From 72f0a143643022ed4e35cc0ec601b6b12613925c Mon Sep 17 00:00:00 2001 From: iFlip721 Date: Wed, 12 Aug 2026 22:34:40 -0400 Subject: [PATCH] add a downgrade mongo version for non-avx systems --- .github/workflows/docker-publish-mongo44.yml | 234 ++++++++++++++++++ README.md | 11 +- docker/aio-entrypoint.sh | 2 +- docker/aio.Dockerfile | 78 ++++-- docker/app.Dockerfile | 10 +- .../src/sources/adapters/dulo/loginBrowser.ts | 3 +- 6 files changed, 309 insertions(+), 29 deletions(-) create mode 100644 .github/workflows/docker-publish-mongo44.yml diff --git a/.github/workflows/docker-publish-mongo44.yml b/.github/workflows/docker-publish-mongo44.yml new file mode 100644 index 0000000..e6d22c0 --- /dev/null +++ b/.github/workflows/docker-publish-mongo44.yml @@ -0,0 +1,234 @@ +# ----------------------------------------------------------------------------- +# .github/workflows/docker-publish-mongo44.yml — the legacy-CPU all-in-one variant. +# +# Builds the SAME image as the `aio` leg of docker-publish.yml, but with mongod 4.4 on a Debian +# bullseye runtime, so it starts on x86-64 CPUs WITHOUT AVX — Synology NAS boxes, Atom/Celeron +# (J4125, N5105, J3455…), pre-2011 Xeons, and VMs whose hypervisor exposes a kvm64/qemu64 CPU model. +# MongoDB 5.0+ hard-requires AVX; on those hosts the standard image dies instantly with +# "Illegal instruction (core dumped)" the moment aio-entrypoint.sh execs mongod. +# +# All four base images are overridden together (see the matrix comment in docker/aio.Dockerfile): +# mongod 4.4 is a focal build needing OpenSSL 1.1 -> bullseye runtime -> bullseye Rust builder, or +# masq-proxy would fail to load with `GLIBC_2.34 not found`. +# +# Same Docker Hub repo as the standard aio image; tags carry a `mongo4.4-` prefix: +# 0.1.16-latest -> :mongo4.4-0.1.16 + :mongo4.4-latest +# 0.1.16-dev -> :mongo4.4-0.1.16-dev + :mongo4.4-dev +# 0.1.16 -> :mongo4.4-0.1.16 +# +# SILENT by design: no GitHub Release, no git tag, no repo-visible artifact of any kind. The +# file-wide `permissions: contents: read` is the ceiling and NO job elevates it, so this workflow +# structurally cannot write to the repo. The run summary is the record of what shipped. +# +# NOTE: a /data volume written by mongod 7.0 CANNOT be opened by 4.4 (no FCV downgrade path) — this +# image needs a fresh volume, or a restore through the app's own JSON backup. +# ----------------------------------------------------------------------------- +name: Build and Publish Mongo 4.4 + +on: + workflow_dispatch: + inputs: + version: + description: "Version to publish (e.g. 0.1.16, 0.1.16-dev, 0.1.16-latest) — tags get a mongo4.4- prefix" + required: true + type: string + +permissions: + contents: read # never elevated — this workflow publishes nothing to GitHub + +concurrency: + group: docker-publish-mongo44-${{ inputs.version }} + cancel-in-progress: false # never kill an in-flight push + +env: + TAG_PREFIX: mongo4.4- + REPO: masqueradarr-aio + # The no-AVX base matrix. These four move together — see docker/aio.Dockerfile. + # Renovate parses Dockerfile `ARG x=image` + `FROM $x`, but NOT workflow build-args, so it will never + # bump the four pins below — they are hand-maintained. The Dockerfile's mongo-7/bookworm defaults stay + # Renovate-managed as before. + MONGO_IMAGE: mongo:4.4.30-focal + NODE_IMAGE: node:22.11.0-bullseye-slim + RUNTIME_IMAGE: node:22-bullseye-slim + RUST_IMAGE: rust:1-bullseye + +jobs: + prepare: + runs-on: ubuntu-latest + outputs: + version: ${{ steps.derive.outputs.version }} + primary: ${{ steps.derive.outputs.primary }} + rolling: ${{ steps.derive.outputs.rolling }} + steps: + - name: Validate input & derive prefixed tags + id: derive + run: | + version="${{ inputs.version }}" + if [ -z "$version" ]; then + echo "::error::version input is empty"; exit 1 + fi + case "$version" in + *[[:space:]]*) echo "::error::version must not contain whitespace: '$version'"; exit 1 ;; + esac + case "$version" in + # the prefix is added below — pre-prefixing would yield mongo4.4-mongo4.4-0.1.16 + mongo4.4-*) echo "::error::pass the bare version; this workflow adds the 'mongo4.4-' prefix itself"; exit 1 ;; + esac + + lc="$(printf '%s' "$version" | tr '[:upper:]' '[:lower:]')" + + # rolling