fix(docker): prevent host node_modules from polluting builds + non-interactive pnpm (#3)

Three things compounding caused `make up` to fail with
ERR_PNPM_ABORTED_REMOVE_MODULES_DIR_NO_TTY:

1. No .dockerignore meant 'COPY ui/ ./' was overlaying the host's
   resolved ui/node_modules onto the image's freshly-installed one,
   triggering pnpm's drift-detection.
2. With drift detected, pnpm decided node_modules needed to be
   removed and reinstalled but refused to do so without a TTY to
   confirm.
3. Backend builds were also susceptible to host-state contamination
   from .venv, .pytest_cache, __pycache__, .cerebro.json, etc.

Fixes:

- Add .dockerignore at repo root. Excludes node_modules, .venv,
  __pycache__, .pytest_cache, .mypy_cache, .ruff_cache, dist/,
  .gitnexus/, AGENTS.md, .docs/, openspec/, tests/, .github/,
  /data/, *.cerebro.json, *.db, .env (keep .env.example). Image
  contexts now ship only what the build actually needs.
- Set ENV CI=true in docker/ui.Dockerfile so pnpm operates
  non-interactively if it ever decides to nuke node_modules anyway.
- Set ENV CI=true in docker/backend.Dockerfile for symmetry and to
  keep any uv prompt path predictable.

Verified locally: `docker compose build` succeeds for both images,
`make up` brings both containers online, `curl localhost:3000`
returns 200 with the UI's index.html.

Author: dgtalbug

.dockerignore

@@ -0,0 +1,87 @@
+# Cerebro .dockerignore — keep image-build contexts small and deterministic.
+#
+# Anything matched here is excluded from the build context Docker sends to
+# the daemon. The two big wins: (1) prevents the host's resolved
+# node_modules / .venv from being COPYed on top of the image's own
+# resolutions; (2) cuts context size from hundreds of MB to a few MB,
+# which makes builds substantially faster.
+
+# ---- Node / UI build artifacts ----------------------------------------
+**/node_modules
+**/dist
+**/.vite
+**/.eslintcache
+*.tsbuildinfo
+**/coverage
+
+# ---- Python build artifacts -------------------------------------------
+**/__pycache__
+**/*.py[cod]
+**/*$py.class
+**/.venv
+**/venv
+**/*.egg-info
+**/.pytest_cache
+**/.mypy_cache
+**/.ruff_cache
+**/.import_linter_cache
+**/.coverage
+**/.coverage.*
+**/htmlcov
+**/coverage.xml
+
+# ---- Runtime data — never bake into images ----------------------------
+/data/
+**/*.cerebro.json
+**/*.db
+**/*.db-wal
+**/*.db-shm
+
+# ---- Secrets / env files ----------------------------------------------
+.env
+.env.*
+!.env.example
+
+# ---- Git / VCS --------------------------------------------------------
+.git
+.gitignore
+.gitattributes
+
+# ---- IDE / OS ---------------------------------------------------------
+.DS_Store
+Thumbs.db
+.idea/
+.vscode/
+*.swp
+
+# ---- Build / analysis caches that don't belong in images --------------
+.turbo
+.gitnexus/
+.codegraph/
+.claude/
+AGENTS.md
+.docs/
+.docs.local/
+
+# ---- Specs / docs / dev tooling (not needed at runtime) ---------------
+openspec/
+docs/
+scripts/
+tests/
+.github/
+.pre-commit-config.yaml
+.python-version
+.node-version
+
+# ---- Compose / Make are tooling, not image content --------------------
+docker-compose.yml
+docker-compose.*.yml
+Makefile
+
+# ---- Top-level docs we don't need at runtime --------------------------
+# (backend.Dockerfile explicitly COPYs README.md, so don't ignore *.md.)
+ARCHITECTURE.md
+CLAUDE.md
+CODE_OF_CONDUCT.md
+CONTRIBUTING.md
+LICENSE

docker/backend.Dockerfile

@@ -4,6 +4,10 @@
 # uvicorn CMD) and digest-pinned bases land alongside the API layer.
 FROM python:3.12-slim
 
+# Non-interactive flag honored by uv and most modern Python tooling.
+# Keeps the build deterministic if any tool decides to prompt.
+ENV CI=true
+
 # uv pinned by version (pin by digest when the build is hardened).
 COPY --from=ghcr.io/astral-sh/uv:0.9.9 /uv /uvx /bin/
 

docker/ui.Dockerfile

@@ -4,6 +4,14 @@
 
 # ---- Stage 1: builder ----
 FROM node:22-alpine AS builder
+
+# CI=true tells pnpm we're non-interactive, so it never blocks on a TTY
+# confirmation if it decides node_modules needs to be rebuilt mid-build
+# (ERR_PNPM_ABORTED_REMOVE_MODULES_DIR_NO_TTY). The .dockerignore at the
+# repo root prevents the host's node_modules from being COPYed in, which
+# is the most common cause of that decision.
+ENV CI=true
+
 RUN npm install -g pnpm@11.1.2
 WORKDIR /build
 COPY ui/package.json ui/pnpm-lock.yaml ui/pnpm-workspace.yaml ./