software-mansion · mat-hek · Aug 12, 2026 · Aug 18, 2026 · Aug 18, 2026 · Aug 18, 2026
diff --git a/.dockerignore b/.dockerignore
@@ -1,2 +1,5 @@
-# Exclude everything, Dockerfile clones the repo anyway
+# Exclude everything, Dockerfile clones the repo anyway.
+# scripts/ is whitelisted so base.Dockerfile can build AtomVM
+# before (independently of) the repo clone.
 **
+!scripts/**
diff --git a/.github/workflows/demo_prod_build_and_deploy.yml b/.github/workflows/demo_prod_build_and_deploy.yml
@@ -9,7 +9,7 @@ env:
 jobs:
   build_docker_images:
     runs-on: ubuntu-latest
-    timeout-minutes: 30
+    timeout-minutes: 60
     permissions:
       contents: read
       packages: write
@@ -40,6 +40,12 @@ jobs:
             ${{ env.REGISTRY }}/${{ env.ORG_NAME }}/popcorn-langtour
             ${{ env.REGISTRY }}/${{ env.ORG_NAME }}/popcorn-burrito
 
+      # Busts the base image's AtomVM layer cache exactly when FissionVM moves,
+      # so AtomVM isn't rebuilt on every popcorn commit.
+      - name: Get FissionVM commit
+        id: fvm
+        run: echo "sha=$(git ls-remote https://github.com/software-mansion-labs/FissionVM.git swm | cut -f1)" >> $GITHUB_OUTPUT
+
       - name: Build base Docker image
         id: build-base
         uses: docker/build-push-action@v6
@@ -48,36 +54,40 @@ jobs:
           file: ./docker/base.Dockerfile
           build-args: |
             COMMIT_REF=${{ github.sha }}
+            FISSIONVM_SHA=${{ steps.fvm.outputs.sha }}
           push: true
           github-token: ${{ secrets.GITHUB_TOKEN }}
           tags: "${{ env.REGISTRY }}/${{ env.ORG_NAME }}/popcorn-base:latest"
           labels: ${{ steps.meta.outputs.labels }}
           cache-from: type=gha
           cache-to: type=gha,mode=max
 
-      - name: Build landing Docker image
-        id: build-and-push-landing
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          file: ./docker/landing.Dockerfile
-          build-args: |
-            POPCORN_BASE_TAG=latest
-            SYNC_THIRD_PARTY_ASSETS=true
-          pull: true
-          push: true
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          tags: "${{ env.REGISTRY }}/${{ env.ORG_NAME }}/popcorn-landing:latest"
-          labels: ${{ steps.meta.outputs.labels }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+      # - name: Build landing Docker image
+      #   id: build-and-push-landing
+      #   uses: docker/build-push-action@v6
+      #   with:
+      #     context: .
+      #     file: ./docker/landing.Dockerfile
+      #     build-args: |
+      #       POPCORN_BASE_TAG=latest
+      #       SYNC_THIRD_PARTY_ASSETS=true
+      #     pull: true
+      #     push: true
+      #     github-token: ${{ secrets.GITHUB_TOKEN }}
+      #     tags: "${{ env.REGISTRY }}/${{ env.ORG_NAME }}/popcorn-landing:latest"
+      #     labels: ${{ steps.meta.outputs.labels }}
+      #     cache-from: type=gha
+      #     cache-to: type=gha,mode=max
 
-      - name: Build burrito Docker image
-        id: build-and-push-burrito
+      # The demos image (kanban + burrito + pong + nginx + Postgres) is pushed
+      # under the burrito name so the existing server-side popcorn-burrito.yml
+      # deploys it unchanged.
+      - name: Build demos Docker image (deployed as burrito)
+        id: build-and-push-demos
         uses: docker/build-push-action@v6
         with:
           context: .
-          file: ./docker/burrito/Dockerfile
+          file: ./docker/demos/Dockerfile
           build-args: |
             POPCORN_BASE_TAG=latest
           pull: true
@@ -88,26 +98,26 @@ jobs:
           cache-from: type=gha
           cache-to: type=gha,mode=max
 
