fix(cli): traverse unreadable directories when stripping node_modules in the code stage

chmod -R u+w itself fails on a directory without owner execute; u+rwX
grants traversal as it recurses. Also trim generated-Containerfile
comments to the non-obvious constraints.

Author: myftija

packages/cli-v3/src/deploy/buildImage.test.ts

@@ -44,8 +44,7 @@ describe("generateContainerfile", () => {
         `COPY --from=build --chown=${user} /app/node_modules ./node_modules`
       );
       expect(containerfile).toContain(`COPY --from=code --chown=${user} /app ./`);
-      // The final stage must not copy all of /app from the build stage anymore,
-      // or node_modules would be duplicated across two layers
+      // copying all of /app from build would duplicate node_modules across two layers
       expect(containerfile).not.toContain(`COPY --from=build --chown=${user} /app ./`);
     }
   );
@@ -62,12 +61,11 @@ describe("generateContainerfile", () => {
       });
 
       const postInstall = containerfile.indexOf("RUN echo post-install");
-      // The guard must run after post-install commands so a command that prunes
-      // node_modules can't break the final-stage COPY of /app/node_modules
+      // guard after post-install so a command that prunes node_modules can't break the COPY
       const mkdirGuard = containerfile.indexOf("RUN mkdir -p node_modules");
       const codeStage = containerfile.indexOf("FROM build AS code");
       const rmNodeModules = containerfile.indexOf(
-        "RUN chmod -R u+w node_modules && rm -rf node_modules"
+        "RUN chmod -R u+rwX node_modules && rm -rf node_modules"
       );
 
       expect(postInstall).toBeGreaterThan(-1);

packages/cli-v3/src/deploy/buildImage.ts

@@ -783,11 +783,10 @@ ${postInstallCommands}
 # node_modules may not exist when there are no dependencies to install
 RUN mkdir -p node_modules
 
-# App files without node_modules, so the final stage can layer them separately
 FROM build AS code
 
-# u+w first: rm as a non-root user fails on read-only directories
-RUN chmod -R u+w node_modules && rm -rf node_modules
+# u+rwX first: non-root rm fails on read-only or non-traversable directories
+RUN chmod -R u+rwX node_modules && rm -rf node_modules
 
 FROM build AS indexer
 
@@ -840,11 +839,9 @@ ENV TRIGGER_PROJECT_ID=\${TRIGGER_PROJECT_ID} \
     NODE_EXTRA_CA_CERTS=\${NODE_EXTRA_CA_CERTS} \
     NODE_ENV=production
 
-# Dependencies as their own layer: unchanged deps produce an identical blob
-# that registries and workers already have, so repeat deploys skip it
+# Unchanged dependencies produce an identical layer that repeat deploys skip
 COPY --from=build --chown=bun:bun /app/node_modules ./node_modules
 
-# Copy the app files (without node_modules) from the code stage
 COPY --from=code --chown=bun:bun /app ./
 
 # Copy the index.json file from the indexer stage
@@ -904,11 +901,10 @@ COPY --chown=node:node . .
 # node_modules may not exist when there are no dependencies to install
 RUN mkdir -p node_modules
 
-# App files without node_modules, so the final stage can layer them separately
 FROM build AS code
 
-# u+w first: rm as a non-root user fails on read-only directories
-RUN chmod -R u+w node_modules && rm -rf node_modules
+# u+rwX first: non-root rm fails on read-only or non-traversable directories
+RUN chmod -R u+rwX node_modules && rm -rf node_modules
 
 FROM build AS indexer
 
@@ -963,11 +959,9 @@ ENV TRIGGER_PROJECT_ID=\${TRIGGER_PROJECT_ID} \
     NODE_EXTRA_CA_CERTS=\${NODE_EXTRA_CA_CERTS} \
     NODE_ENV=production
 
-# Dependencies as their own layer: unchanged deps produce an identical blob
-# that registries and workers already have, so repeat deploys skip it
+# Unchanged dependencies produce an identical layer that repeat deploys skip
 COPY --from=build --chown=node:node /app/node_modules ./node_modules
 
-# Copy the app files (without node_modules) from the code stage
 COPY --from=code --chown=node:node /app ./
 
 # Copy the index.json file from the indexer stage