From 2d4fc3e05f7b41a67a038445d355da89c5949c2e Mon Sep 17 00:00:00 2001
From: Andrey Antukh <niwi@niwi.nz>
Date: Tue, 17 Jun 2025 15:42:35 +0200
Subject: [PATCH] :recycle: Refactor devenv build mechanism

This introduces multistage build process for devenv making
different dependencies build depend on its own (per example, when
jvm version is changed, only the jvm stage is rebuild)

This commit also introduces imagemagick 7.x custom build
in the same way as we have on public docker images, so on
devenv we use the same version.
---
 backend/scripts/repl              |   6 +-
 backend/scripts/run.template.sh   |   4 +-
 backend/scripts/start-dev         |   4 +-
 docker/devenv/Dockerfile          | 548 ++++++++++++++++++------------
 docker/devenv/files/bashrc        |   5 +-
 docker/devenv/files/entrypoint.sh |   4 +-
 6 files changed, 338 insertions(+), 233 deletions(-)

diff --git a/backend/scripts/repl b/backend/scripts/repl
index 87910ab20..60d6b95e4 100755
--- a/backend/scripts/repl
+++ b/backend/scripts/repl
@@ -77,8 +77,9 @@ export JAVA_OPTS="\
        -Djdk.attach.allowAttachSelf \
        -Dlog4j2.configurationFile=log4j2-devenv-repl.xml \
        -Djdk.tracePinnedThreads=full \
+       -Dim4java.useV7=true \
        -XX:+EnableDynamicAgentLoading \
-       -XX:-OmitStackTraceInFastThrow                    \
+       -XX:-OmitStackTraceInFastThrow  \
        -XX:+UnlockDiagnosticVMOptions \
        -XX:+DebugNonSafepoints \
        --sun-misc-unsafe-memory-access=allow \
@@ -106,9 +107,6 @@ export OPTIONS="-A:jmx-remote -A:dev"
 # Setup GC
 # export OPTIONS="$OPTIONS -J-XX:+UseZGC"
 
-# Enable ImageMagick v7.x support
-# export OPTIONS="-J-Dim4java.useV7=true $OPTIONS";
-
 export OPTIONS_EVAL="nil"
 # export OPTIONS_EVAL="(set! *warn-on-reflection* true)"
 
diff --git a/backend/scripts/run.template.sh b/backend/scripts/run.template.sh
index 46a4e4555..6124e4475 100644
--- a/backend/scripts/run.template.sh
+++ b/backend/scripts/run.template.sh
@@ -18,9 +18,9 @@ if [ -f ./environ ]; then
     source ./environ
 fi
 
-export JVM_OPTS="-Djava.util.logging.manager=org.apache.logging.log4j.jul.LogManager -Dlog4j2.configurationFile=log4j2.xml -XX:-OmitStackTraceInFastThrow --enable-native-access=ALL-UNNAMED --enable-preview $JVM_OPTS"
+export JAVA_OPTS="-Dim4java.useV7=true -Djava.util.logging.manager=org.apache.logging.log4j.jul.LogManager -Dlog4j2.configurationFile=log4j2.xml -XX:-OmitStackTraceInFastThrow --sun-misc-unsafe-memory-access=allow --enable-native-access=ALL-UNNAMED --enable-preview $JVM_OPTS $JAVA_OPTS"
 
 ENTRYPOINT=${1:-app.main};
 
 set -ex
-exec $JAVA_CMD $JVM_OPTS -jar penpot.jar -m $ENTRYPOINT
+exec $JAVA_CMD $JAVA_OPTS -jar penpot.jar -m $ENTRYPOINT
diff --git a/backend/scripts/start-dev b/backend/scripts/start-dev
index 278b28ebf..a611eb485 100755
--- a/backend/scripts/start-dev
+++ b/backend/scripts/start-dev
@@ -36,9 +36,6 @@ export PENPOT_MEDIA_MAX_FILE_SIZE=104857600
 # Setup default multipart upload size to 300MiB
 export PENPOT_HTTP_SERVER_MAX_MULTIPART_BODY_SIZE=314572800
 
