mirror of
https://github.com/KeygraphHQ/shannon.git
synced 2026-02-12 17:22:50 +00:00
dcae34af81
Resolves Playwright browser installation failures in Docker by using Wolfi's system Chromium instead of downloading Playwright's bundled browsers at runtime. ## Problem When running in Docker, agents attempted to install browsers via `browser_install` tool, which failed due to: - Permission issues (non-root user couldn't install system dependencies) - npx @playwright/mcp spawns with its own Playwright dependency separate from global installations - Playwright's bundled browsers require runtime download (~280MB) and glibc deps - Environment variables alone (PLAYWRIGHT_BROWSERS_PATH) weren't sufficient ## Solution **Dockerfile changes:** - Use Wolfi's native `chromium` package (guaranteed compatible, already installed) - Remove Playwright browser installation step (saves ~280MB and build time) - Add explicit `SHANNON_DOCKER=true` environment variable for reliable detection - Set PLAYWRIGHT_CHROMIUM_EXECUTABLE_PATH to point to system Chromium **Code changes (claude-executor.js):** - Detect Docker via `process.env.SHANNON_DOCKER` (more reliable than /.dockerenv) - Conditionally add `--executable-path /usr/bin/chromium-browser` CLI arg for Docker - Local: Use Playwright's bundled browsers (downloaded to ~/Library/Caches/) - Docker: Use system Chromium with no runtime downloads ## Research Findings - @playwright/mcp has separate playwright-core dependency (v1.56.0-alpha) - MCP server spawned via npx doesn't inherit browser binaries from global install - --executable-path CLI argument is required (env vars insufficient) - /.dockerenv file is unreliable (missing in BuildKit, K8s, can be spoofed) ## Testing ✅ Docker: All 5 parallel agents successfully navigate, screenshot, create deliverables ✅ Local: All 5 parallel agents successfully navigate, screenshot, create deliverables ✅ No browser_install calls, no permission errors ✅ Image size reduced by ~280MB Fixes #docker-playwright-browser-issues 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
141 lines
3.6 KiB
Docker
141 lines
3.6 KiB
Docker
# Multi-stage Dockerfile for Pentest Agent
|
|
# Uses Chainguard Wolfi for minimal attack surface and supply chain security
|
|
|
|
# Builder stage - Install tools and dependencies
|
|
FROM cgr.dev/chainguard/wolfi-base:latest AS builder
|
|
|
|
# Install system dependencies available in Wolfi
|
|
RUN apk update && apk add --no-cache \
|
|
# Core build tools
|
|
build-base \
|
|
git \
|
|
curl \
|
|
wget \
|
|
ca-certificates \
|
|
# Network libraries for Go tools
|
|
libpcap-dev \
|
|
linux-headers \
|
|
# Language runtimes
|
|
go \
|
|
nodejs-22 \
|
|
npm \
|
|
python3 \
|
|
py3-pip \
|
|
ruby \
|
|
ruby-dev \
|
|
# Security tools available in Wolfi
|
|
nmap \
|
|
# Additional utilities
|
|
bash
|
|
|
|
# Set environment variables for Go
|
|
ENV GOPATH=/go
|
|
ENV PATH=$GOPATH/bin:/usr/local/go/bin:$PATH
|
|
ENV CGO_ENABLED=1
|
|
|
|
# Create directories
|
|
RUN mkdir -p $GOPATH/bin
|
|
|
|
# Install Go-based security tools
|
|
RUN go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest
|
|
# Install WhatWeb from GitHub (Ruby-based tool)
|
|
RUN git clone --depth 1 https://github.com/urbanadventurer/WhatWeb.git /opt/whatweb && \
|
|
chmod +x /opt/whatweb/whatweb && \
|
|
gem install addressable && \
|
|
echo '#!/bin/bash' > /usr/local/bin/whatweb && \
|
|
echo 'cd /opt/whatweb && exec ./whatweb "$@"' >> /usr/local/bin/whatweb && \
|
|
chmod +x /usr/local/bin/whatweb
|
|
|
|
# Install Python-based tools
|
|
RUN pip3 install --no-cache-dir schemathesis
|
|
|
|
# Runtime stage - Minimal production image
|
|
FROM cgr.dev/chainguard/wolfi-base:latest AS runtime
|
|
|
|
# Install only runtime dependencies
|
|
USER root
|
|
RUN apk update && apk add --no-cache \
|
|
# Core utilities
|
|
git \
|
|
bash \
|
|
curl \
|
|
ca-certificates \
|
|
# Network libraries (runtime)
|
|
libpcap \
|
|
# Security tools
|
|
nmap \
|
|
# Language runtimes (minimal)
|
|
nodejs-22 \
|
|
npm \
|
|
python3 \
|
|
ruby \
|
|
# Chromium browser and dependencies for Playwright
|
|
chromium \
|
|
# Additional libraries Chromium needs
|
|
nss \
|
|
freetype \
|
|
harfbuzz \
|
|
# X11 libraries for headless browser
|
|
libx11 \
|
|
libxcomposite \
|
|
libxdamage \
|
|
libxext \
|
|
libxfixes \
|
|
libxrandr \
|
|
mesa-gbm \
|
|
# Font rendering
|
|
fontconfig
|
|
|
|
# Copy Go binaries from builder
|
|
COPY --from=builder /go/bin/subfinder /usr/local/bin/
|
|
|
|
# Copy WhatWeb from builder
|
|
COPY --from=builder /opt/whatweb /opt/whatweb
|
|
COPY --from=builder /usr/local/bin/whatweb /usr/local/bin/whatweb
|
|
|
|
# Install WhatWeb Ruby dependencies in runtime stage
|
|
RUN gem install addressable
|
|
|
|
# Copy Python packages from builder
|
|
COPY --from=builder /usr/lib/python3.*/site-packages /usr/lib/python3.12/site-packages
|
|
COPY --from=builder /usr/bin/schemathesis /usr/bin/
|
|
|
|
# Create non-root user for security
|
|
RUN addgroup -g 1001 pentest && \
|
|
adduser -u 1001 -G pentest -s /bin/bash -D pentest
|
|
|
|
# Set working directory
|
|
WORKDIR /app
|
|
|
|
# Copy package.json and package-lock.json first for better caching
|
|
COPY package*.json ./
|
|
|
|
# Install Node.js dependencies as root
|
|
RUN npm ci --only=production && \
|
|
npm install -g zx && \
|
|
npm install -g @anthropic-ai/claude-agent-sdk && \
|
|
npm cache clean --force
|
|
|
|
# Copy application code
|
|
COPY . .
|
|
|
|
# Create directories for session data and ensure proper permissions
|
|
|
|
RUN mkdir -p /app/sessions /app/deliverables /app/repos && \
|
|
chown -R pentest:pentest /app /app/repos && \
|
|
chmod +x /app/shannon.mjs
|
|
|
|
|
|
# Switch to non-root user
|
|
USER pentest
|
|
|
|
# Set environment variables
|
|
ENV NODE_ENV=production
|
|
ENV PATH="/usr/local/bin:$PATH"
|
|
ENV SHANNON_DOCKER=true
|
|
ENV PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1
|
|
ENV PLAYWRIGHT_CHROMIUM_EXECUTABLE_PATH=/usr/bin/chromium-browser
|
|
|
|
|
|
# Set entrypoint
|
|
ENTRYPOINT ["./shannon.mjs"] |