build: optimize Dockerfiles for production

- Use BuildKit syntax 1.7 with cache mounts for apt/uv
- Switch from pip to uv for 10-100x faster installs (ADR-0014)
- Add OCI Image Spec labels for container metadata
- Add HEALTHCHECK directives for orchestration
- Add .dockerignore to reduce context size
- Update Makefile with buildx and lint target
- Add retry logic to ray-entrypoint.sh

Refs: ADR-0012 (uv), ADR-0014 (Docker best practices)

Makefile

@@ -3,52 +3,73 @@
 
 REGISTRY := git.daviestechlabs.io/daviestechlabs
 TAG := latest
+PLATFORM := linux/amd64
 
 # Image names
 IMAGES := ray-worker-nvidia ray-worker-rdna2 ray-worker-strixhalo ray-worker-intel
 
-.PHONY: all build-all push-all clean help $(addprefix build-,$(IMAGES)) $(addprefix push-,$(IMAGES))
+.PHONY: all build-all push-all clean help lint $(addprefix build-,$(IMAGES)) $(addprefix push-,$(IMAGES))
 
 help:
 	@echo "KubeRay Images Build System"
 	@echo ""
 	@echo "Usage:"
-	@echo "  make build-all          Build all images"
-	@echo "  make push-all           Push all images to registry"
-	@echo "  make build-nvidia       Build NVIDIA worker image"
-	@echo "  make build-rdna2        Build AMD RDNA2 worker image"
-	@echo "  make build-strixhalo    Build AMD Strix Halo worker image"
-	@echo "  make build-intel        Build Intel XPU worker image"
-	@echo "  make push-nvidia        Push NVIDIA worker image"
+	@echo "  make build-all            Build all images"
+	@echo "  make push-all             Push all images to registry"
+	@echo "  make build-nvidia         Build NVIDIA worker image"
+	@echo "  make build-rdna2          Build AMD RDNA2 worker image"
+	@echo "  make build-strixhalo      Build AMD Strix Halo worker image"
+	@echo "  make build-intel          Build Intel XPU worker image"
+	@echo "  make push-nvidia          Push NVIDIA worker image"
+	@echo "  make lint                 Lint Dockerfiles with hadolint"
 	@echo "  make TAG=v1.0.0 push-all  Push with specific tag"
 	@echo ""
 	@echo "Environment:"
 	@echo "  REGISTRY=$(REGISTRY)"
 	@echo "  TAG=$(TAG)"
+	@echo "  PLATFORM=$(PLATFORM)"
 
-# Build targets
+# Lint Dockerfiles with hadolint
+lint:
+	@echo "Linting Dockerfiles..."
+	@command -v hadolint >/dev/null 2>&1 || { echo "hadolint not found, skipping..."; exit 0; }
+	hadolint dockerfiles/Dockerfile.ray-worker-nvidia
+	hadolint dockerfiles/Dockerfile.ray-worker-rdna2
+	hadolint dockerfiles/Dockerfile.ray-worker-strixhalo
+	hadolint dockerfiles/Dockerfile.ray-worker-intel
+	@echo "Lint passed!"
+
+# Build targets using buildx for cache support
 build-nvidia:
-	docker build \
-		-t $(REGISTRY)/ray-worker-nvidia:$(TAG) \
-		-f dockerfiles/Dockerfile.ray-worker-nvidia \
+	docker buildx build \
+		--platform $(PLATFORM) \
+		--tag $(REGISTRY)/ray-worker-nvidia:$(TAG) \
+		--file dockerfiles/Dockerfile.ray-worker-nvidia \
+		--load \
 		.
 
 build-rdna2:
-	docker build \
-		-t $(REGISTRY)/ray-worker-rdna2:$(TAG) \
-		-f dockerfiles/Dockerfile.ray-worker-rdna2 \
+	docker buildx build \
+		--platform $(PLATFORM) \
+		--tag $(REGISTRY)/ray-worker-rdna2:$(TAG) \
+		--file dockerfiles/Dockerfile.ray-worker-rdna2 \
+		--load \
 		.
 
 build-strixhalo:
-	docker build \
-		-t $(REGISTRY)/ray-worker-strixhalo:$(TAG) \
-		-f dockerfiles/Dockerfile.ray-worker-strixhalo \
+	docker buildx build \
+		--platform $(PLATFORM) \
+		--tag $(REGISTRY)/ray-worker-strixhalo:$(TAG) \
+		--file dockerfiles/Dockerfile.ray-worker-strixhalo \
+		--load \
 		.
 
 build-intel:
-	docker build \
-		-t $(REGISTRY)/ray-worker-intel:$(TAG) \
-		-f dockerfiles/Dockerfile.ray-worker-intel \
+	docker buildx build \
+		--platform $(PLATFORM) \
+		--tag $(REGISTRY)/ray-worker-intel:$(TAG) \
+		--file dockerfiles/Dockerfile.ray-worker-intel \
+		--load \
 		.
 
 build-all: build-nvidia build-rdna2 build-strixhalo build-intel