♻️ Refactor devenv build mechanism

This introduces multistage build process for devenv making
different dependencies build depend on its own (per example, when
jvm version is changed, only the jvm stage is rebuild)

This commit also introduces imagemagick 7.x custom build
in the same way as we have on public docker images, so on
devenv we use the same version.

backend/scripts/repl

@@ -77,6 +77,7 @@ export JAVA_OPTS="\
        -Djdk.attach.allowAttachSelf \
        -Dlog4j2.configurationFile=log4j2-devenv-repl.xml \
        -Djdk.tracePinnedThreads=full \
+       -Dim4java.useV7=true \
        -XX:+EnableDynamicAgentLoading \
        -XX:-OmitStackTraceInFastThrow  \
        -XX:+UnlockDiagnosticVMOptions \
@@ -106,9 +107,6 @@ export OPTIONS="-A:jmx-remote -A:dev"
 # Setup GC
 # export OPTIONS="$OPTIONS -J-XX:+UseZGC"
 
-# Enable ImageMagick v7.x support
-# export OPTIONS="-J-Dim4java.useV7=true $OPTIONS";
-
 export OPTIONS_EVAL="nil"
 # export OPTIONS_EVAL="(set! *warn-on-reflection* true)"
 

backend/scripts/run.template.sh

@@ -18,9 +18,9 @@ if [ -f ./environ ]; then
     source ./environ
 fi
 
-export JVM_OPTS="-Djava.util.logging.manager=org.apache.logging.log4j.jul.LogManager -Dlog4j2.configurationFile=log4j2.xml -XX:-OmitStackTraceInFastThrow --enable-native-access=ALL-UNNAMED --enable-preview $JVM_OPTS"
+export JAVA_OPTS="-Dim4java.useV7=true -Djava.util.logging.manager=org.apache.logging.log4j.jul.LogManager -Dlog4j2.configurationFile=log4j2.xml -XX:-OmitStackTraceInFastThrow --sun-misc-unsafe-memory-access=allow --enable-native-access=ALL-UNNAMED --enable-preview $JVM_OPTS $JAVA_OPTS"
 
 ENTRYPOINT=${1:-app.main};
 
 set -ex
-exec $JAVA_CMD $JVM_OPTS -jar penpot.jar -m $ENTRYPOINT
+exec $JAVA_CMD $JAVA_OPTS -jar penpot.jar -m $ENTRYPOINT

backend/scripts/start-dev

@@ -36,9 +36,6 @@ export PENPOT_MEDIA_MAX_FILE_SIZE=104857600
 # Setup default multipart upload size to 300MiB
 export PENPOT_HTTP_SERVER_MAX_MULTIPART_BODY_SIZE=314572800
 
-# Enable ImageMagick v7.x support
-# export OPTIONS="-J-Dim4java.useV7=true $OPTIONS";
-
 # Initialize MINIO config
 mc alias set penpot-s3/ http://minio:9000 minioadmin minioadmin -q
 mc admin user add penpot-s3 penpot-devenv penpot-devenv -q
@@ -61,6 +58,7 @@ export JAVA_OPTS="\
        -Djdk.attach.allowAttachSelf \
        -Dlog4j2.configurationFile=log4j2-devenv.xml \
        -Djdk.tracePinnedThreads=full \
+       -Dim4java.useV7=true \
        -XX:-OmitStackTraceInFastThrow  \
        --sun-misc-unsafe-memory-access=allow \
        --enable-preview \

docker/devenv/Dockerfile

@@ -1,26 +1,16 @@
-FROM ubuntu:24.04
+FROM ubuntu:24.04 AS base
-LABEL maintainer="Penpot <docker@penpot.app>"
 
-ARG DEBIAN_FRONTEND=noninteractive
+ENV LANG='C.UTF-8' \
-
+    LC_ALL='C.UTF-8' \
-ENV NODE_VERSION=v22.16.0 \
+    DEBIAN_FRONTEND=noninteractive
-    CLOJURE_VERSION=1.12.0.1501 \
-    CLJKONDO_VERSION=2025.01.16 \
-    BABASHKA_VERSION=1.12.196 \
-    CLJFMT_VERSION=0.13.0 \
-    RUSTUP_VERSION=1.27.1 \
-    RUST_VERSION=1.85.0 \
-    EMSCRIPTEN_VERSION=4.0.6 \
-    LANG=en_US.UTF-8 \
-    LC_ALL=en_US.UTF-8
 
