fix(blueprints): rework deploy/docker to use the LangGraph CLI (the old one didn't work)

[blove]

Summary

A full docker test of the shipped deploy/docker blueprint proved it does not produce a working container: it hand-rolled a multi-stage Dockerfile with CMD ["node", ".dawn/build/server.js"] — but dawn build emits langgraph.json, not a server (Dawn has no standalone HTTP server) — and its pnpm install --prod failed (ERR_PNPM_IGNORED_BUILDS: esbuild).

This reworks the blueprint to the validated correct approach (I verified each step against a real scaffolded app):

• Delegate to @langchain/langgraph-cli (langgraphjs dockerfile / build) against the dawn build artifact — matching Dawn's own deployment.mdx self-hosting guidance.
• Documents the real path-resolution gotcha: Dawn writes langgraph.json with root-relative graph paths, so it must sit at the app root or langgraphjs doubles the path (​.dawn/build/.dawn/build/...).
• Generates a correct LangGraph platform image (FROM langchain/langgraphjs-api:22) and is honest about the runtime: it needs Postgres + Redis + a LangGraph/LangSmith license (langgraphjs up provisions them) — not a trivial node server.js.
• Bumps version 1 → 2; marker # dawn-blueprint: docker@2.

Pairs with #277 (which adds pnpm.onlyBuiltDependencies: ["esbuild"] to scaffolds, so the in-image pnpm i succeeds).

Test Plan

• pnpm --filter web exec vitest run app/blueprints (11) — validator + catalog + marker checks pass
• Validated langgraphjs dockerfile generates a real Dockerfile from a Dawn langgraph.json
• Only apps/web/content/blueprints/deploy/docker.md changed (website content; no changeset needed)

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
dawnai	Ready	Preview, Comment	Jun 27, 2026 10:18pm

[github-actions]

Automated approval: this PR received an intelligent (AI) code review. See the review comments on this PR.

[github-actions]

Claude finished @blove's task in 1m 46s —— View job

---

PR Review — fix(blueprints): rework deploy/docker to use LangGraph CLI

• Gather context (reading diff, no CLAUDE.md present)
• Review changed file for correctness, security, and quality
• Post findings

---

Summary

The approach is correct and this is a real fix — the old blueprint was broken by design (no standalone server, pnpm i --prod failing). The new delegation to @langchain/langgraph-cli matches Dawn's own deployment guidance and the platform requirements disclosure (Postgres + Redis + license key) is the right call.

One correctness bug in the guide text, two minor issues.

---

Issues

1. npx used after installing as a dev dep — can pull a mismatched version (correctness)

The guide correctly installs @langchain/langgraph-cli as a dev dependency and even confirms the binary with pnpm exec langgraphjs --version. But four later invocations switch to npx @langchain/langgraph-cli, which fetches from the registry and can pull a different version than what's pinned in the lockfile:

Location	Current (inconsistent)	Should be
Step 3 — generate Dockerfile	npx @langchain/langgraph-cli dockerfile ./Dockerfile	pnpm exec langgraphjs dockerfile ./Dockerfile
Step 4 — one-step build	npx @langchain/langgraph-cli build -t my-dawn-app	pnpm exec langgraphjs build -t my-dawn-app
Verify step 2 — local run	npx @langchain/langgraph-cli up	pnpm exec langgraphjs up
Updating step 2 — regenerate	npx @langchain/langgraph-cli dockerfile ./Dockerfile	pnpm exec langgraphjs dockerfile ./Dockerfile

All four should use pnpm exec langgraphjs (with npm exec langgraphjs / yarn langgraphjs shown as alternates, matching the install section's pattern). Fix this →

2. .gitignore instruction contradicts the "hand-authored" alternative (minor)

The guide says: "Add the generated copy to .gitignore (or keep a hand-authored root langgraph.json — Dawn shallow-merges it on build)" then immediately tells users to run echo 'langgraph.json' >> .gitignore. If a user chooses the hand-authored path they should NOT add it to .gitignore. Consider splitting the two cases:

# If generated (copy from .dawn/build) — don't commit it:
echo 'langgraph.json' >> .gitignore

# If hand-authored (Dawn merges it) — commit it instead.

3. docker@1 → docker@2 migration path is implicit (minor)

The "Inspect" step says: "If it is # dawn-blueprint: docker@1, this is an older version — proceed with the steps below to regenerate it." but "Updating an existing install" only covers docker@2. Users hitting this from v1 might not realize that their old Dockerfile is completely replaced (not patched), and that the runtime requirements have fundamentally changed (now needs Postgres + Redis). A one-sentence callout at the start of the update section would help: "Note: upgrading from v1 to v2 is a full replacement — the old image cannot run without Postgres and Redis."

---

What looks good

• Path-resolution gotcha is clearly documented and the cp .dawn/build/langgraph.json ./langgraph.json fix is the right solution
• Platform requirements (Postgres, Redis, license key) disclosed upfront — correct and honest
• pnpm.onlyBuiltDependencies: ["esbuild"] check preempts the ERR_PNPM_IGNORED_BUILDS failure
• Version bump to version: 2 and updated marker are properly done
• No secrets in the image; .env.example pattern is correct

The blocker is issue #1. #2 and #3 are polish but not blocking.