perf(docker): share reactor build across images

.github/PULL_REQUEST_TEMPLATE.md

@@ -2,7 +2,7 @@
   Thank you very much for contributing to Apache HugeGraph, we are happy that you want to help us improve it!
 
   Here are some tips for you:
-    1. If this is your first time, please read the [contributing guidelines](https://github.com/apache/hugegraph/blob/master/CONTRIBUTING.md)
+    1. If this is your first time, please read the [contributing guidelines](https://github.com/apache/hugegraph/blob/master/docs/CONTRIBUTING.md)
 
     2. If a PR fix/close an issue, type the message "close xxx" (xxx is the link of related 
 issue) in the content, GitHub will auto link it (Required)

.github/workflows/docker-build-ci.yml

@@ -25,6 +25,7 @@ on:
   pull_request:
     paths:
       - '.github/workflows/docker-build-ci.yml'
+      - 'docker/bake.hcl'
       - '.dockerignore'
       - '.mvn/**'
       - 'pom.xml'
@@ -38,8 +39,71 @@ on:
       - 'install-dist/**'
 
 jobs:
+  docker-bake-check:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Verify shared Maven stages stay identical
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          extract_build_stage() {
+            awk '
+              /^FROM .* AS build$/ {
+                in_build = 1
+              }
+              in_build && seen && /^FROM / {
+                exit
+              }
+              in_build {
+                print
+                seen = 1
+              }
+            ' "$1"
+          }
+
+          reference="hugegraph-pd/Dockerfile"
+          if [ -z "$(extract_build_stage "$reference")" ]; then
+            echo "ERROR: no 'AS build' stage found in $reference"
+            exit 1
+          fi
+          for dockerfile in \
+            hugegraph-store/Dockerfile \
+            hugegraph-server/Dockerfile \
+            hugegraph-server/Dockerfile-hstore; do
+            diff -u \
+              <(extract_build_stage "$reference") \
+              <(extract_build_stage "$dockerfile")
+          done
+
+      - name: Validate shared image build graph
+        run: |
+          set -euo pipefail
+
+          docker buildx bake --file docker/bake.hcl --print > /tmp/hugegraph-bake.json
+          jq -e '
+            .group.default.targets == [
+              "build-cache",
+              "pd",
+              "server-hstore",
+              "server-standalone",
+              "store"
+            ] and
+            ([.target[] | .platforms] |
+              all(. == ["linux/amd64", "linux/arm64"])) and
+            .target["build-cache"].target == "build" and
+            .target["build-cache"].output[0].type == "cacheonly" and
+            ([.target | to_entries[] |
+              select(.key != "build-cache") |
+              .value.output[0].type] |
+              all(. == "docker"))
+          ' /tmp/hugegraph-bake.json
+
   docker-build:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-latest
     strategy:
       fail-fast: false
       matrix:

.github/workflows/pd-store-ci.yml

@@ -378,6 +378,8 @@ jobs:
           $TRAVIS_DIR/run-unit-test.sh $BACKEND
 
       - name: Run core test
+        env:
+          HUGEGRAPH_TEST_TASK_LOG_LEVEL: WARN
         run: |
           $TRAVIS_DIR/run-core-test.sh $BACKEND
 

.gitignore

@@ -19,9 +19,7 @@ gen-java
 .svn
 
 ### IntelliJ IDEA ###
-.idea/*
-!.idea/vcs.xml
-!.idea/icon.png
+.idea/
 *.iws
 *.iml
 *.ipr

.serena/memories/key_file_locations.md

@@ -41,4 +41,4 @@
 - `stale.yml` — Stale issue/PR cleanup
 
 ## Docs
-- `README.md`, `BUILDING.md`, `CONTRIBUTING.md`, `AGENTS.md`, `CLAUDE.md`
+- `README.md`, `docs/BUILDING.md`, `docs/CONTRIBUTING.md`, `AGENTS.md`, `CLAUDE.md`

.serena/project.yml

@@ -47,7 +47,7 @@ ignored_paths:
   - "hugegraph-server/hugegraph-test/**/tinkerpop/**"
   - "hugegraph-server/hugegraph-example/**"
   - "hugegraph-cluster-test/**"
-  # --- Note: target/, .flattened-pom.xml, .idea/*, apache-hugegraph-*/ already covered by .gitignore ---
+  # --- Note: target/, .flattened-pom.xml, .idea/, apache-hugegraph-*/ already covered by .gitignore ---
 