-# Enable ImageMagick v7.x support
-# export OPTIONS="-J-Dim4java.useV7=true $OPTIONS";
-
 # Initialize MINIO config
 mc alias set penpot-s3/ http://minio:9000 minioadmin minioadmin -q
 mc admin user add penpot-s3 penpot-devenv penpot-devenv -q
@@ -61,6 +58,7 @@ export JAVA_OPTS="\
        -Djdk.attach.allowAttachSelf \
        -Dlog4j2.configurationFile=log4j2-devenv.xml \
        -Djdk.tracePinnedThreads=full \
+       -Dim4java.useV7=true \
        -XX:-OmitStackTraceInFastThrow  \
        --sun-misc-unsafe-memory-access=allow \
        --enable-preview \
diff --git a/docker/devenv/Dockerfile b/docker/devenv/Dockerfile
index d25b2baa7..f8b29ed63 100644
--- a/docker/devenv/Dockerfile
+++ b/docker/devenv/Dockerfile
@@ -1,26 +1,16 @@
-FROM ubuntu:24.04
-LABEL maintainer="Penpot <docker@penpot.app>"
+FROM ubuntu:24.04 AS base
 
-ARG DEBIAN_FRONTEND=noninteractive
-
-ENV NODE_VERSION=v22.16.0 \
-    CLOJURE_VERSION=1.12.0.1501 \
-    CLJKONDO_VERSION=2025.01.16 \
-    BABASHKA_VERSION=1.12.196 \
-    CLJFMT_VERSION=0.13.0 \
-    RUSTUP_VERSION=1.27.1 \
-    RUST_VERSION=1.85.0 \
-    EMSCRIPTEN_VERSION=4.0.6 \
-    LANG=en_US.UTF-8 \
-    LC_ALL=en_US.UTF-8
+ENV LANG='C.UTF-8' \
+    LC_ALL='C.UTF-8' \
+    DEBIAN_FRONTEND=noninteractive
 
 RUN set -ex; \
-    mkdir -p /etc/resolvconf/resolv.conf.d; \
-    echo "nameserver 8.8.8.8" > /etc/resolvconf/resolv.conf.d/tail; \
     apt-get -qq update; \
-    apt-get -qqy install --no-install-recommends \
-        locales \
-        ca-certificates \
+    apt-get -qq upgrade; \
+    apt-get -qqy --no-install-recommends install \
+        python3 \
+        unzip \
+        rsync \
         wget \
         sudo \
         tmux \
@@ -28,98 +18,98 @@ RUN set -ex; \
         curl \
         bash \
         git \
-    ; \
-    echo "en_US.UTF-8 UTF-8" >> /etc/locale.gen; \
-    locale-gen; \
-    rm -rf /var/lib/apt/lists/*;
+        \
+        curl \
+        ca-certificates \
+        \
+        binutils \
+        build-essential autoconf libtool pkg-config
+
 
 COPY files/apt.sources /etc/apt/sources.list.d/ubuntu.sources
 
-RUN set -ex; \
-    usermod -l penpot -d /home/penpot -G users -s /bin/bash ubuntu; \
-    passwd penpot -d; \
-    echo "penpot ALL=(ALL) NOPASSWD:ALL" >> /etc/sudoers
+################################################################################
+## IMAGE MAGICK
+################################################################################
+
+FROM base AS build-imagemagick
+
+ENV IMAGEMAGICK_VERSION=7.1.1-47 \
+    DEBIAN_FRONTEND=noninteractive
 
