Several variants of the container

Containerfile

@@ -3,12 +3,19 @@
 
 # peo: neo4j-browser on top of PostgreSQL + Apache AGE.
 #
-# Stage 1 builds the neo4j-browser static frontend from source.
-# Stage 2 is the Apache AGE image (PostgreSQL with the AGE extension) plus the
-# peo Python package, which speaks the Bolt protocol to the browser and
-# translates Cypher into AGE `cypher()` calls, and pgAdmin as a SQL interface.
+# Two images can be built from this file:
+#
+#   full (the default): the Apache AGE image (PostgreSQL with the AGE extension)
+#       plus peo, neo4j-browser and pgAdmin, all in one container.
+#   slim (--target slim): only peo and neo4j-browser, for connecting to a
+#       separate PostgreSQL server with AGE; see compose.yaml.
+#
+# peo is the Python package that speaks the Bolt protocol to the browser and
+# translates Cypher into AGE `cypher()` calls. The browser stage builds the
+# neo4j-browser static frontend from source for both images.
 
 ARG AGE_IMAGE=docker.io/apache/age:release_PG18_1.8.0
+ARG SLIM_BASE_IMAGE=docker.io/library/debian:trixie-slim
 # Commit of apache/age's release/PG18/1.8.0 branch, for AGE's LICENSE and NOTICE.
 ARG AGE_SOURCE_REF=b570cf7c1486863f77c14e9c0e07b0e9bfd01bf4
 ARG PGADMIN_VERSION=9.18
@@ -28,7 +35,42 @@ RUN yarn install --frozen-lockfile --network-timeout 600000
 RUN yarn build && test -f dist/index.html
 
 
-FROM ${AGE_IMAGE}
+FROM ${SLIM_BASE_IMAGE} AS slim
+
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends python3 python3-psycopg python3-venv \
+    && rm -rf /var/lib/apt/lists/*
+
+# peo itself, using Debian's psycopg and the other dependencies from PyPI. License
+# notices: see THIRD_PARTY_NOTICES.md.
+COPY container/collect-python-licenses.py /tmp/
+COPY container/licenses/ /tmp/licenses/
+COPY pyproject.toml README.md LICENSE /tmp/peo/
+COPY peo /tmp/peo/peo
+RUN python3 -m venv --system-site-packages /opt/peo/venv \
+    && /opt/peo/venv/bin/pip install --no-cache-dir "/tmp/peo[browser]" \
+    && /opt/peo/venv/bin/python /tmp/collect-python-licenses.py \
+        /usr/share/doc/peo/peo-python-licenses /tmp/licenses \
+    && rm -r /tmp/peo /tmp/collect-python-licenses.py /tmp/licenses
+COPY LICENSE THIRD_PARTY_NOTICES.md /usr/share/doc/peo/
+COPY --from=browser /src/LICENSE /src/NOTICE.txt /src/LICENSES.txt /neo4j-browser-source.tar.gz \
+    /usr/share/doc/peo/neo4j-browser/
+COPY --from=browser /src/dist /opt/peo/browser
+
+RUN useradd --system --no-create-home --home-dir /nonexistent --shell /usr/sbin/nologin peo
+USER peo
+
+ENV PEO_BROWSER_DIR=/opt/peo/browser \
+    PEO_HTTP_PORT=7474 \
+    PEO_BOLT_PORT=7687
+
+# 7474: neo4j-browser (HTTP), 7687: Bolt
+EXPOSE 7474 7687
+
+CMD ["/opt/peo/venv/bin/peo"]
+
+
+FROM ${AGE_IMAGE} AS full
 
 ARG AGE_SOURCE_REF
 ARG PGADMIN_VERSION