Dockerfile: multi-stage Node install (HF apt sandbox workaround)

Dockerfile

@@ -4,19 +4,26 @@
 # This Dockerfile is HF Spaces specific. Local Docker users should use
 # compose.yml (which just runs the unmodified upstream SIE image with the
 # Node UI on the host).
+#
+# We use a multi-stage build to grab Node binaries from the official
+# node:22-bookworm-slim image. HF Spaces' build sandbox restricts apt-key
+# tmp-file writes, so installing Node via apt fails. Copy approach avoids
+# apt entirely.
+
+# --- stage 1: pull Node binaries ---
+FROM node:22-bookworm-slim AS node
+
+# --- stage 2: final image ---
 FROM ghcr.io/superlinked/sie-server:latest-cpu-default
 
 USER root
 
-# Node 22 for the UI server (tsx + node:http + our Express-free server.ts)
-# The SIE base image is minimal; install curl + ca-certificates before
-# pulling NodeSource's setup script.
-RUN apt-get update \
- && apt-get install -y --no-install-recommends curl ca-certificates gnupg \
- && curl -fsSL https://deb.nodesource.com/setup_22.x | bash - \
- && apt-get install -y --no-install-recommends nodejs \
- && apt-get clean \
- && rm -rf /var/lib/apt/lists/*
+# Copy Node 22 from the official image (no apt, no apt-key).
+COPY --from=node /usr/local/bin/node /usr/local/bin/node
+COPY --from=node /usr/local/lib/node_modules /usr/local/lib/node_modules
+RUN ln -s /usr/local/lib/node_modules/npm/bin/npm-cli.js /usr/local/bin/npm \
+ && ln -s /usr/local/lib/node_modules/npm/bin/npx-cli.js /usr/local/bin/npx \
+ && node --version && npm --version
 
 # HF Spaces' persistent storage lives at /data (50 GB free tier).
 # Send the HuggingFace cache there so model weights survive Space restarts.