 RUN set -ex; \
     apt-get -qq update; \
-    apt-get -qqy install --no-install-recommends \
-        build-essential \
-        openssh-client \
-        redis-tools \
-        gnupg2 \
-        rlwrap \
-        unzip \
-        rsync \
-        fakeroot \
-        file \
-        less \
-        jq \
-        nginx \
-        \
-        python3 \
-        python3-tabulate \
-        imagemagick \
-        ghostscript \
-        netpbm \
-        poppler-utils \
-        potrace \
-        webp \
-        woff-tools \
-        woff2 \
-        fontforge \
-        libatk1.0-0 \
-        libatk-bridge2.0-0 \
-        libcairo2 \
-        libcups2 \
-        libdbus-1-3 \
-        libexpat1 \
-        libfontconfig1 \
-        libgcc1 \
-        libgdk-pixbuf2.0-0 \
-        libglib2.0-0 \
-        libgtk-3-0 \
-        libnspr4 \
-        libpango-1.0-0 \
-        libpangocairo-1.0-0 \
-        libx11-6 \
-        libx11-xcb1 \
-        libxcb1 \
-        libxcomposite1 \
-        libxcursor1 \
-        libxdamage1 \
-        libxext6 \
-        libxfixes3 \
-        libxi6 \
-        libxrandr2 \
-        libxrender1 \
-        libxshmfence1 \
-        libxss1 \
-        libxtst6 \
-        fonts-liberation \
-        libnss3 \
-        libgbm1 \
-        \
-        xvfb \
-        libfontconfig-dev \
-        \
-        fonts-noto-color-emoji \
-        fonts-unifont \
-        libfreetype6 \
-        xfonts-cyrillic \
-        xfonts-scalable \
-        fonts-ipafont-gothic \
-        fonts-wqy-zenhei \
-        fonts-tlwg-loma-otf \
-        fonts-freefont-ttf \
-        libasound2t64 \
-        libatk-bridge2.0-0t64 \
-        libatk1.0-0t64 \
-        libatspi2.0-0t64 \
-        libcups2t64 \
-        libdrm2 \
-        libxkbcommon0 \
+    apt-get -qq upgrade; \
+    apt-get -qqy --no-install-recommends install \
+        libltdl-dev \
+        libpng-dev \
+        libjpeg-dev \
+        libtiff-dev \
+        libwebp-dev \
+        libopenexr-dev \
+        libfftw3-dev \
+        libzip-dev \
+        liblcms2-dev \
+        liblzma-dev \
+        libzstd-dev \
+        libheif-dev \
+        librsvg2-dev \
     ; \
-    rm -rf /var/lib/apt/lists/*;
+    rm -rf /var/lib/apt/lists/*
+
+RUN set -eux; \
+    curl -LfsSo /tmp/magick.tar.gz https://github.com/ImageMagick/ImageMagick/archive/refs/tags/${IMAGEMAGICK_VERSION}.tar.gz; \
+    mkdir -p /tmp/magick; \
+    cd /tmp/magick; \
+    tar -xf /tmp/magick.tar.gz --strip-components=1; \
+    ./configure  --prefix=/opt/imagick; \
+    make -j 2; \
+    make install; \
+    rm -rf /opt/imagick/lib/libMagick++*; \
+    rm -rf /opt/imagick/include; \
+    rm -rf /opt/imagick/share;
+
+################################################################################
+## NODE SETUP
+################################################################################
+
+FROM base AS setup-node
+
+ENV NODE_VERSION=v22.16.0 \
+    PATH=/opt/node/bin:$PATH
+
+RUN set -eux; \
+    ARCH="$(dpkg --print-architecture)"; \
+    case "${ARCH}" in \
+       aarch64|arm64) \
+         OPENSSL_ARCH='linux-aarch64'; \
+         BINARY_URL="https://nodejs.org/dist/${NODE_VERSION}/node-${NODE_VERSION}-linux-arm64.tar.gz"; \
+         ;; \
+       amd64|x86_64) \
+         OPENSSL_ARCH='linux-x86_64'; \
+         BINARY_URL="https://nodejs.org/dist/${NODE_VERSION}/node-${NODE_VERSION}-linux-x64.tar.gz"; \
+         ;; \
+       *) \
+         echo "Unsupported arch: ${ARCH}"; \
+         exit 1; \
+         ;; \
+    esac; \
+    curl -LfsSo /tmp/nodejs.tar.gz ${BINARY_URL}; \
+    mkdir -p /opt/node; \
+    cd /opt/node; \
+    tar -xf /tmp/nodejs.tar.gz --strip-components=1; \
+    chown -R root /opt/node; \
+    find /opt/node/include/node/openssl/archs -mindepth 1 -maxdepth 1 ! -name "$OPENSSL_ARCH" -exec rm -rf {} \; ; \
+    corepack enable; \
+    rm -rf /tmp/nodejs.tar.gz;
+
+################################################################################
+## JVM SETUP
+################################################################################
+
+FROM base AS setup-jvm
+
+ENV CLOJURE_VERSION=1.12.0.1501
 
