perf(core): Write CI image tarballs straight from BuildKit (no-changelog)

The e2e image path made four passes over ~3GB to produce one file: bake
exported an OCI tarball, streamed it to dockerd, dockerd unpacked it into
overlay2, then `docker save` read it back out and piped it through zstd.

BuildKit writes the docker-archive directly instead. `compression=zstd`
compresses the layers inside the archive, so the separate compression pass goes
away too - the file is cache-ready as written, and `docker load` handles the
decompression on the other side.

This lands on prepare-docker, which runs ~1000-1400x/week and is the most
frequent Docker job in CI.

Output is one archive per target in DOCKER_BUILD_TARBALL_DIR, so the cache
entry becomes a directory and the variable target count (distroless, pc) needs
no special casing. The pc variant loads its archive before asserting pointer
compression, since nothing reaches the daemon implicitly any more.

Trade-off: with no images in the daemon, `docker images` cannot report a size,
so the e2e docker-image-size metric stops being emitted. Left as Unknown rather
than substituted with the compressed archive size, which would silently change
what the metric means. That image is built with INCLUDE_TEST_CONTROLLER=true
and was never the shipped artifact, so image size belongs on the release path.

Verified locally: bake writes n8n.tar (327M) and runners.tar (162M) with the
expected RepoTags, and `docker load -i` restores a working image.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: shortstacked

.github/actions/build-n8n-docker/action.yml

@@ -24,7 +24,7 @@ runs:
       uses: actions/cache/restore@640a1c2554105b57832a23eea0b4672fc7a790d5 # v4.2.3
       with:
         key: n8n-docker-image-${{ inputs.build-variant }}-${{ github.sha }}
-        path: /tmp/n8n-image.tar.zst
+        path: /tmp/n8n-images
         lookup-only: true
 
     - name: Build Docker image
@@ -36,30 +36,30 @@ runs:
         docker-cache-key: n8n-io/n8n
       env:
         INCLUDE_TEST_CONTROLLER: 'true'
+        DOCKER_BUILD_TARBALL_DIR: /tmp/n8n-images
         # Selects the n8n-pc bake target, which carries the pointer-compressed pins.
         DOCKER_BUILD_PC: ${{ inputs.build-variant == 'pc' }}
 
     - name: Assert pointer compression
       if: steps.cache-check.outputs.cache-hit != 'true' && inputs.build-variant == 'pc'
       shell: bash
       run: |
+        docker load -i /tmp/n8n-images/n8n-pc.tar
         docker run --rm --entrypoint node n8nio/n8n:local -e "
           if (!process.config.variables.v8_enable_pointer_compression) {
             throw new Error('pc variant image is not pointer-compressed');
           }
           console.log(process.version, 'pointer compression: on');
         "
 
-    - name: Save image tarball
+    - name: Report tarball sizes
       if: steps.cache-check.outputs.cache-hit != 'true'
       shell: bash
-      run: |
-        docker save n8nio/n8n:local n8nio/runners:local | zstd -T0 -3 -o /tmp/n8n-image.tar.zst
-        ls -lh /tmp/n8n-image.tar.zst
+      run: ls -lh /tmp/n8n-images
 
     - name: Publish image tarball to cache
       if: steps.cache-check.outputs.cache-hit != 'true'
       uses: actions/cache/save@640a1c2554105b57832a23eea0b4672fc7a790d5 # v4.2.3
       with:
         key: n8n-docker-image-${{ inputs.build-variant }}-${{ github.sha }}
-        path: /tmp/n8n-image.tar.zst
+        path: /tmp/n8n-images

.github/actions/load-n8n-docker/action.yml

@@ -11,7 +11,7 @@
 # the tarball to cache as a side effect.
 
 name: 'Load n8n Docker images from cache'
-description: 'Restores the zstd-compressed n8n + runners image tarball from the variant+SHA-keyed GHA cache and loads both images into the local docker daemon. Falls back to rebuilding on cache miss.'
+description: 'Restores the n8n + runners image tarballs from the variant+SHA-keyed GHA cache and loads both images into the local docker daemon. Falls back to rebuilding on cache miss.'
 
