fix: switch Docker images from Alpine to Debian slim for native addon compatibility

Alpine (musl libc) is incompatible with matrix-sdk-crypto-nodejs native binary
which requires glibc's ld-linux-x86-64.so.2. Switched all Node.js Dockerfiles
to node:24-slim (Debian/glibc). Also fixed docker-compose.matrix.yml network
naming from undefined mosaic-network to mosaic-internal.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

apps/api/Dockerfile

@@ -2,7 +2,9 @@
 # Enable BuildKit features for cache mounts
 
 # Base image for all stages
-FROM node:24-alpine AS base
+# Uses Debian slim (glibc) instead of Alpine (musl) because native Node.js addons
+# (matrix-sdk-crypto-nodejs, Prisma engines) require glibc-compatible binaries.
+FROM node:24-slim AS base
 
 # Install pnpm globally
 RUN corepack enable && corepack prepare pnpm@10.27.0 --activate
@@ -53,16 +55,17 @@ RUN pnpm turbo build --filter=@mosaic/api --force
 # ======================
 # Production stage
 # ======================
-FROM node:24-alpine AS production
+FROM node:24-slim AS production
 
 # Remove npm (unused in production — we use pnpm) to reduce attack surface
 RUN rm -rf /usr/local/lib/node_modules/npm /usr/local/bin/npm /usr/local/bin/npx
 
 # Install dumb-init for proper signal handling
-RUN apk add --no-cache dumb-init
+RUN apt-get update && apt-get install -y --no-install-recommends dumb-init \
+    && rm -rf /var/lib/apt/lists/*
 
 # Create non-root user
-RUN addgroup -g 1001 -S nodejs && adduser -S nestjs -u 1001
+RUN groupadd -g 1001 nodejs && useradd -m -u 1001 -g nodejs nestjs
 
 WORKDIR /app
 

apps/orchestrator/Dockerfile

@@ -2,7 +2,8 @@
 # Enable BuildKit features for cache mounts
 
 # Base image for all stages
-FROM node:24-alpine AS base
+# Uses Debian slim (glibc) instead of Alpine (musl) for native addon compatibility.
+FROM node:24-slim AS base
 
 # Install pnpm globally
 RUN corepack enable && corepack prepare pnpm@10.27.0 --activate
@@ -57,7 +58,7 @@ RUN find ./apps/orchestrator/dist \( -name '*.spec.js' -o -name '*.spec.js.map'
 # ======================
 # Production stage
 # ======================
-FROM node:24-alpine AS production
+FROM node:24-slim AS production
 
 # Add metadata labels
 LABEL maintainer="mosaic-team@mosaicstack.dev"
@@ -72,10 +73,11 @@ LABEL org.opencontainers.image.description="Agent orchestration service for Mosa
 RUN rm -rf /usr/local/lib/node_modules/npm /usr/local/bin/npm /usr/local/bin/npx
 
 # Install wget and dumb-init
-RUN apk add --no-cache wget dumb-init
+RUN apt-get update && apt-get install -y --no-install-recommends wget dumb-init \
+    && rm -rf /var/lib/apt/lists/*
 
 # Create non-root user
-RUN addgroup -g 1001 -S nodejs && adduser -S nestjs -u 1001
+RUN groupadd -g 1001 nodejs && useradd -m -u 1001 -g nodejs nestjs
 
 WORKDIR /app
 

apps/web/Dockerfile

@@ -2,7 +2,9 @@
 # Enable BuildKit features for cache mounts
 
 # Base image for all stages
-FROM node:24-alpine AS base
+# Uses Debian slim (glibc) for consistency with API/orchestrator and to prevent
+# future native addon compatibility issues with Alpine's musl libc.
+FROM node:24-slim AS base
 
 # Install pnpm globally
 RUN corepack enable && corepack prepare pnpm@10.27.0 --activate
@@ -75,7 +77,7 @@ RUN mkdir -p ./apps/web/public
 # ======================
 # Production stage
 # ======================
-FROM node:24-alpine AS production
+FROM node:24-slim AS production
 
 # Remove npm (unused in production — we use pnpm) to reduce attack surface
 RUN rm -rf /usr/local/lib/node_modules/npm /usr/local/bin/npm /usr/local/bin/npx
@@ -84,10 +86,11 @@ RUN rm -rf /usr/local/lib/node_modules/npm /usr/local/bin/npm /usr/local/bin/npx
 RUN corepack enable && corepack prepare pnpm@10.27.0 --activate
 
 # Install dumb-init for proper signal handling
-RUN apk add --no-cache dumb-init
+RUN apt-get update && apt-get install -y --no-install-recommends dumb-init \
+    && rm -rf /var/lib/apt/lists/*
 
 # Create non-root user
-RUN addgroup -g 1001 -S nodejs && adduser -S nextjs -u 1001
+RUN groupadd -g 1001 nodejs && useradd -m -u 1001 -g nodejs nextjs
 
 WORKDIR /app
 

docker/docker-compose.matrix.yml

@@ -60,7 +60,7 @@ services:
       postgres:
         condition: service_healthy
     networks:
-      - mosaic-network
+      - mosaic-internal
 
   # ======================
   # Synapse (Matrix Homeserver)
@@ -76,9 +76,9 @@ services:
       - "${SYNAPSE_CLIENT_PORT:-8008}:8008"
       - "${SYNAPSE_FEDERATION_PORT:-8448}:8448"
     volumes:
-      - ./matrix/synapse/homeserver.yaml:/data/homeserver.yaml:ro
+      - /opt/mosaic/synapse/homeserver.yaml:/data/homeserver.yaml:ro
-      - synapse_data:/data/media_store
+      - /opt/mosaic/synapse/media_store:/data/media_store
-      - synapse_signing_key:/data/keys
+      - /opt/mosaic/synapse/keys:/data/keys
     depends_on:
       postgres:
         condition: service_healthy
@@ -91,7 +91,7 @@ services:
       retries: 5
       start_period: 30s
     networks:
-      - mosaic-network
+      - mosaic-internal
     labels:
       com.mosaic.service: "matrix-synapse"
       com.mosaic.description: "Matrix homeserver (dev)"
@@ -106,7 +106,7 @@ services:
     ports:
       - "${ELEMENT_PORT:-8501}:80"
     volumes:
-      - ./matrix/element/config.json:/app/config.json:ro
+      - /opt/mosaic/synapse/element-config.json:/app/config.json:ro
     depends_on:
       synapse:
         condition: service_healthy
@@ -117,13 +117,7 @@ services:
       retries: 3
       start_period: 10s
     networks:
-      - mosaic-network
+      - mosaic-internal
     labels:
       com.mosaic.service: "matrix-element"
       com.mosaic.description: "Element Web client (dev)"
-
-volumes:
-  synapse_data:
-    name: mosaic-synapse-data
-  synapse_signing_key:
-    name: mosaic-synapse-signing-key