 RUN set -ex; \
-    mkdir -p /etc/resolvconf/resolv.conf.d; \
-    echo "nameserver 8.8.8.8" > /etc/resolvconf/resolv.conf.d/tail; \
     apt-get -qq update; \
-    apt-get -qqy install --no-install-recommends \
+    apt-get -qq upgrade; \
-        locales \
+    apt-get -qqy --no-install-recommends install \
-        ca-certificates \
+        python3 \
+        unzip \
+        rsync \
         wget \
         sudo \
         tmux \
@@ -28,98 +18,98 @@ RUN set -ex; \
         curl \
         bash \
         git \
-    ; \
+        \
-    echo "en_US.UTF-8 UTF-8" >> /etc/locale.gen; \
+        curl \
-    locale-gen; \
+        ca-certificates \
-    rm -rf /var/lib/apt/lists/*;
+        \
+        binutils \
+        build-essential autoconf libtool pkg-config
+
 
 COPY files/apt.sources /etc/apt/sources.list.d/ubuntu.sources
 
-RUN set -ex; \
+################################################################################
-    usermod -l penpot -d /home/penpot -G users -s /bin/bash ubuntu; \
+## IMAGE MAGICK
-    passwd penpot -d; \
+################################################################################
-    echo "penpot ALL=(ALL) NOPASSWD:ALL" >> /etc/sudoers
+
+FROM base AS build-imagemagick
+
+ENV IMAGEMAGICK_VERSION=7.1.1-47 \
+    DEBIAN_FRONTEND=noninteractive
 
 RUN set -ex; \
     apt-get -qq update; \
-    apt-get -qqy install --no-install-recommends \
+    apt-get -qq upgrade; \
-        build-essential \
+    apt-get -qqy --no-install-recommends install \
-        openssh-client \
+        libltdl-dev \
-        redis-tools \
+        libpng-dev \
-        gnupg2 \
+        libjpeg-dev \
-        rlwrap \
+        libtiff-dev \
-        unzip \
+        libwebp-dev \
-        rsync \
+        libopenexr-dev \
-        fakeroot \
+        libfftw3-dev \
-        file \
+        libzip-dev \
-        less \
+        liblcms2-dev \
-        jq \
+        liblzma-dev \
-        nginx \
+        libzstd-dev \
-        \
+        libheif-dev \
-        python3 \
+        librsvg2-dev \
-        python3-tabulate \
-        imagemagick \
-        ghostscript \
-        netpbm \
-        poppler-utils \
-        potrace \
-        webp \
-        woff-tools \
-        woff2 \
-        fontforge \
-        libatk1.0-0 \
-        libatk-bridge2.0-0 \
-        libcairo2 \
-        libcups2 \
-        libdbus-1-3 \
-        libexpat1 \
-        libfontconfig1 \
-        libgcc1 \
-        libgdk-pixbuf2.0-0 \
-        libglib2.0-0 \
-        libgtk-3-0 \
-        libnspr4 \
-        libpango-1.0-0 \
-        libpangocairo-1.0-0 \
-        libx11-6 \
-        libx11-xcb1 \
-        libxcb1 \
-        libxcomposite1 \
-        libxcursor1 \
-        libxdamage1 \
-        libxext6 \
-        libxfixes3 \
-        libxi6 \
-        libxrandr2 \
-        libxrender1 \
-        libxshmfence1 \
-        libxss1 \
-        libxtst6 \
-        fonts-liberation \
-        libnss3 \
-        libgbm1 \
-        \
-        xvfb \
-        libfontconfig-dev \
-        \
-        fonts-noto-color-emoji \
-        fonts-unifont \
-        libfreetype6 \
-        xfonts-cyrillic \
-        xfonts-scalable \
-        fonts-ipafont-gothic \
-        fonts-wqy-zenhei \
-        fonts-tlwg-loma-otf \
-        fonts-freefont-ttf \
-        libasound2t64 \
-        libatk-bridge2.0-0t64 \
-        libatk1.0-0t64 \
-        libatspi2.0-0t64 \
-        libcups2t64 \
-        libdrm2 \
-        libxkbcommon0 \
     ; \
-    rm -rf /var/lib/apt/lists/*;
+    rm -rf /var/lib/apt/lists/*
+
+RUN set -eux; \
+    curl -LfsSo /tmp/magick.tar.gz https://github.com/ImageMagick/ImageMagick/archive/refs/tags/${IMAGEMAGICK_VERSION}.tar.gz; \
+    mkdir -p /tmp/magick; \
+    cd /tmp/magick; \
+    tar -xf /tmp/magick.tar.gz --strip-components=1; \
+    ./configure  --prefix=/opt/imagick; \
+    make -j 2; \
+    make install; \
+    rm -rf /opt/imagick/lib/libMagick++*; \
+    rm -rf /opt/imagick/include; \
+    rm -rf /opt/imagick/share;
+
+################################################################################
+## NODE SETUP
+################################################################################
+
+FROM base AS setup-node
+
+ENV NODE_VERSION=v22.16.0 \
+    PATH=/opt/node/bin:$PATH
+
+RUN set -eux; \
+    ARCH="$(dpkg --print-architecture)"; \
+    case "${ARCH}" in \
+       aarch64|arm64) \
+         OPENSSL_ARCH='linux-aarch64'; \
+         BINARY_URL="https://nodejs.org/dist/${NODE_VERSION}/node-${NODE_VERSION}-linux-arm64.tar.gz"; \
+         ;; \
+       amd64|x86_64) \
+         OPENSSL_ARCH='linux-x86_64'; \
+         BINARY_URL="https://nodejs.org/dist/${NODE_VERSION}/node-${NODE_VERSION}-linux-x64.tar.gz"; \
+         ;; \
+       *) \
+         echo "Unsupported arch: ${ARCH}"; \
+         exit 1; \
+         ;; \
+    esac; \
+    curl -LfsSo /tmp/nodejs.tar.gz ${BINARY_URL}; \
+    mkdir -p /opt/node; \
+    cd /opt/node; \
+    tar -xf /tmp/nodejs.tar.gz --strip-components=1; \
+    chown -R root /opt/node; \
+    find /opt/node/include/node/openssl/archs -mindepth 1 -maxdepth 1 ! -name "$OPENSSL_ARCH" -exec rm -rf {} \; ; \
+    corepack enable; \
+    rm -rf /tmp/nodejs.tar.gz;
+
+################################################################################
+## JVM SETUP
+################################################################################
+
+FROM base AS setup-jvm
+
+ENV CLOJURE_VERSION=1.12.0.1501
 
