feat: pre-seed BuildKit layer store for faster first builds

[hiroTamada]

Summary

• Adds preseed-layers.sh script that warms BuildKit's content store by pulling and extracting base image layers at builder image build time
• Adds make build-builder-preseeded Makefile target
• Documents pre-seeding in builder image README

Problem

Every code-change deploy spends ~13s extracting base image layers because ephemeral builder VMs start with an empty BuildKit content store. Even with registry cache, BuildKit must decompress and extract all 16 base image layers before executing any Dockerfile steps.

Approach

Pre-seed the builder image with extracted layers:

1. Build the base builder image
2. Run a privileged warmup container that starts buildkitd and does a dummy build against each base image
3. Commit the warmed container (with populated content store) as the final builder image

Benchmark

Scenario	FROM step	Total build
Cold start (no pre-seed)	~13.0s (download + extract)	13.66s
Pre-seeded content store	0s (CACHED)	0.36s

38x speedup on the build step. In production, this would reduce code-change deploys from ~48s to ~35s.

Trade-offs

• Builder image size increases by ~410MB (pre-extracted filesystem layers)
• Requires --privileged Docker access during build
• Pre-seeded images are pinned to specific base image versions — must rebuild when base images update

Test plan

• Benchmarked cold vs pre-seeded builds in Docker container
• Run make build-builder-preseeded end-to-end
• Deploy pre-seeded builder and verify first tenant build skips extraction
• Verify subsequent builds still use registry cache correctly

Related RFC: #86

🤖 Generated with Claude Code