 RUN set -eux; \
     ARCH="$(dpkg --print-architecture)"; \
@@ -139,132 +129,33 @@ RUN set -eux; \
     esac; \
     curl -LfsSo /tmp/openjdk.tar.gz ${BINARY_URL}; \
     echo "${ESUM} */tmp/openjdk.tar.gz" | sha256sum -c -; \
-    mkdir -p /usr/lib/jvm/openjdk; \
-    cd /usr/lib/jvm/openjdk; \
+    mkdir -p /opt/jdk; \
+    cd /opt/jdk; \
     tar -xf /tmp/openjdk.tar.gz --strip-components=1; \
     rm -rf /tmp/openjdk.tar.gz;
 
-ENV PATH="/usr/lib/jvm/openjdk/bin:/usr/local/nodejs/bin:$PATH" JAVA_HOME=/usr/lib/jvm/openjdk
-
 RUN set -ex; \
     curl -LfsSo /tmp/clojure.sh https://download.clojure.org/install/linux-install-$CLOJURE_VERSION.sh; \
     chmod +x /tmp/clojure.sh; \
-    /tmp/clojure.sh; \
+    mkdir -p /opt/clojure; \
+    /tmp/clojure.sh --prefix /opt/clojure; \
     rm -rf /tmp/clojure.sh;
 
-RUN set -ex; \
-    install -d /usr/share/postgresql-common/pgdg; \
-    curl -o /usr/share/postgresql-common/pgdg/apt.postgresql.org.asc --fail https://www.postgresql.org/media/keys/ACCC4CF8.asc; \
-    echo "deb [signed-by=/usr/share/postgresql-common/pgdg/apt.postgresql.org.asc] https://apt.postgresql.org/pub/repos/apt noble-pgdg main" >> /etc/apt/sources.list.d/postgresql.list; \
-    apt-get -qq update; \
-    apt-get -qqy install postgresql-client-16; \
-    rm -rf /var/lib/apt/lists/*;
+################################################################################
+## RUST SETUP
+################################################################################
 