-      - name: Build language tour Docker image
-        id: build-and-push-langtour
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          file: ./docker/langtour.Dockerfile
-          # Sentry DSN is embedded in built JS, not really a secret
-          build-args: |
-            POPCORN_BASE_TAG=latest
-            SYNC_THIRD_PARTY_ASSETS=true
-            SENTRY_DSN=${{ secrets.SENTRY_CLIENT_DSN }}
-            SENTRY_MODE=production
-            APP_VERSION=${{ github.sha }}
-          pull: true
-          push: true
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          tags: "${{ env.REGISTRY }}/${{ env.ORG_NAME }}/popcorn-langtour:latest"
-          labels: ${{ steps.meta.outputs.labels }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+      # - name: Build language tour Docker image
+      #   id: build-and-push-langtour
+      #   uses: docker/build-push-action@v6
+      #   with:
+      #     context: .
+      #     file: ./docker/langtour.Dockerfile
+      #     # Sentry DSN is embedded in built JS, not really a secret
+      #     build-args: |
+      #       POPCORN_BASE_TAG=latest
+      #       SYNC_THIRD_PARTY_ASSETS=true
+      #       SENTRY_DSN=${{ secrets.SENTRY_CLIENT_DSN }}
+      #       SENTRY_MODE=production
+      #       APP_VERSION=${{ github.sha }}
+      #     pull: true
+      #     push: true
+      #     github-token: ${{ secrets.GITHUB_TOKEN }}
+      #     tags: "${{ env.REGISTRY }}/${{ env.ORG_NAME }}/popcorn-langtour:latest"
+      #     labels: ${{ steps.meta.outputs.labels }}
+      #     cache-from: type=gha
+      #     cache-to: type=gha,mode=max
 
   deploy_production:
     runs-on: ubuntu-latest

diff --git a/.github/workflows/demo_staging_build_and_deploy.yml b/.github/workflows/demo_staging_build_and_deploy.yml
@@ -18,8 +18,10 @@ on:
       - "docker/base.Dockerfile"
       - "docker/landing.Dockerfile"
       - "docker/langtour.Dockerfile"
-      - "docker/burrito/Dockerfile"
+      - "docker/demos/**"
+      - "examples/local-lv-kanban/**"
       - "examples/local-lv-burrito/**"
+      - "examples/local-lv-pong/**"
       - ".github/workflows/demo_staging_build_and_deploy.yml"
       - "pnpm-workspace.yaml"
       - "pnpm-lock.yaml"
@@ -33,7 +35,7 @@ env:
 jobs:
   build_docker_images:
     runs-on: ubuntu-latest
-    timeout-minutes: 30
+    timeout-minutes: 60
     permissions:
       contents: read
       packages: write
@@ -65,6 +67,12 @@ jobs:
             ${{ env.REGISTRY }}/${{ env.ORG_NAME }}/popcorn-langtour
             ${{ env.REGISTRY }}/${{ env.ORG_NAME }}/popcorn-burrito
 
+      # Busts the base image's AtomVM layer cache exactly when FissionVM moves,
+      # so AtomVM isn't rebuilt on every popcorn commit.
+      - name: Get FissionVM commit
+        id: fvm
+        run: echo "sha=$(git ls-remote https://github.com/software-mansion-labs/FissionVM.git swm | cut -f1)" >> $GITHUB_OUTPUT
+
       - name: Build base Docker image
         id: build-base
         uses: docker/build-push-action@v6
@@ -73,36 +81,40 @@ jobs:
           file: ./docker/base.Dockerfile
           build-args: |
             COMMIT_REF=${{ github.sha }}
+            FISSIONVM_SHA=${{ steps.fvm.outputs.sha }}
           push: true
           github-token: ${{ secrets.GITHUB_TOKEN }}
           tags: "${{ env.REGISTRY }}/${{ env.ORG_NAME }}/popcorn-base:staging"
           labels: ${{ steps.meta.outputs.labels }}
           cache-from: type=gha
           cache-to: type=gha,mode=max
 
-      - name: Build landing Docker image
-        id: build-and-push-landing
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          file: ./docker/landing.Dockerfile
-          build-args: |
-            POPCORN_BASE_TAG=staging
-            SYNC_THIRD_PARTY_ASSETS=true
-          pull: true
-          push: true
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          tags: "${{ env.REGISTRY }}/${{ env.ORG_NAME }}/popcorn-landing:staging"
-          labels: ${{ steps.meta.outputs.labels }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+      # - name: Build landing Docker image
+      #   id: build-and-push-landing
+      #   uses: docker/build-push-action@v6
+      #   with:
+      #     context: .
+      #     file: ./docker/landing.Dockerfile
+      #     build-args: |
+      #       POPCORN_BASE_TAG=staging
+      #       SYNC_THIRD_PARTY_ASSETS=true
+      #     pull: true
+      #     push: true
+      #     github-token: ${{ secrets.GITHUB_TOKEN }}
+      #     tags: "${{ env.REGISTRY }}/${{ env.ORG_NAME }}/popcorn-landing:staging"
+      #     labels: ${{ steps.meta.outputs.labels }}
+      #     cache-from: type=gha
+      #     cache-to: type=gha,mode=max
 
-      - name: Build burrito Docker image
-        id: build-and-push-burrito
+      # The demos image (kanban + burrito + nginx + Postgres) is pushed under
+      # the burrito name so the existing server-side popcorn-burrito.yml
+      # deploys it unchanged.
+      - name: Build demos Docker image (deployed as burrito)
+        id: build-and-push-demos
         uses: docker/build-push-action@v6
         with:
           context: .
-          file: ./docker/burrito/Dockerfile
+          file: ./docker/demos/Dockerfile
           build-args: |
             POPCORN_BASE_TAG=staging
           pull: true
@@ -113,26 +125,26 @@ jobs:
           cache-from: type=gha
           cache-to: type=gha,mode=max
 