 RUN set -eux; \
     ARCH="$(dpkg --print-architecture)"; \
@@ -139,132 +129,33 @@ RUN set -eux; \
     esac; \
     curl -LfsSo /tmp/openjdk.tar.gz ${BINARY_URL}; \
     echo "${ESUM} */tmp/openjdk.tar.gz" | sha256sum -c -; \
-    mkdir -p /usr/lib/jvm/openjdk; \
+    mkdir -p /opt/jdk; \
-    cd /usr/lib/jvm/openjdk; \
+    cd /opt/jdk; \
     tar -xf /tmp/openjdk.tar.gz --strip-components=1; \
     rm -rf /tmp/openjdk.tar.gz;
 
-ENV PATH="/usr/lib/jvm/openjdk/bin:/usr/local/nodejs/bin:$PATH" JAVA_HOME=/usr/lib/jvm/openjdk
-
 RUN set -ex; \
     curl -LfsSo /tmp/clojure.sh https://download.clojure.org/install/linux-install-$CLOJURE_VERSION.sh; \
     chmod +x /tmp/clojure.sh; \
-    /tmp/clojure.sh; \
+    mkdir -p /opt/clojure; \
+    /tmp/clojure.sh --prefix /opt/clojure; \
     rm -rf /tmp/clojure.sh;
 
-RUN set -ex; \
+################################################################################
-    install -d /usr/share/postgresql-common/pgdg; \
+## RUST SETUP
-    curl -o /usr/share/postgresql-common/pgdg/apt.postgresql.org.asc --fail https://www.postgresql.org/media/keys/ACCC4CF8.asc; \
+################################################################################
-    echo "deb [signed-by=/usr/share/postgresql-common/pgdg/apt.postgresql.org.asc] https://apt.postgresql.org/pub/repos/apt noble-pgdg main" >> /etc/apt/sources.list.d/postgresql.list; \
-    apt-get -qq update; \
-    apt-get -qqy install postgresql-client-16; \
-    rm -rf /var/lib/apt/lists/*;
 