-RUN set -eux; \
-    ARCH="$(dpkg --print-architecture)"; \
-    case "${ARCH}" in \
-       aarch64|arm64) \
-         BINARY_URL="https://nodejs.org/dist/${NODE_VERSION}/node-${NODE_VERSION}-linux-arm64.tar.gz"; \
-         ;; \
-       amd64|x86_64) \
-         BINARY_URL="https://nodejs.org/dist/${NODE_VERSION}/node-${NODE_VERSION}-linux-x64.tar.gz"; \
-         ;; \
-       *) \
-         echo "Unsupported arch: ${ARCH}"; \
-         exit 1; \
-         ;; \
-    esac; \
-    curl -LfsSo /tmp/nodejs.tar.gz ${BINARY_URL}; \
-    mkdir -p /usr/local/nodejs; \
-    cd /usr/local/nodejs; \
-    tar -xf /tmp/nodejs.tar.gz --strip-components=1; \
-    chown -R root /usr/local/nodejs; \
-    corepack enable; \
-    rm -rf /tmp/nodejs.tar.gz;
-
-RUN set -ex; \
-    ARCH="$(dpkg --print-architecture)"; \
-    case "${ARCH}" in \
-       aarch64|arm64) \
-         BINARY_URL="https://github.com/clj-kondo/clj-kondo/releases/download/v$CLJKONDO_VERSION/clj-kondo-$CLJKONDO_VERSION-linux-aarch64.zip"; \
-         ;; \
-       amd64|x86_64) \
-         BINARY_URL="https://github.com/clj-kondo/clj-kondo/releases/download/v$CLJKONDO_VERSION/clj-kondo-$CLJKONDO_VERSION-linux-amd64.zip"; \
-         ;; \
-       *) \
-         echo "Unsupported arch: ${ARCH}"; \
-         exit 1; \
-         ;; \
-    esac; \
-    cd /tmp; \
-    curl -LfsSo /tmp/clj-kondo.zip ${BINARY_URL}; \
-    cd /usr/local/bin; \
-    unzip /tmp/clj-kondo.zip; \
-    rm -rf /tmp/clj-kondo.zip;
-
-RUN set -ex; \
-    ARCH="$(dpkg --print-architecture)"; \
-    case "${ARCH}" in \
-       aarch64|arm64) \
-         BINARY_URL="https://github.com/babashka/babashka/releases/download/v$BABASHKA_VERSION/babashka-$BABASHKA_VERSION-linux-aarch64-static.tar.gz"; \
-         ;; \
-       amd64|x86_64) \
-         BINARY_URL="https://github.com/babashka/babashka/releases/download/v$BABASHKA_VERSION/babashka-$BABASHKA_VERSION-linux-amd64-static.tar.gz"; \
-         ;; \
-       *) \
-         echo "Unsupported arch: ${ARCH}"; \
-         exit 1; \
-         ;; \
-    esac; \
-    cd /tmp; \
-    curl -LfsSo /tmp/babashka.tar.gz ${BINARY_URL}; \
-    cd /usr/local/bin; \
-    tar -xf /tmp/babashka.tar.gz; \
-    rm -rf /tmp/babashka.tar.gz;
-
-RUN set -ex; \
-    ARCH="$(dpkg --print-architecture)"; \
-    case "${ARCH}" in \
-       aarch64|arm64) \
-         BINARY_URL="https://github.com/weavejester/cljfmt/releases/download/${CLJFMT_VERSION}/cljfmt-${CLJFMT_VERSION}-linux-aarch64.tar.gz"; \
-         ;; \
-       amd64|x86_64) \
-         BINARY_URL="https://github.com/weavejester/cljfmt/releases/download/${CLJFMT_VERSION}/cljfmt-${CLJFMT_VERSION}-linux-amd64.tar.gz"; \
-         ;; \
-       *) \
-         echo "Unsupported arch: ${ARCH}"; \
-         exit 1; \
-         ;; \
-    esac; \
-    cd /tmp; \
-    curl -LfsSo /tmp/cljfmt.tar.gz ${BINARY_URL}; \
-    cd /usr/local/bin; \
-    tar -xf /tmp/cljfmt.tar.gz; \
-    rm -rf /tmp/cljfmt.tar.gz;
-
-# Install minio client
-RUN set -ex; \
-    ARCH="$(dpkg --print-architecture)"; \
-    case "${ARCH}" in \
-       aarch64|arm64) \
-         BINARY_URL="https://dl.min.io/client/mc/release/linux-arm64/mc"; \
-         ;; \
-       amd64|x86_64) \
-         BINARY_URL="https://dl.min.io/client/mc/release/linux-amd64/mc"; \
-         ;; \
-       *) \
-         echo "Unsupported arch: ${ARCH}"; \
-         exit 1; \
-         ;; \
-    esac; \
-    wget -O /tmp/mc ${BINARY_URL}; \
-    mv /tmp/mc /usr/local/bin/; \
-    chmod +x /usr/local/bin/mc;
-
-WORKDIR /usr/local
+FROM base AS setup-rust
 
 # Install Rust toolchain
-ENV PATH=/usr/local/cargo/bin:$PATH RUSTUP_HOME=/usr/local/rustpo CARGO_HOME=/usr/local/cargo
+ENV PATH=/opt/cargo/bin:$PATH \
+    RUSTUP_HOME=/opt/rustup \
+    CARGO_HOME=/opt/cargo \
+    RUSTUP_VERSION=1.27.1 \
+    RUST_VERSION=1.85.0 \
+    EMSCRIPTEN_VERSION=4.0.6
+
+WORKDIR /opt
 
