fix: Remove invalid --production=false flag from bun install

[ngoiyaeric]

User description

Problem

The Docker build is failing in Google Cloud Build with the following error:

error: The argument '--production' does not take a value.
error: DoesntTakeValue

Root Cause

Bun v1.1.3 does not support the --production=false syntax. The --production flag in this version is a boolean flag that does not accept a value.

Solution

This PR removes the --production=false flag from the bun install command in the Dockerfile. The command now uses:

RUN bun install --frozen-lockfile

This installs all dependencies including devDependencies, which is the intended behavior when --production=false was originally used.

Testing

This fix resolves the build failure seen in the Google Cloud Build run:

• Build ID: cb011a44-a323-4c4d-8647-d3dd2e1234e0
• Failed at: Step #0 - "Build"

Related

• Fixes the build failure introduced in PR feat: Upgrade Docker containerization for Google Cloud Build #393

---

PR Type

Bug fix

---

Description

• Remove invalid --production=false flag from bun install

• Fix Docker build failure with Bun v1.1.3 syntax error

• Install all dependencies including devDependencies as intended

---

Diagram Walkthrough

flowchart LR
  A["bun install --frozen-lockfile --production=false"] -- "Remove unsupported flag" --> B["bun install --frozen-lockfile"]
  B -- "Installs all dependencies" --> C["Includes devDependencies"]

Loading

File Walkthrough

	Relevant files
Bug fix	Dockerfile Remove unsupported production flag from bun install            Dockerfile Removed --production=false flag from bun install command Flag is not supported in Bun v1.1.3 and causes build failure Command now installs all dependencies including devDependencies +1/-1

---

Summary by CodeRabbit

• Chores
  • Updated build process dependency installation configuration to optimize production deployments.

_{✏️ Tip: You can customize this high-level summary in your review settings.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Review	Updated (UTC)
qcx	Ready	Preview, Comment	Jan 3, 2026 11:29am

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[coderabbitai]

Walkthrough

A --production=false flag was removed from the bun install command in the Dockerfile's first stage. The command now runs bun install --frozen-lockfile, which defaults to production dependencies instead of explicitly including development dependencies.

Changes

Cohort / File(s)	Summary
Dependency installation configuration Dockerfile	Removed --production=false flag from bun install command in first stage; now uses frozen lockfile with default (production) dependency installation

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Poem

🐰 A flag takes flight, the build runs clean,
Production only, lean and mean,
No dev dependencies cluttering the way,
Docker's lighter now—hooray, hooray!

Pre-merge checks

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main change: removing an invalid flag from the bun install command in the Dockerfile.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

---

📜 Recent review details

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between c356e72 and 75d4f5b.

📒 Files selected for processing (1)

• Dockerfile

🔇 Additional comments (1)

Dockerfile (1)

11-11: LGTM! The fix correctly resolves the invalid flag syntax.

The --production flag is a boolean that doesn't accept values, so removing =false is the correct fix. By default, bun install installs all dependencies including devDependencies, which is appropriate for this multi-stage build where the deps and builder stages need devDependencies to compile the Next.js application, while the runner stage only receives the built artifacts.

Note: The AI-generated summary incorrectly states this changes to "production-default install" — this is inconsistent with the actual behavior, which installs all dependencies including devDependencies.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[qodo-code-review]

PR Compliance Guide 🔍

Below is a summary of compliance checks for this PR:

Security Compliance
🟢	No security concerns identified No security vulnerabilities detected by AI analysis. Human verification advised for critical code.
Ticket Compliance
⚪	🎫 No ticket provided Create ticket/issue
Codebase Duplication Compliance
⚪	Codebase context is not defined Follow the guide to enable codebase context checks.
Custom Compliance
🟢	Generic: Comprehensive Audit Trails Objective: To create a detailed and reliable record of critical system actions for security analysis and compliance. Status: Passed Learn more about managing compliance generic rules or creating your own custom rules
	Generic: Meaningful Naming and Self-Documenting Code Objective: Ensure all identifiers clearly express their purpose and intent, making code self-documenting Status: Passed Learn more about managing compliance generic rules or creating your own custom rules
	Generic: Robust Error Handling and Edge Case Management Objective: Ensure comprehensive error handling that provides meaningful context and graceful degradation Status: Passed Learn more about managing compliance generic rules or creating your own custom rules
	Generic: Secure Error Handling Objective: To prevent the leakage of sensitive system information through error messages while providing sufficient detail for internal debugging. Status: Passed Learn more about managing compliance generic rules or creating your own custom rules
	Generic: Secure Logging Practices Objective: To ensure logs are useful for debugging and auditing without exposing sensitive information like PII, PHI, or cardholder data. Status: Passed Learn more about managing compliance generic rules or creating your own custom rules
	Generic: Security-First Input Validation and Data Handling Objective: Ensure all data inputs are validated, sanitized, and handled securely to prevent vulnerabilities Status: Passed Learn more about managing compliance generic rules or creating your own custom rules

Compliance status legend

🟢 - Fully Compliant
🟡 - Partial Compliant
🔴 - Not Compliant
⚪ - Requires Further Human Verification
🏷️ - Compliance label

[qodo-code-review]

PR Code Suggestions ✨

Explore these optional code suggestions:

Category	Suggestion	Impact
General	Install only production dependencies Set the NODE_ENV to production before running bun install to ensure only production dependencies are installed. Dockerfile [11] -RUN bun install --frozen-lockfile +RUN NODE_ENV=production bun install --frozen-lockfile Apply / Chat Suggestion importance[1-10]: 7 __ Why: The suggestion correctly points out that the PR change will install devDependencies and proposes a valid solution by setting NODE_ENV=production, which is a best practice for creating smaller and more secure production Docker images.	Medium
More

[charliecreates]

No issues found in the modified code. This change correctly aligns the Docker build with Bun v1.1.3 flag semantics and should resolve the reported Cloud Build failure.

Summary of changes

What changed

• Updated the dependency install step in Dockerfile to remove the invalid Bun flag --production=false.
• The install command is now:
  • RUN bun install --frozen-lockfile

Why

• Bun v1.1.3 treats --production as a boolean flag and rejects --production=false, which was causing Google Cloud Build failures.