hats (no profiles: / compose.dev.yml split), and defines healthcheck + FILE_TOOL_BASE_DIR in two places already
6. Secrets only as env vars (visible via docker inspect); compose secrets:/_FILE pattern unused; rotation needs container recreation

Evidence

• Dockerfile:17–20, 35, 39, 60–61; docker-compose.yml:10, 34, 82, 98, 122, 146–151

Suggested fix / acceptance criteria

• Dependency layer cached (copy metadata/pyproject before install, copy sources after)
• Runtime stage slims pip/setuptools/wheel (or multi-stage wheel copy)
• Digest-pinned (or at least minor-pinned) base images, documented bump policy
• Log rotation on the api/migrations services; minimal dev/prod split documented
• (Optional) _FILE secret pattern for datastore passwords

Suggested branch / commit

chore/container-polish · chore(infra): cache dependency layers and pin images