Thin out the docker image

Dockerfile

@@ -9,26 +9,35 @@ COPY frontend/package.json frontend/package-lock.json frontend/.npmrc ./
 RUN npm ci
 
 COPY frontend/ ./
-RUN VITE_COMMIT_HASH=${COMMIT_HASH} npm run build
+RUN VITE_COMMIT_HASH=${COMMIT_HASH} npm run build \
+    && find dist -name '*.map' -delete
 
 
-# Stage 2: Python runtime
+# Stage 2: Install Python dependencies (uv stays in this stage only)
+FROM python:3.13-slim AS python-deps
+
+WORKDIR /app
+
+COPY --from=ghcr.io/astral-sh/uv:0.6 /uv /usr/local/bin/uv
+COPY pyproject.toml uv.lock ./
+RUN uv sync --frozen --no-dev
+
+
+# Stage 3: Final runtime (no uv, no source maps)
 FROM python:3.13-slim
 
 ARG COMMIT_HASH=unknown
 
 WORKDIR /app
 
-ENV COMMIT_HASH=${COMMIT_HASH}
+ENV COMMIT_HASH=${COMMIT_HASH} \
+    PATH="/app/.venv/bin:$PATH"
 
-# Install uv
-COPY --from=ghcr.io/astral-sh/uv:0.6 /uv /usr/local/bin/uv
+# Copy installed venv from deps stage
+COPY --from=python-deps /app/.venv ./.venv
 
-# Copy dependency files first for layer caching
-COPY pyproject.toml uv.lock ./
-
-# Install dependencies (no dev/test deps)
-RUN uv sync --frozen --no-dev
+# Copy dependency metadata (pyproject.toml needed by app for version info)
+COPY pyproject.toml ./
 
 # Copy application code
 COPY app/ ./app/
@@ -36,7 +45,7 @@ COPY app/ ./app/
 # Copy license attributions
 COPY LICENSES.md ./
 
-# Copy built frontend from first stage
+# Copy built frontend from first stage (source maps already stripped)
 COPY --from=frontend-builder /build/dist ./frontend/dist
 
 # Create data directory for SQLite database
@@ -44,5 +53,5 @@ RUN mkdir -p /app/data
 
 EXPOSE 8000
 
-# Run the application (we retain root for max compatibility)
-CMD ["uv", "run", "uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8000"]
+# Run uvicorn directly from the venv (no uv needed at runtime)
+CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8000"]

frontend/src/test/rawPacketStats.test.ts

@@ -147,9 +147,7 @@ describe('buildRawPacketStatsSnapshot', () => {
       '2-5',
       '6-10',
       '11-15',
-      '16-20',
-      '21-31',
-      '32+',
+      '16+',
     ]);
     expect(stats.hopProfile).toEqual(
       expect.arrayContaining([
@@ -158,9 +156,7 @@ describe('buildRawPacketStatsSnapshot', () => {
         expect.objectContaining({ label: '2-5', count: 1 }),
         expect.objectContaining({ label: '6-10', count: 0 }),
         expect.objectContaining({ label: '11-15', count: 0 }),
-        expect.objectContaining({ label: '16-20', count: 0 }),
-        expect.objectContaining({ label: '21-31', count: 0 }),
-        expect.objectContaining({ label: '32+', count: 0 }),
+        expect.objectContaining({ label: '16+', count: 0 }),
       ])
     );
     expect(stats.hopByteWidthProfile).toEqual(

frontend/src/utils/rawPacketStats.ts

@@ -322,13 +322,7 @@ function getHopProfileBucket(pathTokenCount: number): string {
   if (pathTokenCount <= 15) {
     return '11-15';
   }
-  if (pathTokenCount <= 20) {
-    return '16-20';
-  }
-  if (pathTokenCount <= 31) {
-    return '21-31';
-  }
-  return '32+';
+  return '16+';
 }
 
 export function buildRawPacketStatsSnapshot(
@@ -360,9 +354,7 @@ export function buildRawPacketStatsSnapshot(
     ['2-5', 0],
     ['6-10', 0],
     ['11-15', 0],
-    ['16-20', 0],
-    ['21-31', 0],
-    ['32+', 0],
+    ['16+', 0],
   ]);
   const hopByteWidthCounts = new Map<string, number>([
     ['No path', 0],