Fix Pyroscope build: add frontend via mkYarnPackage, use go/bin target

The upstream Makefile's `build` target runs frontend via Docker, which
isn't available in the Nix sandbox. Instead, build the frontend
(yarn + webpack) separately via mkYarnPackage, copy assets to
public/build/, then invoke `make go/bin` with EMBEDASSETS=embedassets
to compile the Go binary with embedded frontend.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

containers/pyroscope/default.nix

@@ -14,6 +14,29 @@ let
     hash = "sha256-UPxGimkzXLFACqmAM1hNQIoNjN6OquVibwVmNvP00+s=";
   };
 
+  # Build frontend assets via yarn + webpack (upstream uses Docker for this)
+  ui = pkgs.mkYarnPackage {
+    inherit version src;
+    pname = "pyroscope-ui";
+
+    buildPhase = ''
+      runHook preBuild
+      export HOME=$TMPDIR
+      cd deps/grafana-pyroscope
+      yarn --offline build
+      runHook postBuild
+    '';
+
+    installPhase = ''
+      runHook preInstall
+      mkdir -p $out
+      cp -r deps/grafana-pyroscope/public/build/* $out/
+      runHook postInstall
+    '';
+
+    distPhase = "true";
+  };
+
   # Pre-fetch Go modules for all go.mod files in the workspace (fixed-output derivation)
   goModules = pkgs.stdenv.mkDerivation {
     pname = "pyroscope-go-modules";
@@ -66,11 +89,18 @@ let
       cp -r ${goModules} $GOPATH/pkg/mod
       chmod -R u+w $GOPATH/pkg/mod
 
-      # Build using upstream Makefile
+      # Copy pre-built frontend assets
+      mkdir -p public/build
+      cp -r ${ui}/* public/build/
+
+      # Build Go binary with embedded frontend assets
+      # Skip the Makefile's frontend/build target (uses Docker) and
+      # invoke go/bin directly with EMBEDASSETS set
       # CGO_ENABLED=0 for static binary (matches upstream)
       CGO_ENABLED=0 \
+        EMBEDASSETS=embedassets \
         IMAGE_TAG=v${version} \
-        make build
+        make go/bin
 
       runHook postBuild
     '';
@@ -78,7 +108,7 @@ let
     installPhase = ''
       runHook preInstall
       mkdir -p $out/bin
-      cp pyroscope $out/bin/pyroscope
+      cp cmd/pyroscope/pyroscope $out/bin/pyroscope
       runHook postInstall
     '';