Merge remote-tracking branch 'upstream/main'

docker/deploy/backend.Dockerfile

@@ -1,13 +1,11 @@
 # syntax=docker/dockerfile:1
 
-# Base image (Debian-based for glibc + OpenSSL compatibility)
-FROM node:20-bookworm-slim AS base
+# Base image (WACE Docker Hub)
+FROM dockerhub.wace.me/node:20.19-alpine.linux AS base
 WORKDIR /app
 ENV NODE_ENV=production
 # Install OpenSSL, curl (for healthcheck), and required certs
-RUN apt-get update \
-    && apt-get install -y --no-install-recommends openssl ca-certificates curl \
-    && rm -rf /var/lib/apt/lists/*
+RUN apk add --no-cache openssl ca-certificates curl
 
 # Dependencies stage (install production dependencies)
 FROM base AS deps
@@ -15,7 +13,7 @@ COPY package*.json ./
 RUN npm ci --omit=dev --prefer-offline --no-audit && npm cache clean --force
 
 # Build stage (compile TypeScript)
-FROM node:20-bookworm-slim AS build
+FROM dockerhub.wace.me/node:20.19-alpine.linux AS build
 WORKDIR /app
 COPY package*.json ./
 RUN npm ci --prefer-offline --no-audit && npm cache clean --force

docker/deploy/frontend.Dockerfile

@@ -1,5 +1,5 @@
 # Multi-stage build for Next.js
-FROM node:20-alpine AS base
+FROM dockerhub.wace.me/node:20.19-alpine.linux AS base
 
 # Install dependencies only when needed
 FROM base AS deps