# mig-xbrowser — xbrowser stealth Chromium on the LinuxServer Selkies base.
#
# Contract with the Go backend (browser-manager):
#   - The container's init is s6 (base image ENTRYPOINT). NEVER append browser
#     flags as docker CMD args — they would replace the init. Per-session flags
#     arrive via the XBROWSER_ARGS env var (space-separated); the labwc
#     autostart hook execs the browser with them after the Wayland session is up.
#   - Selkies listens on 3000 (HTTP). /api/status and /api/websockets are the
#     integration points.
#   - /config is the per-session volume (mounted by the backend): HOME, browser
#     profile, and state live here, so every session is isolated.
#   - License via /config/.xbrowser/license.key (+ .license_cache), seeded by
#     the backend into the session volume. The binary reads the file directly.
#   - Display is XWayland (DISPLAY=:0). The binary auto-detects X11;
#     do NOT pass --ozone-platform=x11 (it causes exit 77).
#
# Rebuild anywhere: docker build -t mig-xbrowser:latest .
# (build context must contain the xbrowser dir + root/)

FROM ghcr.io/linuxserver/baseimage-selkies:debiantrixie

# MS core fonts — required for --fingerprint-windows-font-metrics
# (xbrowser renders Windows font metrics; EULA pre-accepted for automation).
# Python3 + pip for the xbrowser launcher (Playwright-managed, see below).
RUN echo "ttf-mscorefonts-installer msttcorefonts/accepted-mscorefonts-eula select true" \
        | debconf-set-selections \
    && apt-get update \
    && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
        ttf-mscorefonts-installer \
        python3 \
        python3-pip \
        python3-venv \
    && rm -rf /var/lib/apt/lists/* \
    && fc-cache -f

# xbrowser stealth Chromium build (binary is named "chrome").
# Chrome runtime deps (libnss3, libatk, libgbm, libcups, ...) and Noto/CJK
# fonts are already in the base image.
COPY chromium-151.0.7922.108.4-pro /opt/xbrowser
RUN chmod -R a+rX /opt/xbrowser

# xbrowser Python wrapper + Playwright.
# The binary CANNOT be launched directly in Docker (exits immediately in
# background/detached mode). The Python wrapper's launch() uses Playwright
# to manage the browser process lifecycle correctly — this is the exact
# working path from the host. The backend triggers /opt/xbrowser-py/
# launch_browser.py via `docker exec` after Selkies is ready.
# NOTE: build context must contain the xbrowser/ Python package dir.
COPY xbrowser /opt/xbrowser-py/xbrowser
COPY root/opt/xbrowser-py/launch_browser.py /opt/xbrowser-py/launch_browser.py
RUN python3 -m pip install --break-system-packages --no-cache-dir \
        playwright \
    && chmod +x /opt/xbrowser-py/launch_browser.py \
    && chmod -R a+rX /opt/xbrowser-py

# labwc autostart hook: launches xbrowser as abc after the Wayland session is up.
# Per-session flags via XBROWSER_ARGS env, license via /config/.xbrowser/.
COPY root/ /
# COPY preserves the source dir modes; force sane perms on /etc so the abc
# user can traverse it (a 750/700 /etc breaks pulseaudio and other services).
# NOTE: COPY root/ overwrites /opt/xbrowser-py/launch_browser.py, so re-apply
# the executable bit here (it was set in the Python setup step above).
RUN chmod 755 /etc /etc/s6-overlay /etc/s6-overlay/s6-rc.d \
        /etc/s6-overlay/s6-rc.d/user/contents.d \
        /defaults \
    && chmod 755 /defaults/autostart_wayland \
    && chmod +x /opt/xbrowser-py/launch_browser.py \
    && chmod -R a+rX /opt/xbrowser-py

EXPOSE 3000