-RUN set -eux; \
+FROM base AS setup-rust
-    ARCH="$(dpkg --print-architecture)"; \
-    case "${ARCH}" in \
-       aarch64|arm64) \
-         BINARY_URL="https://nodejs.org/dist/${NODE_VERSION}/node-${NODE_VERSION}-linux-arm64.tar.gz"; \
-         ;; \
-       amd64|x86_64) \
-         BINARY_URL="https://nodejs.org/dist/${NODE_VERSION}/node-${NODE_VERSION}-linux-x64.tar.gz"; \
-         ;; \
-       *) \
-         echo "Unsupported arch: ${ARCH}"; \
-         exit 1; \
-         ;; \
-    esac; \
-    curl -LfsSo /tmp/nodejs.tar.gz ${BINARY_URL}; \
-    mkdir -p /usr/local/nodejs; \
-    cd /usr/local/nodejs; \
-    tar -xf /tmp/nodejs.tar.gz --strip-components=1; \
-    chown -R root /usr/local/nodejs; \
-    corepack enable; \
-    rm -rf /tmp/nodejs.tar.gz;
-
-RUN set -ex; \
-    ARCH="$(dpkg --print-architecture)"; \
-    case "${ARCH}" in \
-       aarch64|arm64) \
-         BINARY_URL="https://github.com/clj-kondo/clj-kondo/releases/download/v$CLJKONDO_VERSION/clj-kondo-$CLJKONDO_VERSION-linux-aarch64.zip"; \
-         ;; \
-       amd64|x86_64) \
-         BINARY_URL="https://github.com/clj-kondo/clj-kondo/releases/download/v$CLJKONDO_VERSION/clj-kondo-$CLJKONDO_VERSION-linux-amd64.zip"; \
-         ;; \
-       *) \
-         echo "Unsupported arch: ${ARCH}"; \
-         exit 1; \
-         ;; \
-    esac; \
-    cd /tmp; \
-    curl -LfsSo /tmp/clj-kondo.zip ${BINARY_URL}; \
-    cd /usr/local/bin; \
-    unzip /tmp/clj-kondo.zip; \
-    rm -rf /tmp/clj-kondo.zip;
-
-RUN set -ex; \
-    ARCH="$(dpkg --print-architecture)"; \
-    case "${ARCH}" in \
-       aarch64|arm64) \
-         BINARY_URL="https://github.com/babashka/babashka/releases/download/v$BABASHKA_VERSION/babashka-$BABASHKA_VERSION-linux-aarch64-static.tar.gz"; \
-         ;; \
-       amd64|x86_64) \
-         BINARY_URL="https://github.com/babashka/babashka/releases/download/v$BABASHKA_VERSION/babashka-$BABASHKA_VERSION-linux-amd64-static.tar.gz"; \
-         ;; \
-       *) \
-         echo "Unsupported arch: ${ARCH}"; \
-         exit 1; \
-         ;; \
-    esac; \
-    cd /tmp; \
-    curl -LfsSo /tmp/babashka.tar.gz ${BINARY_URL}; \
-    cd /usr/local/bin; \
-    tar -xf /tmp/babashka.tar.gz; \
-    rm -rf /tmp/babashka.tar.gz;
-
-RUN set -ex; \
-    ARCH="$(dpkg --print-architecture)"; \
-    case "${ARCH}" in \
-       aarch64|arm64) \
-         BINARY_URL="https://github.com/weavejester/cljfmt/releases/download/${CLJFMT_VERSION}/cljfmt-${CLJFMT_VERSION}-linux-aarch64.tar.gz"; \
-         ;; \
-       amd64|x86_64) \
-         BINARY_URL="https://github.com/weavejester/cljfmt/releases/download/${CLJFMT_VERSION}/cljfmt-${CLJFMT_VERSION}-linux-amd64.tar.gz"; \
-         ;; \
-       *) \
-         echo "Unsupported arch: ${ARCH}"; \
-         exit 1; \
-         ;; \
-    esac; \
-    cd /tmp; \
-    curl -LfsSo /tmp/cljfmt.tar.gz ${BINARY_URL}; \
-    cd /usr/local/bin; \
-    tar -xf /tmp/cljfmt.tar.gz; \
-    rm -rf /tmp/cljfmt.tar.gz;
-
-# Install minio client
-RUN set -ex; \
-    ARCH="$(dpkg --print-architecture)"; \
-    case "${ARCH}" in \
-       aarch64|arm64) \
-         BINARY_URL="https://dl.min.io/client/mc/release/linux-arm64/mc"; \
-         ;; \
-       amd64|x86_64) \
-         BINARY_URL="https://dl.min.io/client/mc/release/linux-amd64/mc"; \
-         ;; \
-       *) \
-         echo "Unsupported arch: ${ARCH}"; \
-         exit 1; \
-         ;; \
-    esac; \
-    wget -O /tmp/mc ${BINARY_URL}; \
-    mv /tmp/mc /usr/local/bin/; \
-    chmod +x /usr/local/bin/mc;
-
-WORKDIR /usr/local
 