 # whether the project is in read-only mode
 # If set to true, all editing tools will be disabled and attempts to use them will result in an error

README.md

@@ -263,7 +263,7 @@ bin/init-store.sh
 bin/start-hugegraph.sh
 ```
 
-For detailed build instructions, see [BUILDING.md](BUILDING.md) and [Build from Source Guide](https://hugegraph.apache.org/docs/quickstart/hugegraph-server/#33-source-code-compilation).
+For detailed build instructions, see [BUILDING.md](docs/BUILDING.md) and [Build from Source Guide](https://hugegraph.apache.org/docs/quickstart/hugegraph-server/#33-source-code-compilation).
 
 </details>
 
@@ -328,7 +328,7 @@ For detailed architecture and development guidance, see [AGENTS.md](AGENTS.md).
 
 2. **Set Up Your Environment**
    - Install Java 11+ and Maven 3.5+
-   - Follow [BUILDING.md](BUILDING.md) for build instructions
+   - Follow [BUILDING.md](docs/BUILDING.md) for build instructions
    - Configure your IDE to use `.editorconfig` for code style and `style/checkstyle.xml` for Checkstyle rules
 
 3. **Find Your First Issue**
@@ -348,7 +348,7 @@ For detailed architecture and development guidance, see [AGENTS.md](AGENTS.md).
    - Commit format: `feat|fix|refactor(module): description`
 
 6. **Submit Your Contribution**
-   - Read [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines
+   - Read [CONTRIBUTING.md](docs/CONTRIBUTING.md) for guidelines
    - Follow the [Contribution Guidelines](https://hugegraph.apache.org/docs/contribution-guidelines/)
    - Use [GitHub Desktop](https://desktop.github.com/) to simplify the PR process
 
@@ -358,7 +358,7 @@ For detailed architecture and development guidance, see [AGENTS.md](AGENTS.md).
 
 Welcome to contribute to HugeGraph!
 
-- **How to Contribute**: See [CONTRIBUTING.md](CONTRIBUTING.md) and [Contribution Guidelines](https://hugegraph.apache.org/docs/contribution-guidelines/)
+- **How to Contribute**: See [CONTRIBUTING.md](docs/CONTRIBUTING.md) and [Contribution Guidelines](https://hugegraph.apache.org/docs/contribution-guidelines/)
 - **Code Style**: Configure your IDE to use `.editorconfig` for code style and `style/checkstyle.xml` for Checkstyle rules
 - **PR Tool**: [GitHub Desktop](https://desktop.github.com/) is recommended for simpler workflow
 

docker/README.md

@@ -23,8 +23,7 @@ This directory contains Docker Compose files for running HugeGraph:
 
 Two compose files run one PD, one Store, one Server, and one Hubble instance:
 
-Create a Compose environment file once so every lifecycle command can resolve
-the required administrator password:
+Create a Compose environment file once so every lifecycle command can resolve the required administrator password:
 
 ```bash
 (
@@ -56,18 +55,11 @@ the required administrator password:
 )
 ```
 
-Compose automatically reads `docker/.env` for `up`, `ps`, `stop`, and `down`.
-The generated password is a 16-character, Compose-safe random value. The file
-is excluded from Git and Docker build contexts; keep its permissions restricted
-and source production credentials from your secret manager instead of
-committing them.
+Compose automatically reads `docker/.env` for `up`, `ps`, `stop`, and `down`. The generated password is a 16-character, Compose-safe random value. The file is excluded from Git and Docker build contexts; keep its permissions restricted and source production credentials from your secret manager instead of committing them.
 
 ### Option A: Quick Start (pre-built images)
 
-Uses pre-built images from Docker Hub. Best for **end users** who want to run HugeGraph quickly.
-Set `HUGEGRAPH_VERSION` to the same published release for PD, Store, Server,
-and Hubble. The authenticated PD/Hubble integration is not present in `1.7.x`;
-if no later compatible release is available, use Option B.
+Uses pre-built images from Docker Hub. Best for **end users** who want to run HugeGraph quickly. Set `HUGEGRAPH_VERSION` to the same published release for PD, Store, Server, and Hubble. The authenticated PD/Hubble integration is not present in `1.7.x`; if no later compatible release is available, use Option B.
 