tag (dev before latest), case-insensitive — MIRRORS docker-publish.yml + case "$lc" in + *dev*) rolling=dev ;; + *latest*) rolling=latest ;; + *) rolling= ;; + esac + # dedupe: caller literally passed `dev`/`latest` as the whole version + if [ "$rolling" = "$version" ]; then rolling=; fi + + # strip a trailing -latest (0.1.16-latest -> 0.1.16); keep -dev / plain versions as-is + clean="$(printf '%s' "$version" | sed -E 's/-(latest|dev)$//I')" + case "$rolling" in + latest) base="$clean" ;; + *) base="$version" ;; + esac + + # the ONLY divergence from docker-publish.yml's derivation: both tags carry the prefix. + # There is deliberately no is_release/release_title here — this workflow never releases. + primary="${TAG_PREFIX}${base}" + [ -n "$rolling" ] && rolling="${TAG_PREFIX}${rolling}" + + { + echo "version=$version" + echo "primary=$primary" + echo "rolling=$rolling" + } >> "$GITHUB_OUTPUT" + echo "Resolved: version='$version' primary='$primary' rolling='${rolling:-}'" + + build: + needs: prepare + runs-on: ${{ matrix.runner }} + strategy: + fail-fast: false + matrix: + # aio only — the app-stack image has no bundled mongod, so there is nothing to downgrade. + # Native runners per arch (no QEMU), same as docker-publish.yml. + include: + - { arch: amd64, runner: ubuntu-latest } + - { arch: arm64, runner: ubuntu-24.04-arm } + steps: + - uses: actions/checkout@v4 + + - name: Set up Buildx + uses: docker/setup-buildx-action@v3 + + - name: Log in to Docker Hub + uses: docker/login-action@v3 + with: + username: ${{ secrets.DOCKERHUB_USERNAME }} + password: ${{ secrets.DOCKERHUB_TOKEN }} + + - name: Build and push by digest + id: build + uses: docker/build-push-action@v6 + with: + context: . + file: docker/aio.Dockerfile + platforms: linux/${{ matrix.arch }} + build-args: | + APP_VERSION=${{ needs.prepare.outputs.version }} + MONGO_IMAGE=${{ env.MONGO_IMAGE }} + NODE_IMAGE=${{ env.NODE_IMAGE }} + RUNTIME_IMAGE=${{ env.RUNTIME_IMAGE }} + RUST_IMAGE=${{ env.RUST_IMAGE }} + provenance: false + # distinct gha scope so this variant never shares layers with the mongo-7 aio build + cache-from: type=gha,scope=aio-mongo44-${{ matrix.arch }} + cache-to: type=gha,mode=max,scope=aio-mongo44-${{ matrix.arch }} + outputs: type=image,name=${{ secrets.DOCKERHUB_USERNAME }}/masqueradarr-aio,push-by-digest=true,name-canonical=true,push=true + + # Emit an empty file NAMED for the pushed digest; the merge job globs these into the manifest list. + - name: Export digest + run: | + mkdir -p /tmp/digests + digest="${{ steps.build.outputs.digest }}" + touch "/tmp/digests/${digest#sha256:}" + + - name: Upload digest + uses: actions/upload-artifact@v4 + with: + name: digests-aio-mongo44-${{ matrix.arch }} + path: /tmp/digests/* + if-no-files-found: error + retention-days: 1 + + merge: + needs: [prepare, build] + runs-on: ubuntu-latest + steps: + - name: Download digests + uses: actions/download-artifact@v4 + with: + path: /tmp/digests + pattern: digests-aio-mongo44-* + merge-multiple: true + + - name: Set up Buildx + uses: docker/setup-buildx-action@v3 + + - name: Log in to Docker Hub + uses: docker/login-action@v3 + with: + username: ${{ secrets.DOCKERHUB_USERNAME }} + password: ${{ secrets.DOCKERHUB_TOKEN }} + + - name: Compose tag args + id: tags + run: | + ns="${{ secrets.DOCKERHUB_USERNAME }}" + primary="${{ needs.prepare.outputs.primary }}" + rolling="${{ needs.prepare.outputs.rolling }}" + args="-t $ns/$REPO:$primary" + [ -n "$rolling" ] && args="$args -t $ns/$REPO:$rolling" + echo "args=$args" >> "$GITHUB_OUTPUT" + + - name: Create & push manifest list + working-directory: /tmp/digests + run: | + # word-splitting is intentional: tag args + one source ref per per-arch digest file. + # shellcheck disable=SC2046,SC2086 + ns="${{ secrets.DOCKERHUB_USERNAME }}" + docker buildx imagetools create ${{ steps.tags.outputs.args }} \ + $(printf "$ns/$REPO@sha256:%s " *) + + # There is no Release to read, so the run summary IS the record of what shipped. + # DOCKERHUB_USERNAME is deliberately NOT printed: Actions masks secret values in job summaries, so + # interpolating it would render every line as `***/masqueradarr-aio:…` and break copy-paste. The + # namespace is whatever