 # Install Rust toolchain
-ENV PATH=/usr/local/cargo/bin:$PATH RUSTUP_HOME=/usr/local/rustpo CARGO_HOME=/usr/local/cargo
+ENV PATH=/opt/cargo/bin:$PATH \
+    RUSTUP_HOME=/opt/rustup \
+    CARGO_HOME=/opt/cargo \
+    RUSTUP_VERSION=1.27.1 \
+    RUST_VERSION=1.85.0 \
+    EMSCRIPTEN_VERSION=4.0.6
+
+WORKDIR /opt
 
 RUN set -eux; \
     # Same steps as in Rust official Docker image https://github.com/rust-lang/docker-rust/blob/9f287282d513a84cb7c7f38f197838f15d37b6a9/1.81.0/bookworm/Dockerfile
@@ -286,8 +177,223 @@ RUN set -eux; \
     ./emsdk install $EMSCRIPTEN_VERSION; \
     ./emsdk activate $EMSCRIPTEN_VERSION; \
     rustup target add wasm32-unknown-emscripten; \
-    cargo install cargo-watch; \
+    cargo install cargo-watch;
-    chown -R penpot:users $CARGO_HOME;
+
+
+# RUN set -eux; \
+#     echo "export RUSTUP_VERSION=${RUSTUP_VERSION};" > /opt/rustup/_env; \
+#     echo "export RUST_VERSION=${RUST_VERSION};" >> /opt/rustup/_env; \
+#     echo "export EMSCRIPTEN_VERSION=${EMSCRIPTEN_VERSION};" >> /opt/rustup/_env; \
+#     echo "export RUSTUP_HOME=${RUSTUP_HOME};" >> /opt/rustup/_env;
+
+
+################################################################################
+## UTILS SETUP
+################################################################################
+
+FROM base AS setup-utils
+
+ENV CLJKONDO_VERSION=2025.01.16 \
+    BABASHKA_VERSION=1.12.196 \
+    CLJFMT_VERSION=0.13.0
+
+RUN set -ex; \
+    ARCH="$(dpkg --print-architecture)"; \
+    case "${ARCH}" in \
+       aarch64|arm64) \
+         BINARY_URL="https://github.com/clj-kondo/clj-kondo/releases/download/v$CLJKONDO_VERSION/clj-kondo-$CLJKONDO_VERSION-linux-aarch64.zip"; \
+         ;; \
+       amd64|x86_64) \
+         BINARY_URL="https://github.com/clj-kondo/clj-kondo/releases/download/v$CLJKONDO_VERSION/clj-kondo-$CLJKONDO_VERSION-linux-amd64.zip"; \
+         ;; \
+       *) \
+         echo "Unsupported arch: ${ARCH}"; \
+         exit 1; \
+         ;; \
+    esac; \
+    cd /tmp; \
+    curl -LfsSo /tmp/clj-kondo.zip ${BINARY_URL}; \
+    mkdir -p /opt/utils/bin; \
+    cd /opt/utils/bin; \
+    unzip /tmp/clj-kondo.zip; \
+    rm -rf /tmp/clj-kondo.zip;
+
+RUN set -ex; \
+    ARCH="$(dpkg --print-architecture)"; \
+    case "${ARCH}" in \
+       aarch64|arm64) \
+         BINARY_URL="https://github.com/babashka/babashka/releases/download/v$BABASHKA_VERSION/babashka-$BABASHKA_VERSION-linux-aarch64-static.tar.gz"; \
+         ;; \
+       amd64|x86_64) \
+         BINARY_URL="https://github.com/babashka/babashka/releases/download/v$BABASHKA_VERSION/babashka-$BABASHKA_VERSION-linux-amd64-static.tar.gz"; \
+         ;; \
+       *) \
+         echo "Unsupported arch: ${ARCH}"; \
+         exit 1; \
+         ;; \
+    esac; \
+    cd /tmp; \
+    curl -LfsSo /tmp/babashka.tar.gz ${BINARY_URL}; \
+    cd /opt/utils/bin; \
+    tar -xf /tmp/babashka.tar.gz; \
+    rm -rf /tmp/babashka.tar.gz;
+
+RUN set -ex; \
+    ARCH="$(dpkg --print-architecture)"; \
+    case "${ARCH}" in \
+       aarch64|arm64) \
+         BINARY_URL="https://github.com/weavejester/cljfmt/releases/download/${CLJFMT_VERSION}/cljfmt-${CLJFMT_VERSION}-linux-aarch64.tar.gz"; \
+         ;; \
+       amd64|x86_64) \
+         BINARY_URL="https://github.com/weavejester/cljfmt/releases/download/${CLJFMT_VERSION}/cljfmt-${CLJFMT_VERSION}-linux-amd64.tar.gz"; \
+         ;; \
+       *) \
+         echo "Unsupported arch: ${ARCH}"; \
+         exit 1; \
+         ;; \
+    esac; \
+    cd /tmp; \
+    curl -LfsSo /tmp/cljfmt.tar.gz ${BINARY_URL}; \
+    cd /opt/utils/bin; \
+    tar -xf /tmp/cljfmt.tar.gz; \
+    rm -rf /tmp/cljfmt.tar.gz;
+
+# Install minio client
+RUN set -ex; \
+    ARCH="$(dpkg --print-architecture)"; \
+    case "${ARCH}" in \