 RUN set -eux; \
     # Same steps as in Rust official Docker image https://github.com/rust-lang/docker-rust/blob/9f287282d513a84cb7c7f38f197838f15d37b6a9/1.81.0/bookworm/Dockerfile
@@ -286,8 +177,223 @@ RUN set -eux; \
     ./emsdk install $EMSCRIPTEN_VERSION; \
     ./emsdk activate $EMSCRIPTEN_VERSION; \
     rustup target add wasm32-unknown-emscripten; \
-    cargo install cargo-watch; \
-    chown -R penpot:users $CARGO_HOME;
+    cargo install cargo-watch;
+
+
+# RUN set -eux; \
+#     echo "export RUSTUP_VERSION=${RUSTUP_VERSION};" > /opt/rustup/_env; \
+#     echo "export RUST_VERSION=${RUST_VERSION};" >> /opt/rustup/_env; \
+#     echo "export EMSCRIPTEN_VERSION=${EMSCRIPTEN_VERSION};" >> /opt/rustup/_env; \
+#     echo "export RUSTUP_HOME=${RUSTUP_HOME};" >> /opt/rustup/_env;
+
+
+################################################################################
+## UTILS SETUP
+################################################################################
+
+FROM base AS setup-utils
+
+ENV CLJKONDO_VERSION=2025.01.16 \
+    BABASHKA_VERSION=1.12.196 \
+    CLJFMT_VERSION=0.13.0
+
+RUN set -ex; \
+    ARCH="$(dpkg --print-architecture)"; \
+    case "${ARCH}" in \
+       aarch64|arm64) \
+         BINARY_URL="https://github.com/clj-kondo/clj-kondo/releases/download/v$CLJKONDO_VERSION/clj-kondo-$CLJKONDO_VERSION-linux-aarch64.zip"; \
+         ;; \
+       amd64|x86_64) \
+         BINARY_URL="https://github.com/clj-kondo/clj-kondo/releases/download/v$CLJKONDO_VERSION/clj-kondo-$CLJKONDO_VERSION-linux-amd64.zip"; \
+         ;; \
+       *) \
+         echo "Unsupported arch: ${ARCH}"; \
+         exit 1; \
+         ;; \
+    esac; \
+    cd /tmp; \
+    curl -LfsSo /tmp/clj-kondo.zip ${BINARY_URL}; \
+    mkdir -p /opt/utils/bin; \
+    cd /opt/utils/bin; \
+    unzip /tmp/clj-kondo.zip; \
+    rm -rf /tmp/clj-kondo.zip;
+
+RUN set -ex; \
+    ARCH="$(dpkg --print-architecture)"; \
+    case "${ARCH}" in \
+       aarch64|arm64) \
+         BINARY_URL="https://github.com/babashka/babashka/releases/download/v$BABASHKA_VERSION/babashka-$BABASHKA_VERSION-linux-aarch64-static.tar.gz"; \
+         ;; \
+       amd64|x86_64) \
+         BINARY_URL="https://github.com/babashka/babashka/releases/download/v$BABASHKA_VERSION/babashka-$BABASHKA_VERSION-linux-amd64-static.tar.gz"; \
+         ;; \
+       *) \
+         echo "Unsupported arch: ${ARCH}"; \
+         exit 1; \
+         ;; \
+    esac; \
+    cd /tmp; \
+    curl -LfsSo /tmp/babashka.tar.gz ${BINARY_URL}; \
+    cd /opt/utils/bin; \
+    tar -xf /tmp/babashka.tar.gz; \
+    rm -rf /tmp/babashka.tar.gz;
+
+RUN set -ex; \
+    ARCH="$(dpkg --print-architecture)"; \
+    case "${ARCH}" in \
+       aarch64|arm64) \
+         BINARY_URL="https://github.com/weavejester/cljfmt/releases/download/${CLJFMT_VERSION}/cljfmt-${CLJFMT_VERSION}-linux-aarch64.tar.gz"; \
+         ;; \
+       amd64|x86_64) \
+         BINARY_URL="https://github.com/weavejester/cljfmt/releases/download/${CLJFMT_VERSION}/cljfmt-${CLJFMT_VERSION}-linux-amd64.tar.gz"; \
+         ;; \
+       *) \
+         echo "Unsupported arch: ${ARCH}"; \
+         exit 1; \
+         ;; \
+    esac; \
+    cd /tmp; \
+    curl -LfsSo /tmp/cljfmt.tar.gz ${BINARY_URL}; \
+    cd /opt/utils/bin; \
+    tar -xf /tmp/cljfmt.tar.gz; \
+    rm -rf /tmp/cljfmt.tar.gz;
+
+# Install minio client
+RUN set -ex; \
+    ARCH="$(dpkg --print-architecture)"; \
+    case "${ARCH}" in \
+       aarch64|arm64) \
+         BINARY_URL="https://dl.min.io/client/mc/release/linux-arm64/mc"; \
+         ;; \
+       amd64|x86_64) \
