build: optimize Dockerfile.

installer/Dockerfile

@@ -7,15 +7,17 @@ RUN cd ui && ls -la && if [ -d "dist" ]; then exit 0; fi && \
     find . -maxdepth 1 ! -name '.' ! -name 'dist' ! -name 'public' -exec rm -rf {} +
 
 FROM ghcr.io/1panel-dev/maxkb-base:python3.11-pg17.6 AS stage-build
-
 COPY --chmod=700 . /opt/maxkb-app
-
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends gettext libexpat1-dev libffi-dev && \
+    apt-get clean all  && \
+    rm -rf /var/lib/apt/lists/*
 WORKDIR /opt/maxkb-app
 RUN rm -rf /opt/maxkb-app/ui && \
     pip install uv --break-system-packages && \
     python -m uv pip install -r pyproject.toml && \
     find /opt/maxkb-app  -depth \( -name ".git*" -o -name ".docker*" -o -name ".idea*" -o -name ".editorconfig*" -o -name ".prettierrc*" -o -name "README.md" -o -name "poetry.lock" -o -name "pyproject.toml"  \) -exec rm -rf {} + && \
-    export MAXKB_CONFIG_TYPE=ENV && python3 /opt/maxkb-app/apps/manage.py compilemessages && \
+    python /opt/maxkb-app/apps/manage.py compilemessages && \
     export PIP_TARGET=/opt/maxkb-app/sandbox/python-packages && \
     python -m uv pip install --target=$PIP_TARGET requests pymysql psycopg2-binary && \
     rm -rf /opt/maxkb-app/installer

installer/Dockerfile-base

@@ -10,12 +10,9 @@ COPY installer/*.sh /usr/bin/
 COPY installer/init.sql /docker-entrypoint-initdb.d/
 
 ARG DEPENDENCIES="                    \
-        libexpat1-dev                 \
-        libffi-dev                    \
         curl                          \
         ca-certificates               \
         vim                           \
-        gettext                       \
         wait-for-it                   \
         redis-server                  \
         postgresql-17-pgvector        \
@@ -49,7 +46,7 @@ ENV PATH=/opt/py3/bin:$PATH \
     MAXKB_LOG_LEVEL=INFO \
     MAXKB_SANDBOX=1 \
     MAXKB_SANDBOX_PYTHON_PACKAGE_PATHS="/opt/py3/lib/python3.11/site-packages,/opt/maxkb-app/sandbox/python-packages,/opt/maxkb/python-packages" \
-    MAXKB_SANDBOX_PYTHON_BANNED_KEYWORDS="subprocess.,system(,exec(,pty.,eval(,compile(,shutil.,input(,__import__" \
+    MAXKB_SANDBOX_PYTHON_BANNED_KEYWORDS="subprocess.,system(,exec(,execve(,pty.,eval(,compile(,shutil.,input(,__import__" \
     MAXKB_ADMIN_PATH=/admin
 
 EXPOSE 6379