+       aarch64|arm64) \
+         BINARY_URL="https://dl.min.io/client/mc/release/linux-arm64/mc"; \
+         ;; \
+       amd64|x86_64) \
+         BINARY_URL="https://dl.min.io/client/mc/release/linux-amd64/mc"; \
+         ;; \
+       *) \
+         echo "Unsupported arch: ${ARCH}"; \
+         exit 1; \
+         ;; \
+    esac; \
+    wget -O /tmp/mc ${BINARY_URL}; \
+    mv /tmp/mc /opt/utils/bin/; \
+    chmod +x /opt/utils/bin/mc;
+
+
+################################################################################
+## DEVENV BASE
+################################################################################
+
+FROM base AS devenv-base
+
+RUN set -ex; \
+    usermod -l penpot -d /home/penpot -G users -s /bin/bash ubuntu; \
+    passwd penpot -d; \
+    echo "penpot ALL=(ALL) NOPASSWD:ALL" >> /etc/sudoers
+
+RUN set -ex; \
+    apt-get -qq update; \
+    apt-get -qqy install --no-install-recommends \
+      redis-tools \
+      gnupg2 \
+      rlwrap \
+      file \
+      less \
+      jq \
+      nginx \
+      \
+      fontconfig \
+      woff-tools \
+      woff2 \
+      python3-tabulate \
+      fontforge \
+      \
+      xvfb \
+      fonts-noto-color-emoji \
+      fonts-unifont \
+      libfontconfig1 \
+      libfreetype6 \
+      xfonts-cyrillic \
+      xfonts-scalable \
+      fonts-liberation \
+      fonts-ipafont-gothic \
+      fonts-wqy-zenhei \
+      fonts-tlwg-loma-otf \
+      fonts-freefont-ttf \
+      \
+      libasound2t64 \
+      libatk-bridge2.0-0t64 \
+      libatk1.0-0t64 \
+      libatspi2.0-0t64 \
+      libcairo2 \
+      libcups2t64 \
+      libdbus-1-3 \
+      libdrm2 \
+      libgbm1 \
+      libglib2.0-0t64 \
+      libnspr4 \
+      libnss3 \
+      libpango-1.0-0 \
+      libx11-6 \
+      libxcb1 \
+      libxcomposite1 \
+      libxdamage1 \
+      libxext6 \
+      libxfixes3 \
+      libxkbcommon0 \
+      libxrandr2 \
+      \
+      libpng16-16 \
+      libjpeg-turbo8 \
+      libtiff6 \
+      libwebp7 \
+      libopenexr-3-1-30 \
+      libfreetype6 \
+      libfontconfig1 \
+      libglib2.0-0 \
+      libxml2 \
+      liblcms2-2 \
+      libheif1 \
+      libopenjp2-7 \
+      libzstd1 \
+      librsvg2-2 \
+      libgomp1 \
+      libwebpmux3 \
+      libwebpdemux2 \
+      libzip4t64 \
+    ; \
+    rm -rf /var/lib/apt/lists/*;
+
+RUN set -ex; \
+    install -d /usr/share/postgresql-common/pgdg; \
+    curl -o /usr/share/postgresql-common/pgdg/apt.postgresql.org.asc --fail https://www.postgresql.org/media/keys/ACCC4CF8.asc; \
+    echo "deb [signed-by=/usr/share/postgresql-common/pgdg/apt.postgresql.org.asc] https://apt.postgresql.org/pub/repos/apt noble-pgdg main" >> /etc/apt/sources.list.d/postgresql.list; \
+    apt-get -qq update; \
+    apt-get -qqy install postgresql-client-16; \
+    rm -rf /var/lib/apt/lists/*;
+
+
+################################################################################
+## DEVENV
+################################################################################
+
+FROM devenv-base AS devenv
+LABEL maintainer="Penpot <docker@penpot.app>"
+
+ENV LANG='C.UTF-8' \
+    LC_ALL='C.UTF-8' \
+    DEBIAN_FRONTEND="noninteractive" \
+    JAVA_HOME="/opt/jdk" \
+    CARGO_HOME="/opt/cargo" \
+    RUSTUP_HOME="/opt/rustup" \
+    PATH="/opt/jdk/bin:/opt/utils/bin:/opt/clojure/bin:/opt/node/bin:/opt/imagick/bin:/opt/cargo/bin:$PATH"
+
+COPY --from=build-imagemagick /opt/imagick /opt/imagick
+COPY --from=setup-jvm /opt/jdk /opt/jdk
+COPY --from=setup-jvm /opt/clojure /opt/clojure
+COPY --from=setup-node /opt/node /opt/node
+COPY --from=setup-utils /opt/utils /opt/utils
+COPY --from=setup-rust /opt/cargo /opt/cargo
+COPY --from=setup-rust /opt/rustup /opt/rustup
+COPY --from=setup-rust /opt/emsdk /opt/emsdk
 
