Support App Runner web deploys from ARM runtimes

templates/image.yaml

@@ -127,7 +127,7 @@ Resources:
                     - set -euo pipefail
                     - export DEBIAN_FRONTEND=noninteractive
                     - apt-get update
-                    - apt-get install -y --no-install-recommends bubblewrap build-essential ca-certificates curl docker.io git gnupg jq ripgrep tmux unzip xz-utils
+                    - apt-get install -y --no-install-recommends bubblewrap build-essential ca-certificates curl docker-buildx docker.io git gnupg jq ripgrep tmux unzip xz-utils
                     - apt-get clean
                     - rm -rf /var/lib/apt/lists/*
               - name: InstallAwsCli
@@ -216,6 +216,7 @@ Resources:
                     - node --version | grep -Fx "v${NodeVersion}"
                     - bun --version | grep -Fx "${BunVersion}"
                     - bwrap --version
+                    - docker buildx version
                     - git --version
                     - tmux -V
           - name: test
@@ -233,6 +234,7 @@ Resources:
                     - node --version | grep -Fx "v${NodeVersion}"
                     - bun --version | grep -Fx "${BunVersion}"
                     - bwrap --version
+                    - docker buildx version
                     - systemctl is-enabled docker
                     - systemctl is-active snap.amazon-ssm-agent.amazon-ssm-agent.service
                     - test -d /home/agentformation

web/Dockerfile

@@ -1,14 +1,14 @@
-FROM docker.io/library/node:24.19.0-alpine3.24@sha256:d32cdf619f63fe0471182d08996dd516c6275bb5fd31ae06e55a570bd9e1ad43 AS base
+FROM --platform=$BUILDPLATFORM docker.io/library/node:24.19.0-alpine3.24@sha256:d32cdf619f63fe0471182d08996dd516c6275bb5fd31ae06e55a570bd9e1ad43 AS build-base
 ARG BUN_VERSION=1.3.6
 RUN apk upgrade --no-cache && \
     npm install --global "bun@${BUN_VERSION}"
 
-FROM base AS deps
+FROM build-base AS deps
 WORKDIR /app
 COPY package.json bun.lock* ./
 RUN bun install --frozen-lockfile
 
-FROM base AS builder
+FROM build-base AS builder
 WORKDIR /app
 COPY --from=deps /app/node_modules ./node_modules
 COPY . .
@@ -28,6 +28,18 @@ RUN mkdir -p public && \
     SESSION_DOCUMENT_NAME=build-only \
     bun run build
 
+# Build the Next.js application on the host architecture. Turbopack is not
+# reliable under QEMU, while App Runner still needs an amd64 image. Install the
+# small set of traced native runtime dependencies for the requested target so a
+# native arm64 build never ships arm64 Sharp binaries in the amd64 image.
+FROM docker.io/library/node:24.19.0-alpine3.24@sha256:d32cdf619f63fe0471182d08996dd516c6275bb5fd31ae06e55a570bd9e1ad43 AS runtime-deps
+ARG BUN_VERSION=1.3.6
+WORKDIR /app
+RUN apk upgrade --no-cache && \
+    npm install --global "bun@${BUN_VERSION}"
+COPY package.json bun.lock* ./
+RUN bun install --frozen-lockfile --production
+
 FROM docker.io/library/node:24.19.0-alpine3.24@sha256:d32cdf619f63fe0471182d08996dd516c6275bb5fd31ae06e55a570bd9e1ad43 AS runner
 WORKDIR /app
 ENV NODE_ENV=production
@@ -40,7 +52,10 @@ RUN apk upgrade --no-cache && \
 COPY --from=builder /app/public ./public
 COPY --from=builder --chown=nextjs:nodejs /app/.next/standalone ./
 COPY --from=builder --chown=nextjs:nodejs /app/.next/static ./.next/static
+COPY --from=runtime-deps --chown=nextjs:nodejs /app/node_modules/sharp ./node_modules/sharp
+COPY --from=runtime-deps --chown=nextjs:nodejs /app/node_modules/@img ./node_modules/@img
 COPY --chown=nextjs:nodejs start.mjs ./start.mjs
+RUN node -e "require('sharp')"
 
 USER nextjs
 EXPOSE 3000