feat: add docker support

.dockerignore

@@ -0,0 +1,10 @@
+.git
+node_modules
+**/node_modules
+**/.next
+**/.turbo
+**/dist
+.env
+.env.local
+.env*.local
+*.log

Dockerfile

@@ -0,0 +1,25 @@
+# Matches `packageManager` in package.json and the version CI installs — a skew
+# here is what makes `--frozen-lockfile` fail inside the image but not locally.
+FROM oven/bun:1.3.14-alpine
+WORKDIR /app
+
+# `next build` runs under `node`, and this image's `node` is a shim that re-execs
+# bun (/usr/local/bun-node-fallback-bin/node). Next 16's build crashes it — a
+# segfault on 1.3.14, a turbopack CommonJS wrapper error on 1.3.0 — on both arm64
+# and amd64. CI does not hit this because GitHub runners have a real node.
+RUN apk add --no-cache nodejs
+
+COPY . .
+RUN bun install --frozen-lockfile
+RUN ./node_modules/.bin/turbo run build --filter=editor
+
+# Saved scenes live in SQLite under PASCAL_DATA_DIR; owned by the runtime user so
+# the store can create the database on first write.
+RUN mkdir -p /data && chown -R bun:bun /data /app
+ENV PASCAL_DATA_DIR=/data
+VOLUME /data
+
+USER bun
+EXPOSE 3000
+WORKDIR /app/apps/editor
+CMD ["bun", "run", "start"]

docker-compose.yml

@@ -0,0 +1,19 @@
+services:
+  editor:
+    build: .
+    ports:
+      # Keep the container port at 3000. `/scenes` fetches its own API through a
+      # base URL that only `NEXT_PUBLIC_APP_URL` can override, and Next inlines
+      # that at build time — so a remapped host port 500s the page.
+      - "3000:3000"
+    environment:
+      NODE_ENV: production
+      # Scene database location. Without the volume below, every saved project is
+      # discarded when the container is recreated.
+      PASCAL_DATA_DIR: /data
+    volumes:
+      - pascal-data:/data
+    restart: unless-stopped
+
+volumes:
+  pascal-data: