[robgruen]

This pull request updates the Docker build and deployment process for the TypeAgent project, focusing on improved security, reproducibility, and maintainability. The main changes include switching to BuildKit-enabled builds in Azure Container Registry (ACR), modernizing and securing the Dockerfile, expanding .dockerignore for cleaner builds, and updating documentation to reflect the new process.

Build pipeline and ACR integration:

• The Azure DevOps pipeline (azure-build-docker-container.yml) now uses az acr run with BuildKit and a new acr-build.yaml task definition, replacing the previous az acr build approach. This enables secret mounts and a more flexible build process. [1] [2] [3] [4]

Dockerfile modernization and security:

• The Dockerfile is updated to use Node 24 on Debian Bookworm, install dependencies more securely (including Azure CLI 2.91.0), and leverage BuildKit secrets for npm registry credentials. The build steps now use explicit secret mounts, and the container starts the API server directly with Node, removing the need for npm registry access at runtime. [1] [2] [3] [4] [5]

Build context and reproducibility:

• The .dockerignore file is expanded to exclude all node_modules, build outputs, environment files, and local configuration, ensuring a cleaner and more reproducible build context.

Documentation updates:

• The README.md is updated with detailed instructions for building the Docker image locally and via the new ACR pipeline, including guidance on using private npm registries and BuildKit secrets.

New ACR build task:

• A new acr-build.yaml file defines the ACR BuildKit build and push steps, parameterized for image name and tag.

[George Ng (GeorgeNgMsft)]

Approving to unblock, but there are two critical concerns to address.