+         BINARY_URL="https://dl.min.io/client/mc/release/linux-amd64/mc"; \
+         ;; \
+       *) \
+         echo "Unsupported arch: ${ARCH}"; \
+         exit 1; \
+         ;; \
+    esac; \
+    wget -O /tmp/mc ${BINARY_URL}; \
+    mv /tmp/mc /opt/utils/bin/; \
+    chmod +x /opt/utils/bin/mc;
+
+
+################################################################################
+## DEVENV BASE
+################################################################################
+
+FROM base AS devenv-base
+
+RUN set -ex; \
+    usermod -l penpot -d /home/penpot -G users -s /bin/bash ubuntu; \
+    passwd penpot -d; \
+    echo "penpot ALL=(ALL) NOPASSWD:ALL" >> /etc/sudoers
+
+RUN set -ex; \
+    apt-get -qq update; \
+    apt-get -qqy install --no-install-recommends \
+      redis-tools \
+      gnupg2 \
+      rlwrap \
+      file \
+      less \
+      jq \
+      nginx \
+      \
+      fontconfig \
+      woff-tools \
+      woff2 \
+      python3-tabulate \
+      fontforge \
+      \
+      xvfb \
+      fonts-noto-color-emoji \
+      fonts-unifont \
+      libfontconfig1 \
+      libfreetype6 \
+      xfonts-cyrillic \
+      xfonts-scalable \
+      fonts-liberation \
+      fonts-ipafont-gothic \
+      fonts-wqy-zenhei \
+      fonts-tlwg-loma-otf \
+      fonts-freefont-ttf \
+      \
+      libasound2t64 \
+      libatk-bridge2.0-0t64 \
+      libatk1.0-0t64 \
+      libatspi2.0-0t64 \
+      libcairo2 \
+      libcups2t64 \
+      libdbus-1-3 \
+      libdrm2 \
+      libgbm1 \
+      libglib2.0-0t64 \
+      libnspr4 \
+      libnss3 \
+      libpango-1.0-0 \
+      libx11-6 \
+      libxcb1 \
+      libxcomposite1 \
+      libxdamage1 \
+      libxext6 \
+      libxfixes3 \
+      libxkbcommon0 \
+      libxrandr2 \
+      \
+      libpng16-16 \
+      libjpeg-turbo8 \
+      libtiff6 \
+      libwebp7 \
+      libopenexr-3-1-30 \
+      libfreetype6 \
+      libfontconfig1 \
+      libglib2.0-0 \
+      libxml2 \
+      liblcms2-2 \
+      libheif1 \
+      libopenjp2-7 \
+      libzstd1 \
+      librsvg2-2 \
+      libgomp1 \
+      libwebpmux3 \
+      libwebpdemux2 \
+      libzip4t64 \
+    ; \
+    rm -rf /var/lib/apt/lists/*;
+
+RUN set -ex; \
+    install -d /usr/share/postgresql-common/pgdg; \
+    curl -o /usr/share/postgresql-common/pgdg/apt.postgresql.org.asc --fail https://www.postgresql.org/media/keys/ACCC4CF8.asc; \
+    echo "deb [signed-by=/usr/share/postgresql-common/pgdg/apt.postgresql.org.asc] https://apt.postgresql.org/pub/repos/apt noble-pgdg main" >> /etc/apt/sources.list.d/postgresql.list; \
+    apt-get -qq update; \
+    apt-get -qqy install postgresql-client-16; \
+    rm -rf /var/lib/apt/lists/*;
+
+
+################################################################################
+## DEVENV
+################################################################################
+
+FROM devenv-base AS devenv
+LABEL maintainer="Penpot <docker@penpot.app>"
+
+ENV LANG='C.UTF-8' \
+    LC_ALL='C.UTF-8' \
+    DEBIAN_FRONTEND="noninteractive" \
+    JAVA_HOME="/opt/jdk" \
+    CARGO_HOME="/opt/cargo" \
+    RUSTUP_HOME="/opt/rustup" \
+    PATH="/opt/jdk/bin:/opt/utils/bin:/opt/clojure/bin:/opt/node/bin:/opt/imagick/bin:/opt/cargo/bin:$PATH"
+
+COPY --from=build-imagemagick /opt/imagick /opt/imagick
+COPY --from=setup-jvm /opt/jdk /opt/jdk
+COPY --from=setup-jvm /opt/clojure /opt/clojure
+COPY --from=setup-node /opt/node /opt/node
+COPY --from=setup-utils /opt/utils /opt/utils
+COPY --from=setup-rust /opt/cargo /opt/cargo
+COPY --from=setup-rust /opt/rustup /opt/rustup
+COPY --from=setup-rust /opt/emsdk /opt/emsdk
 