-      - name: Build language tour Docker image
-        id: build-and-push-langtour
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          file: ./docker/langtour.Dockerfile
-          # Sentry DSN is embedded in built JS, not really a secret
-          build-args: |
-            POPCORN_BASE_TAG=staging
-            SYNC_THIRD_PARTY_ASSETS=true
-            SENTRY_DSN=${{ secrets.SENTRY_CLIENT_DSN }}
-            SENTRY_MODE=staging
-            APP_VERSION=${{ github.sha }}
-          pull: true
-          push: true
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          tags: "${{ env.REGISTRY }}/${{ env.ORG_NAME }}/popcorn-langtour:staging"
-          labels: ${{ steps.meta.outputs.labels }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+      # - name: Build language tour Docker image
+      #   id: build-and-push-langtour
+      #   uses: docker/build-push-action@v6
+      #   with:
+      #     context: .
+      #     file: ./docker/langtour.Dockerfile
+      #     # Sentry DSN is embedded in built JS, not really a secret
+      #     build-args: |
+      #       POPCORN_BASE_TAG=staging
+      #       SYNC_THIRD_PARTY_ASSETS=true
+      #       SENTRY_DSN=${{ secrets.SENTRY_CLIENT_DSN }}
+      #       SENTRY_MODE=staging
+      #       APP_VERSION=${{ github.sha }}
+      #     pull: true
+      #     push: true
+      #     github-token: ${{ secrets.GITHUB_TOKEN }}
+      #     tags: "${{ env.REGISTRY }}/${{ env.ORG_NAME }}/popcorn-langtour:staging"
+      #     labels: ${{ steps.meta.outputs.labels }}
+      #     cache-from: type=gha
+      #     cache-to: type=gha,mode=max
 
   deploy_staging:
     runs-on: ubuntu-latest

diff --git a/docker/base.Dockerfile b/docker/base.Dockerfile
@@ -17,7 +17,7 @@ ARG COMMIT_REF
 WORKDIR /build/
 RUN mkdir -p popcorn out
 RUN apt-get -y update && \
-    apt-get -y install git curl cmake gperf libmbedtls-dev zlib1g-dev \
+    apt-get -y install git curl cmake ninja-build gperf libmbedtls-dev zlib1g-dev \
     automake make gcc g++ libssl-dev libncurses-dev \
     default-jre-headless python3 xz-utils gpg wget
 
@@ -47,6 +47,15 @@ RUN mise install erlang@26.0.2 elixir@1.17.3-otp-26 && \
     mise exec erlang@26.0.2 elixir@1.17.3-otp-26 -- mix local.hex --force
 RUN mise use --global emsdk@"${EMSDK_VERSION}" && mise install
 
+# Build the release AtomVM WASM runtime once, before the repo clone, so the
+# layer survives popcorn commits. FISSIONVM_SHA is only a cache key: the deploy
+# workflows pass the current FissionVM swm commit so this layer is rebuilt
+# exactly when FissionVM moves.
+COPY scripts/ /build/popcorn-scripts/
+ARG FISSIONVM_SHA=untracked
+RUN echo "FissionVM swm @ ${FISSIONVM_SHA}" && \
+    /build/popcorn-scripts/build-atomvm.sh --outdir /build/atomvm-release-wasm release-wasm
+
 RUN git clone https://github.com/software-mansion/popcorn.git /build/popcorn && \
     mise trust /build/popcorn
 RUN cd /build/popcorn && git fetch && git checkout "${COMMIT_REF}"
@@ -62,3 +71,11 @@ RUN mise exec erlang@"${ERLANG_VERSION}" elixir@"${ELIXIR_VERSION}" -- \
     scripts/build-beam.sh release
 RUN mise exec erlang@"${ERLANG_VERSION}" elixir@"${ELIXIR_VERSION}" -- \
     pnpm -F ./popcorn/js build
+
+# Build the popcorn-2 JS package against the release AtomVM runtime built
+# above. Images that build the demos (docker/demos) link local-live-view to
+# this package, so AtomVM is compiled once here instead of once per demo app.
+RUN pnpm --dir popcorn-2 install --frozen-lockfile --child-concurrency=1 --network-concurrency=1
+RUN mkdir -p popcorn-2/js/assets && \
+    cp /build/atomvm-release-wasm/AtomVM.mjs /build/atomvm-release-wasm/AtomVM.wasm popcorn-2/js/assets/ && \
+    pnpm --dir popcorn-2/js exec rollup -c
diff --git a/docker/burrito/Dockerfile b/docker/burrito/Dockerfile
diff --git a/docker/burrito/Dockerfile.dockerignore b/docker/burrito/Dockerfile.dockerignore