 inputs:
   build-variant:
@@ -31,12 +31,14 @@ runs:
       uses: actions/cache/restore@640a1c2554105b57832a23eea0b4672fc7a790d5 # v4.2.3
       with:
         key: n8n-docker-image-${{ inputs.build-variant }}-${{ inputs.cache-sha || github.sha }}
-        path: /tmp/n8n-image.tar.zst
+        path: /tmp/n8n-images
 
     - name: Load n8n and runners images into docker
       if: steps.restore.outputs.cache-hit == 'true'
       shell: bash
-      run: zstd -d -c /tmp/n8n-image.tar.zst | docker load
+      # Layers inside each archive are zstd-compressed by BuildKit, so docker
+      # load handles decompression - no separate zstd pass.
+      run: for f in /tmp/n8n-images/*.tar; do docker load -i "$f"; done
 
     - name: Warn on cache miss
       if: steps.restore.outputs.cache-hit != 'true'

scripts/dockerize-n8n.mjs

@@ -13,6 +13,8 @@
  *   NODE_VERSION, BUILDER_IMAGE, RUNTIME_IMAGE          - read by bake directly
  *   DOCKER_PLATFORM                                     - cross-platform builds
  *   DOCKER_BUILD_NO_CACHE, DOCKER_BUILD_BASE_IMAGE, DOCKER_BUILD_DISTROLESS
+ *   DOCKER_BUILD_TARBALL_DIR - write per-target docker-archives here instead of
+ *                              loading into the daemon (CI image distribution)
  *   CONTAINER_ENGINE                                    - force 'docker' or 'podman'
  */
 
@@ -42,6 +44,9 @@ const imageTag = process.env.IMAGE_TAG || 'local';
 // Push directly when the name carries a registry host, which avoids the slow
 // --load export/import round-trip.
 const shouldPush = imageBaseName.split('/').length > 2;
+// CI wants a tarball, not images in the daemon. Writing it straight from BuildKit
+// skips the dockerd import and the `docker save` that reads it back out again.
+const tarballDir = process.env.DOCKER_BUILD_TARBALL_DIR;
 
 const compiledAppDir = path.join(rootDir, 'compiled');
 const compiledTaskRunnerDir = path.join(rootDir, 'dist', 'task-runner-javascript');
@@ -138,13 +143,26 @@ async function buildWithBake(targets) {
 	const driver = await buildxDriver();
 	const isContainerDriver = driver !== 'docker';
 
+	// `compression=zstd` compresses the layers inside the archive, so no separate
+	// compression pass is needed - the file is cache-ready as written.
+	const tarballOutputs = targets.flatMap((t) => [
+		'--set',
+		`${t}.output=type=docker,dest=${path.join(tarballDir ?? '', `${t}.tar`)},compression=zstd,compression-level=3`,
+	]);
+
 	const flags = [
 		...(noCache ? ['--no-cache'] : []),
 		// The 'docker' driver builds straight into the daemon and rejects both flags.
-		...(isContainerDriver ? ['--provenance=false', shouldPush ? '--push' : '--load'] : []),
+		...(isContainerDriver
+			? [
+					'--provenance=false',
+					...(tarballDir ? tarballOutputs : [shouldPush ? '--push' : '--load']),
+				]
+			: []),
 	];
 
 	echo(chalk.yellow(`INFO: Building ${targets.join(', ')} with docker buildx bake...`));
+	if (tarballDir) echo(chalk.yellow(`INFO: Writing image tarballs to ${tarballDir}`));
 	if (shouldPush) echo(chalk.yellow(`INFO: Registry detected - pushing directly`));
 
 	await $({ verbose: true })`docker buildx bake -f ${BAKE_FILE} ${targets} ${flags}`;
@@ -200,6 +218,8 @@ async function main() {
 	let platform;
 	let imageNames;
 
+	if (tarballDir) await fs.ensureDir(tarballDir);
+
 	if (usePodman) {
 		platform = hostPlatform();
 		imageNames = await buildWithPodman(platform);
@@ -216,7 +236,10 @@ async function main() {
 
 	const images = [];
 	for (const imageName of imageNames) {
-		images.push({ imageName, size: await getImageSize(imageName) });
+		// In tarball mode nothing is loaded into the daemon, so there is no size to
+		// read. Left out rather than reported as the compressed archive size, which
+		// would silently change what the docker-image-size metric means.
+		images.push({ imageName, size: tarballDir ? 'Unknown' : await getImageSize(imageName) });
 	}
 
 	await fs.writeJson(