 ```bash
 (
@@ -77,25 +69,43 @@ if no later compatible release is available, use Option B.
 )
 ```
 
-- Images: matching `hugegraph/pd`, `hugegraph/store`, `hugegraph/server`, and
-  `hugegraph/hubble` tags from the selected compatible release
+- Images: matching `hugegraph/pd`, `hugegraph/store`, `hugegraph/server`, and `hugegraph/hubble` tags from the selected compatible release
 - `pull_policy: always` — always pulls the specified image tag
 
-> **Note**: Do not use `latest` to claim a reproducible deployment. Pin a
-> compatible release tag and keep it unchanged for later lifecycle commands.
+> **Note**: Do not use `latest` to claim a reproducible deployment. Pin a compatible release tag and keep it unchanged for later lifecycle commands.
 - PD healthcheck endpoint: `/v1/health`
-- Hubble is available at `http://localhost:8088`; sign in as `admin` with the
-  required `HUGEGRAPH_ADMIN_PASSWORD`
-- Hubble binds to host loopback by default. Set `HUBBLE_PUBLISH_HOST`
-  explicitly only behind an HTTPS reverse proxy and trusted network controls.
+- Hubble is available at `http://localhost:8088`; sign in as `admin` with the required `HUGEGRAPH_ADMIN_PASSWORD`
+- Hubble binds to host loopback by default. Set `HUBBLE_PUBLISH_HOST` explicitly only behind an HTTPS reverse proxy and trusted network controls.
 - Hubble uses PD discovery and the Docker-network Server address
 - Server healthcheck endpoint: `/versions`
 
 ### Option B: Development Build (build from source)
 
-Builds images locally from source Dockerfiles. Best for **developers** who want to test local changes.
-Build the matching `hugegraph-toolchain` Hubble source as
-`local/hugegraph-hubble:dev` before starting this stack.
+Builds images locally from source Dockerfiles. Best for **developers** who want to test local changes. Build the matching `hugegraph-toolchain` Hubble source as `local/hugegraph-hubble:dev` before starting this stack.
+
+The publishing pipeline uses [`docker/bake.hcl`](./bake.hcl) from the repository root to compile the Java reactor once and build the PD, Store, HStore Server, and standalone Server runtime images from that shared result.
+
+Run Bake commands from the repository root. Use `--print` to inspect the resolved targets without building, or run the default group to build all four amd64/arm64 images. Loading both platforms under the same local tags requires Docker's containerd image store.
+
+```bash
+# Inspect the resolved build graph
+docker buildx bake --file docker/bake.hcl --print
+
+# Build the default multi-platform target group
+IMAGE_TAG=local docker buildx bake --file docker/bake.hcl
+```
+
+Local source changes are included because Bake uses the current repository working tree as its build context. For routine development, override all targets to the host architecture so the four images still share one Maven build without requiring the multi-platform containerd image store.
+
+```bash
+# x86_64 host
+IMAGE_TAG=local docker buildx bake --file docker/bake.hcl --set '*.platform=linux/amd64'
+
+# ARM64 host
+IMAGE_TAG=local docker buildx bake --file docker/bake.hcl --set '*.platform=linux/arm64'
+```
+
+These local commands can read existing Registry caches but do not publish images or write remote caches because `EXPORT_CACHE` defaults to `false`.
 
 ```bash
 (
@@ -108,8 +118,7 @@ Build the matching `hugegraph-toolchain` Hubble source as
 
 - PD, Store, and Server images are built from this repository
 - Hubble uses `HUBBLE_IMAGE` because its source is in `hugegraph-toolchain`
-- Server entrypoint scripts are baked into the built image; Hubble mounts the
-  Docker-local PD configuration
+- Server entrypoint scripts are baked into the built image; Hubble mounts the Docker-local PD configuration
 - PD healthcheck endpoint: `/v1/health`
 - Otherwise identical env vars and structure to the quickstart file
 
@@ -265,27 +274,11 @@ Configuration is injected via environment variables. The old `docker/configs/app
 | `PASSWORD` | No | — | Enables auth and sets `auth.admin_pa` | Initial administrator password; disabled init-store does not read it from stdin, but the entrypoint still applies it to the PD bootstrap path |
 | `HG_SERVER_INIT_STORE_ENABLED` | No | `true` | `init_store.enabled` in `rest-server.properties` | Set `false` in PD/HStore deployments so init-store skips local backend and admin initialization |
 
