Preinstall Chromium runtime libraries in the agent image - #8022
Conversation
There was a problem hiding this comment.
🟡 Changes recommended
Image-installed libraries are hidden by the runtime chroot, and no integration test exercises the claimed behavior.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
Adds Chromium runtime dependencies to agent images for Playwright compatibility.
Changes:
- Adds Ubuntu 22.04/24.04 package resolution.
- Adds Dockerfile-focused dependency tests.
- Documents browser dependencies and troubleshooting.
File summaries
| File | Description |
|---|---|
containers/agent/Dockerfile |
Installs Chromium runtime libraries. |
scripts/ci/agent-dockerfile-browser-deps.test.ts |
Tests package declaration and resolution. |
docs/agent-images.md |
Documents preinstalled libraries. |
docs-site/src/content/docs/reference/agent-images.md |
Mirrors agent-image documentation. |
docs/troubleshooting.md |
Adds Playwright troubleshooting guidance. |
Review details
- Files reviewed: 5/5 changed files
- Comments generated: 2
- Review effort level: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| # Chromium/Playwright native runtime libraries. The agent uses selective bind | ||
| # mounts (not a full host filesystem mount), so Playwright-managed browsers | ||
| # cannot pick these up from the host and must be present in the image. | ||
| BROWSER_PKGS="libasound2 libatk-bridge2.0-0 libatk1.0-0 libatspi2.0-0 libcairo2 libcups2 libdbus-1-3 libdrm2 libexpat1 libgbm1 libglib2.0-0 libnspr4 libnss3 libpango-1.0-0 libpangocairo-1.0-0 libx11-6 libxcb1 libxcomposite1 libxdamage1 libxext6 libxfixes3 libxkbcommon0 libxrandr2 libxrender1 libxshmfence1 fonts-liberation"; \ |
| it('installs the resolved browser packages with the other agent packages', () => { | ||
| expect(readDockerfile()).toMatch(/apt_install_retry \$PKGS/); |
|
@copilot address review feedback |
Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>
|
@copilot address review feedback |
Addressed both review threads in fa3ee21:
|
|
✅ Copilot review passed with no inline comments. @copilot Add the |
|
📰 VERDICT: Smoke Docker Sbx has concluded. All systems operational. This is a developing story. 🎤
|
|
✅ Security Guard completed successfully! Security review of PR #8022 complete — no security issues found. The PR adds Chromium/Playwright runtime library support via manifest-driven staging in the agent container. Changes maintain isolation model (uses container's writable /run/awf-lib, not bind-mounted), respect capability restrictions (no SYS_ADMIN/NET_RAW added), avoid firewall changes, use safe file operations with error handling, and properly update cleanup logic. No security regression detected.
|
|
✅ Smoke Copilot BYOK AOAI (api-key) completed. Copilot AOAI BYOK (api-key) mode operational. 🔓
|
|
🌑 The shadows whisper... Smoke Codex failed. The oracle requires further meditation...
|
|
Chroot tests passed! Smoke Chroot - All security and functionality tests succeeded.
|
|
✅ Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓
|
|
🔌 Smoke Services — All services reachable! ✅
|
|
📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤
|
|
❌ Smoke Gemini reports failed. Facets need polishing...
|
|
✅ Build Test Suite completed successfully!
|
|
❌ Contribution Check failed. Please review the logs for details.
|
|
✅ Smoke Claude passed Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "api.anthropic.com"See Network Configuration for more information.
|
|
Smoke Test: Copilot BYOK (Direct Mode) ✅ PASS
All systems operational. Agent responding normally with COPILOT_PROVIDER_API_KEY forwarded to sidecar.
|
|
EGRESS_RESULT allow=pass deny=pass ✅ Allowed domain (github.com) reachable — Overall status: PASS cc Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "example.com"See Network Configuration for more information.
|
github-actions
Bot
added
the
smoke-copilot-network-isolation
|
Smoke Test: Copilot Engine
Overall: PASS
|
|
Smoke Test: Docker Sbx Validation —
Overall: PASS
|
Smoke Test: GitHub Actions Services Connectivity
Overall: FAIL —
|
Chroot Version Comparison Results
Overall: FAILED — Node.js version mismatch between host and chroot environment.
|
Smoke Test: API Proxy OpenTelemetry Tracing — Results
Overall: ✅ All scenarios pass. OTEL tracing integration (module init, span creation, GenAI usage attributes, parent context propagation, env forwarding, graceful degradation) is implemented and covered by passing tests.
|
|
|
Smoke Test: Claude Engine Validation
Overall result: PASS Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "api.anthropic.com"See Network Configuration for more information.
|
|
test: validate shared-gateway enclave smoke
|
🏗️ Build Test Suite Results
Overall: 8/8 ecosystems passed — PASS Note: For Java, Maven's No errors encountered across any ecosystem.
|
Playwright-managed browsers fail to launch inside the sandbox (
libnspr4.so: cannot open shared object file) because the agent image ships a minimal Ubuntu base and uses selective bind mounts, so Chromium's native dependencies are neither in the image nor reachable from the host.Changes
containers/agent/Dockerfile: adds aBROWSER_PKGSlist (Chromium/Playwright shared libs +fonts-liberation) to the existing single apt layer. Transitive deps (fontconfig, freetype, harfbuzz, …) come in automatically.ubuntu:22.04(default preset) andcatthehacker/ubuntu:act-24.04(act preset). On 24.04 several of these names became ambiguous virtual packages (apt-get install libasound2→ has no installation candidate), so each package resolves to itst64variant when the base image provides one:scripts/ci/agent-dockerfile-browser-deps.test.ts(new): asserts the required libs are declared under their base names, and executes the extracted resolution loop against a stubbedapt-cacheto cover both the 22.04 passthrough and the 24.04t64preference. Follows the extract-and-run-the-shell-block pattern ofagent-dockerfile-security.test.ts.docs/agent-images.md+ docs-site mirror list the preinstalled libraries;docs/troubleshooting.mdgains a Playwright / Chromium Issues section (symptom, in-sandboxlddverification,npx playwright install-deps chromiumfor custom base images,cdn.playwright.devallowlist note).Notes for reviewers
scripts/ci/stage-playwright-loopback-smoke.sh.smoke-playwright-*workflows still stage their own sysroot; they are unchanged here and could be simplified in a follow-up once the new image ships.