37 lines
1.9 KiB
Docker
37 lines
1.9 KiB
Docker
# A slim Node base plus Chromium alone, not Microsoft's own image: that one ships Chromium,
|
|
# Firefox and WebKit together at 3.5 GB, when this server only ever launches Chromium
|
|
# (browser-service.js calls chromium.launch, never firefox or webkit). Built and verified this way
|
|
# comes to 1.84 GB - Chromium's own weight plus the OS libraries it needs, nothing else - and every
|
|
# security constraint below (seccomp, cap_drop, the read-only root, chromiumSandbox: true) was
|
|
# checked against this base before it replaced the old one, not assumed to still hold.
|
|
FROM node:24-bookworm-slim
|
|
|
|
ENV NODE_ENV=production
|
|
ENV PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1
|
|
# Outside /tmp on purpose: the container mounts /tmp as tmpfs (see mcp-stack.compose.yml), so a
|
|
# browser installed under HOME=/tmp/... at build time would be gone the instant the real container
|
|
# started - a mistake made once while building this image, and the reason it is called out here.
|
|
# /ms-playwright is where Microsoft's own image keeps browsers, for the identical reason.
|
|
ENV PLAYWRIGHT_BROWSERS_PATH=/ms-playwright
|
|
ENV HOME=/tmp/browser-home
|
|
|
|
WORKDIR /app
|
|
COPY package.json package-lock.json ./
|
|
RUN npm ci --omit=dev --ignore-scripts \
|
|
&& npm cache clean --force
|
|
|
|
# --with-deps installs the apt packages Chromium needs to run headless and sandboxed - fonts,
|
|
# libgtk, libnss and the rest - which is most of what this layer costs; the browser binaries
|
|
# themselves are a few hundred MB. chromium.launch({ headless: true }) reaches for the headless
|
|
# shell build Playwright ships alongside full Chromium, so both are needed, not just one.
|
|
RUN npx --yes playwright@1.63.0 install --with-deps chromium \
|
|
&& apt-get clean && rm -rf /var/lib/apt/lists/* \
|
|
&& chmod -R o+rX /ms-playwright
|
|
|
|
RUN groupadd -r pwuser && useradd -r -g pwuser -G audio,video pwuser \
|
|
&& mkdir -p /tmp/browser-home && chown -R pwuser:pwuser /app
|
|
COPY --chown=pwuser:pwuser src ./src
|
|
|
|
USER pwuser
|
|
CMD ["node", "src/index.js"]
|