-> **The built-in authenticator with `HG_SERVER_INIT_STORE_ENABLED=false`
-> requires `usePD=true` and an HStore-backed `auth.graph_store`, unless
-> `auth.remote_url` delegates auth elsewhere.** With init-store skipped, the
-> server creates the built-in admin in PD metadata, and only an HStore auth
-> graph uses the PD-backed auth manager that can read that account. init-store
-> exits non-zero when the combination is unusable, rather than leaving a server
-> nobody can log in to. A custom `auth.authenticator` is exempt because it
-> manages its own identities.
+> **The built-in authenticator with `HG_SERVER_INIT_STORE_ENABLED=false` requires `usePD=true` and an HStore-backed `auth.graph_store`, unless `auth.remote_url` delegates auth elsewhere.** With init-store skipped, the server creates the built-in admin in PD metadata, and only an HStore auth graph uses the PD-backed auth manager that can read that account. init-store exits non-zero when the combination is unusable, rather than leaving a server nobody can log in to. A custom `auth.authenticator` is exempt because it manages its own identities.
 >
-> `docker/init_complete` is written by init-store itself, and only after it has
-> initialized. A skipped run therefore records nothing, whether it was disabled
-> by the variable or by the property in a mounted `rest-server.properties`, so a
-> later re-enable is still able to initialize. The marker only short-circuits
-> re-initialization: init-store runs on every container start, and a disabled
-> one performs the fail-closed check above first, so a marker left by an
-> earlier release or an earlier enabled run cannot bypass it.
+> `docker/init_complete` is written by init-store itself, and only after it has initialized. A skipped run therefore records nothing, whether it was disabled by the variable or by the property in a mounted `rest-server.properties`, so a later re-enable is still able to initialize. The marker only short-circuits re-initialization: init-store runs on every container start, and a disabled one performs the fail-closed check above first, so a marker left by an earlier release or an earlier enabled run cannot bypass it.
 >
-> The entrypoint maps **`PASSWORD` to `auth.admin_pa`** before init-store runs.
-> A disabled init-store does not read the password from standard input, but the
-> PD startup path uses the explicit `auth.admin_pa` value when it first creates
-> the administrator. Changing it later does not rotate an existing password.
+> The entrypoint maps **`PASSWORD` to `auth.admin_pa`** before init-store runs. A disabled init-store does not read the password from standard input, but the PD startup path uses the explicit `auth.admin_pa` value when it first creates the administrator. Changing it later does not rotate an existing password.
 
 The single-node Compose files also accept these deployment-level overrides:
 
@@ -299,11 +292,7 @@ The single-node Compose files also accept these deployment-level overrides:
 | `HUGEGRAPH_ADMIN_PASSWORD` | required (`docker/.env`) | Initial admin password; no public default is provided |
 | `HUGEGRAPH_AUTH_TOKEN_SECRET` | generated | JWT signing secret; explicit values must be at least 32 bytes |
 
-When authentication is enabled and no token secret is supplied, the Server
-entrypoint generates a random secret and writes it to both authentication
-configurations. The value is reused on container restart while the container
-filesystem is preserved. To preserve tokens across container recreation,
-generate a compatible secret once and add it to the mode-600 `docker/.env`:
+When authentication is enabled and no token secret is supplied, the Server entrypoint generates a random secret and writes it to both authentication configurations. The value is reused on container restart while the container filesystem is preserved. To preserve tokens across container recreation, generate a compatible secret once and add it to the mode-600 `docker/.env`:
 
 ```bash
 (
@@ -348,8 +337,7 @@ generate a compatible secret once and add it to the mode-600 `docker/.env`:
 )
 ```
 
-The entrypoint rejects shorter explicit values before changing either Server
-configuration file.
+The entrypoint rejects shorter explicit values before changing either Server configuration file.
 
 **Deprecated aliases** (still work but log a warning):
 
@@ -362,9 +350,7 @@ configuration file.
 
 ## Port Reference
 
-The table below reflects the published host ports in `docker-compose-3pd-3store-3server.yml`.
-The single-node Compose file publishes `8620`, `8520`, `8080`, and Hubble
-`8088`; Hubble defaults to host loopback.
+The table below reflects the published host ports in `docker-compose-3pd-3store-3server.yml`. The single-node Compose file publishes `8620`, `8520`, `8080`, and Hubble `8088`; Hubble defaults to host loopback.
 
 | Service | Container Port | Host Port | Protocol | Purpose |
 |---------|---------------|-----------|----------|---------|