fix remote browser improved remote support

Signed-off-by: RonniSkansing <rskansing@gmail.com>

docker/chrome/Dockerfile

@@ -0,0 +1,57 @@
+# development docker file
+# real Google Chrome running headful on a virtual X display, used by the
+# remote browser feature over the DevTools protocol
+FROM debian:bookworm-slim@sha256:7b140f374b289a7c2befc338f42ebe6441b7ea838a042bbd5acbfca6ec875818
+
+# chrome is pinned by version and checksum. to upgrade read the current values from
+# https://dl.google.com/linux/chrome/deb/dists/stable/main/binary-amd64/Packages
+ARG CHROME_VERSION=150.0.7871.186-1
+ARG CHROME_SHA256=4193e00b6d5d5969ee63f7a69596868f546aa0e8cb077b3e0bf9cc1e2c719d00
+
+# xvfb provides the display, openbox gives chrome a focused window, x11vnc plus
+# novnc make the display watchable from a browser, socat republishes the loopback
+# only devtools port on the container network
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    ca-certificates \
+    curl \
+    xvfb \
+    openbox \
+    x11vnc \
+    novnc \
+    websockify \
+    socat \
+    tini \
+    fonts-liberation \
+    fonts-noto-color-emoji \
+    && rm -rf /var/lib/apt/lists/*
+
+RUN curl -fsSL -o /tmp/chrome.deb \
+      "https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-stable/google-chrome-stable_${CHROME_VERSION}_amd64.deb" \
+    && echo "${CHROME_SHA256}  /tmp/chrome.deb" | sha256sum -c - \
+    && apt-get update \
+    && apt-get install -y --no-install-recommends /tmp/chrome.deb \
+    && rm -f /tmp/chrome.deb \
+    && rm -rf /var/lib/apt/lists/*
+
+# google ships a daily apt cron and a repo entry with the package. neither is
+# wanted here because the version is pinned above
+RUN rm -f /etc/cron.daily/google-chrome /etc/apt/sources.list.d/google-chrome.list
+
+RUN groupadd -g 1000 chrome && \
+    useradd -u 1000 -g chrome -m -d /home/chrome chrome
+
+# an empty named volume inherits the permissions of the image directory it is
+# mounted over, so the socket dir must be world writable before the volume exists
+RUN mkdir -p /tmp/.X11-unix && chmod 1777 /tmp/.X11-unix
+
+COPY start.sh /usr/local/bin/start.sh
+RUN chmod +x /usr/local/bin/start.sh
+
+USER chrome
+WORKDIR /home/chrome
+
+EXPOSE 8109 9222
+
+# -g forwards signals to the whole process group so xvfb, openbox and the vnc
+# stack stop with chrome instead of lingering
+ENTRYPOINT ["/usr/bin/tini", "-g", "--", "/usr/local/bin/start.sh"]

docker/chrome/start.sh

@@ -0,0 +1,71 @@
+#!/bin/sh
+# starts the virtual display, a window manager, the vnc viewer stack and chrome.
+# every background process is killed when this script exits so the container
+# stops cleanly instead of leaving a half dead display behind.
+set -eu
+
+DISPLAY_NUM="${DISPLAY_NUM:-99}"
+SCREEN="${SCREEN:-1920x1080x24}"
+DEVTOOLS_PORT="${DEVTOOLS_PORT:-9222}"
+NOVNC_PORT="${NOVNC_PORT:-8109}"
+
+# chrome binds devtools to loopback only, so it listens on a private port and
+# socat republishes it on the container network below
+CHROME_DEVTOOLS_PORT=9223
+VNC_PORT=5900
+
+WIDTH="${SCREEN%%x*}"
+HEIGHT_DEPTH="${SCREEN#*x}"
+HEIGHT="${HEIGHT_DEPTH%%x*}"
+
+export DISPLAY=":${DISPLAY_NUM}"
+
+cleanup() {
+    trap - EXIT INT TERM
+    kill 0 2>/dev/null || true
+}
+trap cleanup EXIT INT TERM
+
+# the X socket is created inside a shared volume so other containers can render
+# on this display too. access control is off because the socket is only reachable
+# through that volume, never over the network
+Xvfb "$DISPLAY" -screen 0 "$SCREEN" -ac -noreset \
+    +extension RANDR +extension GLX +render &
+
+for _ in $(seq 1 100); do
+    [ -S "/tmp/.X11-unix/X${DISPLAY_NUM}" ] && break
+    sleep 0.1
+done
+if [ ! -S "/tmp/.X11-unix/X${DISPLAY_NUM}" ]; then
+    echo "xvfb failed to create a display socket" >&2
+    exit 1
+fi
+
+# without a window manager the chrome window never takes X focus, which leaves
+# document.hasFocus() false for every page and is a strong bot signal
+openbox &
+
+x11vnc -display "$DISPLAY" -rfbport "$VNC_PORT" -localhost -forever -shared -nopw -quiet &
+websockify --web=/usr/share/novnc "$NOVNC_PORT" "127.0.0.1:${VNC_PORT}" &
+
+# devtools refuses requests whose Host header is neither localhost nor an IP,
+# so connect to this container by IP rather than by service name
+socat "TCP-LISTEN:${DEVTOOLS_PORT},fork,reuseaddr" "TCP:127.0.0.1:${CHROME_DEVTOOLS_PORT}" &
+
+# launching chrome by hand rather than through an automation library keeps the
+# enable-automation switch off, so navigator.webdriver stays false
+exec google-chrome-stable \
+    --remote-debugging-address=127.0.0.1 \
+    --remote-debugging-port="${CHROME_DEVTOOLS_PORT}" \
+    --user-data-dir=/home/chrome/profile \
+    --window-position=0,0 \
+    --window-size="${WIDTH},${HEIGHT}" \
+    --no-first-run \
+    --no-default-browser-check \
+    --disable-blink-features=AutomationControlled \
+    --password-store=basic \
+    --use-mock-keychain \
+    ${CHROME_LANG:+--lang=${CHROME_LANG}} \
+    ${CHROME_PROXY:+--proxy-server=${CHROME_PROXY}} \
+    ${CHROME_EXTRA_FLAGS:-} \
+    about:blank