added multi stage builds for oci containers

it should help from builds from failing in addition to slimming down the
artifact size

.gitea/workflows/update-flake-lock.yml

@@ -1,40 +0,0 @@
-name: Update flake lock
-
-on:
-  schedule:
-    # Gitea cron schedules use UTC. 07:00 UTC is 03:00 EDT.
-    - cron: "0 7 * * 0"
-  workflow_dispatch:
-
-permissions:
-  contents: write
-
-jobs:
-  update-flake-lock:
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Check out repository
-        uses: actions/checkout@v4
-
-      - name: Install upstream Nix
-        uses: cachix/install-nix-action@v31
-
-      - name: Update flake lock
-        run: nix flake update
-
-      - name: Commit and push changes
-        shell: bash
-        run: |
-          set -euo pipefail
-
-          if git diff --quiet -- flake.lock; then
-            echo "flake.lock is already up to date"
-            exit 0
-          fi
-
-          git config user.name "gitea-actions[bot]"
-          git config user.email "gitea-actions[bot]@noreply.localhost"
-          git add flake.lock
-          git commit -m "chore: update flake lock"
-          git push

backend/public/Dockerfile

@@ -1,4 +1,5 @@
-FROM rust:1.88.0
+# Build stage
+FROM rust:1.88.0 AS builder
 
 WORKDIR /app
 
@@ -7,6 +8,16 @@ COPY ./cache ./cache
 
 RUN cargo build --release --manifest-path ./public/Cargo.toml
 
+# Runtime stage with Alpine
+FROM alpine:latest
+
+WORKDIR /app
+
+RUN apk add --no-cache ca-certificates libgcc
+
+COPY --from=builder /app/public/target/release/public /app/public
+COPY --from=builder /app/cache ./cache
+
 EXPOSE 3000
 
-CMD ["/app/public/target/release/public"]
+CMD ["/app/public"]

backend/task/Dockerfile

@@ -1,4 +1,5 @@
-FROM rust:1.88.0
+# Build stage
+FROM rust:1.88.0 AS builder
 
 WORKDIR /app
 
@@ -6,9 +7,23 @@ COPY ./task ./task
 COPY ./cache ./cache
 COPY ./storage ./storage
 
-RUN mkdir /app/posts
 RUN cargo build --release --manifest-path ./task/Cargo.toml
 
+# Runtime stage
+FROM debian:bookworm-slim
+
+WORKDIR /app
+
+RUN apt-get update && apt-get install -y \
+    ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+RUN mkdir /app/posts
+
+COPY --from=builder /app/task/target/release/task /app/task
+COPY --from=builder /app/cache ./cache
+COPY --from=builder /app/storage ./storage
+
 EXPOSE 3000
 
-CMD ["/app/task/target/release/task"]
+CMD ["/app/task"]

flake.lock

@@ -2,12 +2,12 @@
   "nodes": {
     "flake-schemas": {
       "locked": {
-        "lastModified": 1780327564,
-        "narHash": "sha256-HiRPtA0spK+Dkgbhz/1zW9glXxNVB+L4Rj2VYmdawb8=",
-        "rev": "6cc9bd98891b1fc6bb2b8cb3277df8bc72799ca6",
-        "revCount": 149,
+        "lastModified": 1721999734,
+        "narHash": "sha256-G5CxYeJVm4lcEtaO87LKzOsVnWeTcHGKbKxNamNWgOw=",
+        "rev": "0a5c42297d870156d9c57d8f99e476b738dcd982",
+        "revCount": 75,
         "type": "tarball",
-        "url": "https://api.flakehub.com/f/pinned/DeterminateSystems/flake-schemas/0.5.0/019e83cf-9af3-78b1-ac5b-70e68ad1efe1/source.tar.gz"
+        "url": "https://api.flakehub.com/f/pinned/DeterminateSystems/flake-schemas/0.1.5/0190ef2f-61e0-794b-ba14-e82f225e55e6/source.tar.gz"
       },
       "original": {
         "type": "tarball",
@@ -36,12 +36,12 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1792615934,
-        "narHash": "sha256-MlvRfa1O5Cqc2/a+gG+l9TSuowEoCKCmrJ1d9oAVm0I=",
-        "rev": "da6dc0e7b26060f2f71ce3ef7088fb56ee44fa36",
-        "revCount": 1016691,
+        "lastModified": 1752436162,
+        "narHash": "sha256-Kt1UIPi7kZqkSc5HVj6UY5YLHHEzPBkgpNUByuyxtlw=",
+        "rev": "dfcd5b901dbab46c9c6e80b265648481aafb01f8",
+        "revCount": 806304,
         "type": "tarball",
-        "url": "https://api.flakehub.com/f/pinned/NixOS/nixpkgs/0.2605.1016691%2Brev-da6dc0e7b26060f2f71ce3ef7088fb56ee44fa36/01a164b3-0756-7f91-92bf-32d04b10d836/source.tar.gz"
+        "url": "https://api.flakehub.com/f/pinned/NixOS/nixpkgs/0.2505.806304%2Brev-dfcd5b901dbab46c9c6e80b265648481aafb01f8/01980f2c-e7f3-7efc-b369-7ebec7be6e59/source.tar.gz"
       },
       "original": {
         "type": "tarball",
@@ -63,11 +63,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1792825530,
-        "narHash": "sha256-aphXA2IFNd3q48++TKmfuuvDDjkrgGdJDnDIhij9684=",
+        "lastModified": 1752633862,
+        "narHash": "sha256-Bj7ozT1+5P7NmvDcuAXJvj56txcXuAhk3Vd9FdWFQzk=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "5b9f1198b59bcb31c5c3250b332e7d77590e6306",
+        "rev": "8668ca94858206ac3db0860a9dec471de0d995f8",
         "type": "github"
       },
       "original": {