 COPY files/nginx.conf /etc/nginx/nginx.conf
 COPY files/nginx-mime.types /etc/nginx/mime.types
diff --git a/docker/devenv/files/bashrc b/docker/devenv/files/bashrc
index bb098b2f1..8bcf7b67b 100644
--- a/docker/devenv/files/bashrc
+++ b/docker/devenv/files/bashrc
@@ -1,6 +1,9 @@
 #!/usr/bin/env bash
 
-EMSDK_QUIET=1 . /usr/local/emsdk/emsdk_env.sh;
+EMSDK_QUIET=1 . /opt/emsdk/emsdk_env.sh;
+
+export PATH="/home/penpot/.cargo/bin:/opt/jdk/bin:/opt/utils/bin:/opt/clojure/bin:/opt/node/bin:/opt/imagick/bin:/opt/cargo/bin:$PATH"
+export CARGO_HOME="/home/penpot/.cargo"
 
 alias l='ls --color -GFlh'
 alias rm='rm -r'
diff --git a/docker/devenv/files/entrypoint.sh b/docker/devenv/files/entrypoint.sh
index ba112dd61..a1cabc2aa 100755
--- a/docker/devenv/files/entrypoint.sh
+++ b/docker/devenv/files/entrypoint.sh
@@ -2,7 +2,7 @@
 
 set -e
 
-EMSDK_QUIET=1 . /usr/local/emsdk/emsdk_env.sh;
+EMSDK_QUIET=1 . /opt/emsdk/emsdk_env.sh;
 
 usermod -u ${EXTERNAL_UID:-1000} penpot;
 
@@ -11,7 +11,7 @@ cp /root/.vimrc /home/penpot/.vimrc
 cp /root/.tmux.conf /home/penpot/.tmux.conf
 
 chown -R penpot:users /home/penpot
-rsync -ar --chown=penpot:users /usr/local/cargo/ /home/penpot/.cargo/
+rsync -ar --chown=penpot:users /opt/cargo/ /home/penpot/.cargo/
 
 export PATH="/home/penpot/.cargo/bin:$PATH"
 export CARGO_HOME="/home/penpot/.cargo"