feat(services): builder selection, resource reservations, static builder (C3)

services.builder picks the build strategy per service: auto detects from
repo contents (Dockerfile → railpack → nixpacks), explicit overrides force
a builder, and static builds assets in a node stage then serves them from
an nginx image (static_build_cmd/static_dir, port 80 default).

- cpu_reserve/memory_reserve → Docker CPU shares + MemoryReservation;
  cpu/memory stay hard caps (NanoCPUs/Memory). Empty string clears.
- app_settings.default_cpu/default_memory override service-create
  fallbacks; capacity_policy=block fails deploys whose requested memory
  exceeds node capacity (default warn logs via slog).
- Resource specs are validated — "512mb" fails instead of silently
  dropping the limit.
- Fixes: deployments.go hardcoded nixpacks (auto-detect was dead code);
  DockerfileBuilder passed the Dockerfile *path* as build-context content;
  BuildImage never drained the daemon stream so builds could abort and
  errors went unseen — stream is now consumed and errorDetail surfaced.
- CLI: --builder/--cpu-reserve/--memory-reserve/--static-cmd/--static-dir
  on create+update; MCP args on services create/update; UI Build &
  Resources card; OpenAPI + llms.txt + CLI.md.

Verified live: static build of a real repo → nginx image → deployed;
reserves reach HostConfig (shares=256, MemoryReservation=128Mi);
validation rejects bad specs; builder persists + clears.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

app/backend/internal/deployment/engine.go

@@ -84,10 +84,11 @@ type VolumeMount struct {
 }
 
 type ResourceLimits struct {
-	MemoryBytes int64 `json:"memory_bytes,omitempty"`
-	CPUQuota    int64 `json:"cpu_quota,omitempty"`
-	CPUPeriod   int64 `json:"cpu_period,omitempty"`
-	CPUShares   int64 `json:"cpu_shares,omitempty"`
+	MemoryBytes       int64 `json:"memory_bytes,omitempty"`
+	MemoryReservation int64 `json:"memory_reservation,omitempty"`
+	CPUQuota          int64 `json:"cpu_quota,omitempty"`
+	CPUPeriod         int64 `json:"cpu_period,omitempty"`
+	CPUShares         int64 `json:"cpu_shares,omitempty"`
 }
 
 type HealthCheck struct {
@@ -152,6 +153,7 @@ type BuildConfig struct {
 	PrebuiltImage string            `json:"prebuilt_image"`
 	BuildCommand  string            `json:"build_command"`
 	StartCommand  string            `json:"start_command"`
+	BuildArgs     map[string]string `json:"build_args,omitempty"`
 	Environment   map[string]string `json:"environment"`
 	Branch        string            `json:"branch"`
 	Commit        string            `json:"commit"`
@@ -166,6 +168,12 @@ type TriggerConfig struct {
 	Timestamp time.Time         `json:"timestamp"` // When trigger occurred
 }
 
+// DockerClient exposes the engine's docker handle for read-only queries
+// (capacity checks, image info).
+func (de *DeploymentEngine) DockerClient() *docker.Client {
+	return de.dockerClient
+}
+
 func NewDeploymentEngine(buildManager *build.BuildManager, dockerClient *docker.Client) *DeploymentEngine {
 	return &DeploymentEngine{
 		buildManager:  buildManager,
@@ -290,6 +298,7 @@ func (de *DeploymentEngine) buildImage(ctx context.Context, deployment *Deployme
 		ImageTag:      deployment.ID,
 		BuildCommand:  buildConfig.BuildCommand,
 		StartCommand:  buildConfig.StartCommand,
+		BuildArgs:     buildConfig.BuildArgs,
 		Environment:   buildConfig.Environment,
 		ProjectID:     deployment.ProjectID,
 		ServiceID:     deployment.ServiceID,
@@ -330,7 +339,9 @@ func (de *DeploymentEngine) deployService(ctx context.Context, deployment *Deplo
 		HealthPath:     cfg.HealthPath,
 		RestartPolicy:  cfg.RestartPolicy,
 		MemoryBytes:    cfg.Resources.MemoryBytes,
+		MemoryReserve:  cfg.Resources.MemoryReservation,
 		NanoCPUs:       cfg.Resources.CPUQuota,
+		CPUShares:      cfg.Resources.CPUShares,
 		Volumes:        cfg.VolumeMounts,
 		Domains:        cfg.Domains,
 		Maintenance:    cfg.Maintenance,

app/backend/internal/deployment/runtime.go

@@ -47,7 +47,9 @@ type RuntimeSpec struct {
 	HealthPath     string // http path probed on Port for container healthcheck
 	RestartPolicy  string
 	MemoryBytes    int64
+	MemoryReserve  int64 // soft reservation; scheduler hint, not a hard cap
 	NanoCPUs       int64
+	CPUShares      int64         // relative weight (1024 ≈ 1 cpu), not a cap
 	Volumes        []VolumeMount // applied to every replica
 	Domains        []string      // all public hostnames; Domain is the default
 	Maintenance    bool          // redirect traffic to MaintenanceURL
@@ -273,15 +275,17 @@ func (de *DeploymentEngine) createReplica(ctx context.Context, spec RuntimeSpec,
 	}
 
 	cfg := docker.ContainerConfig{
-		Name:          fmt.Sprintf("%s%d", serviceNamePrefix(spec.ServiceID), index),
-		Image:         spec.Image,
-		Cmd:           spec.Command,
-		Env:           env,
-		Labels:        labels,
-		RestartPolicy: spec.RestartPolicy,
-		Memory:        spec.MemoryBytes,
-		NanoCPUs:      spec.NanoCPUs,
-		Networks:      endpoints,
+		Name:              fmt.Sprintf("%s%d", serviceNamePrefix(spec.ServiceID), index),
+		Image:             spec.Image,
+		Cmd:               spec.Command,
+		Env:               env,
+		Labels:            labels,
+		RestartPolicy:     spec.RestartPolicy,
+		Memory:            spec.MemoryBytes,
+		MemoryReservation: spec.MemoryReserve,
+		NanoCPUs:          spec.NanoCPUs,
+		CPUShares:         spec.CPUShares,
+		Networks:          endpoints,
 	}
 
 	for _, v := range spec.Volumes {
@@ -526,12 +530,14 @@ func specHash(spec RuntimeSpec) string {
 		Env                                            map[string]string
 		Port                                           int32
 		MemoryBytes, NanoCPUs                          int64
+		MemoryReserve, CPUShares                       int64
 		Volumes                                        []VolumeMount
 		Domains                                        []string
 		Maintenance                                    bool
 		BasicAuth                                      string
 	}{spec.Image, spec.Name, spec.Domain, spec.HealthPath, spec.RestartPolicy,
-		spec.Command, spec.Env, spec.Port, spec.MemoryBytes, spec.NanoCPUs, spec.Volumes,
+		spec.Command, spec.Env, spec.Port, spec.MemoryBytes, spec.NanoCPUs,
+		spec.MemoryReserve, spec.CPUShares, spec.Volumes,
 		spec.Domains, spec.Maintenance, spec.BasicAuthUsers})
 	sum := sha256.Sum256(payload)
 	return hex.EncodeToString(sum[:8])