 COPY files/nginx.conf /etc/nginx/nginx.conf
 COPY files/nginx-mime.types /etc/nginx/mime.types

docker/devenv/files/bashrc

@@ -1,6 +1,9 @@
 #!/usr/bin/env bash
 
-EMSDK_QUIET=1 . /usr/local/emsdk/emsdk_env.sh;
+EMSDK_QUIET=1 . /opt/emsdk/emsdk_env.sh;
+
+export PATH="/home/penpot/.cargo/bin:/opt/jdk/bin:/opt/utils/bin:/opt/clojure/bin:/opt/node/bin:/opt/imagick/bin:/opt/cargo/bin:$PATH"
+export CARGO_HOME="/home/penpot/.cargo"
 
 alias l='ls --color -GFlh'
 alias rm='rm -r'

docker/devenv/files/entrypoint.sh

@@ -2,7 +2,7 @@
 
 set -e
 
-EMSDK_QUIET=1 . /usr/local/emsdk/emsdk_env.sh;
+EMSDK_QUIET=1 . /opt/emsdk/emsdk_env.sh;
 
 usermod -u ${EXTERNAL_UID:-1000} penpot;
 
@@ -11,7 +11,7 @@ cp /root/.vimrc /home/penpot/.vimrc
 cp /root/.tmux.conf /home/penpot/.tmux.conf
 
 chown -R penpot:users /home/penpot
-rsync -ar --chown=penpot:users /usr/local/cargo/ /home/penpot/.cargo/
+rsync -ar --chown=penpot:users /opt/cargo/ /home/penpot/.cargo/
 
 export PATH="/home/penpot/.cargo/bin:$PATH"
 export CARGO_HOME="/home/penpot/.cargo"