DOCKERHUB_USERNAME is set to — the same one the standard aio image uses. + - name: Report published tags + run: | + ns="${{ secrets.DOCKERHUB_USERNAME }}" + primary="${{ needs.prepare.outputs.primary }}" + rolling="${{ needs.prepare.outputs.rolling }}" + digest="$(docker buildx imagetools inspect "$ns/$REPO:$primary" --format '{{.Manifest.Digest}}')" + { + echo "### Published to Docker Hub (silent — no GitHub Release)" + echo + echo "Repository \`$REPO\`, under the configured Docker Hub account. Tags pushed:" + echo + echo "- \`$REPO:$primary\`" + [ -n "$rolling" ] && echo "- \`$REPO:$rolling\`" + echo + echo "| field | value |" + echo "|---|---|" + echo "| platforms | linux/amd64, linux/arm64 |" + echo "| manifest digest | \`$digest\` |" + echo "| mongod | \`$MONGO_IMAGE\` — no AVX requirement |" + echo "| runtime | \`$RUNTIME_IMAGE\` (OpenSSL 1.1) |" + echo "| sidecar built on | \`$RUST_IMAGE\` |" + echo "| source commit | \`$GITHUB_SHA\` |" + echo + echo "> **Fresh \`/data\` volume required.** A dbpath written by mongod 7.0 cannot be opened by" + echo "> 4.4 (no FCV downgrade). Migrate with Settings → Data: generate a backup on the 7.0 image," + echo "> boot this one on an empty volume, then restore." + } >> "$GITHUB_STEP_SUMMARY" diff --git a/README.md b/README.md index 7c04937..6b5de70 100644 --- a/README.md +++ b/README.md @@ -217,8 +217,15 @@ masqueradarr ships as Docker images. There are two deployment shapes. A second image bundles **app + MongoDB + config bootstrap** into one container, so the whole stack runs from a single `docker run` with no external database — ideal for a quick trial or a small home server. One `/data` volume persists the database, exports, config, and credentials. It's published under the -**`iflip721/masqueradarr`** name (see **Migration status** above). *(On amd64, the bundled MongoDB 7.0 -requires a CPU with AVX; on hosts without it, use the compose stack.)* +**`iflip721/masqueradarr`** name (see **Migration status** above). + +> **No-AVX hosts (Synology NAS, Atom/Celeron, older Xeons, kvm64/qemu64 VMs).** On amd64 the bundled +> MongoDB 7.0 requires a CPU with AVX — without it mongod dies at boot with `Illegal instruction (core +> dumped)`. Those hosts want the **`mongo4.4-`** tags, an otherwise-identical image built with MongoDB +> 4.4 (which predates the AVX requirement): `iflip721/masqueradarr-aio:mongo4.4-latest`. It needs a +> **fresh `/data` volume** — a database written by MongoDB 7.0 cannot be opened by 4.4. To carry data +> across, generate a backup from **Settings → Data** on the 7.0 image, boot this one on an empty volume, +> then restore. Alternatively, use the compose stack with `image: mongo:4.4`. To publish on a different host port, change the left side of the `-p` mapping — e.g. `-p 8080:3000` (the container always serves on `3000` internally; `MASQUERADARR_PORT` only applies to the compose stack). diff --git a/docker/aio-entrypoint.sh b/docker/aio-entrypoint.sh index 125e33b..1993a73 100755 --- a/docker/aio-entrypoint.sh +++ b/docker/aio-entrypoint.sh @@ -17,7 +17,7 @@ # ----------------------------------------------------------------------------- set -euo pipefail -NODE_UID=node # uid/gid 1000 in node:*-bookworm-slim +NODE_UID=node # uid/gid 1000 in every node:*-slim base (bookworm and bullseye) DATA_DIR=/data DB_DIR=/data/db COMPOSE_DIR=/data/compose diff --git a/docker/aio.Dockerfile b/docker/aio.Dockerfile index e8f1975..a9dcfcf 100644 --- a/docker/aio.Dockerfile +++ b/docker/aio.Dockerfile @@ -20,27 +20,50 @@ # runtime BASE is not a divergence. The only intentional divergence left is the all-in-one delta: mongod + # gosu + the /data redirect + the supervisor entrypoint, # and no `USER node` line because the entrypoint starts as root to chown the data volume. +# (app.Dockerfile carries the same RUNTIME_IMAGE/RUST_IMAGE args; MONGO_IMAGE is aio-only.) # # All-in-one specifics: -# - mongod 7.0 (server only) runs --auth, bound to 127.0.0.1 ONLY (never port-exposed). +# - mongod (server only) runs --auth, bound to 127.0.0.1 ONLY (never port-exposed). # - A bash supervisor (docker/aio-entrypoint.sh) runs config-init -> mongod -> ready-gate -> node # under tini, dropping both long-lived processes to the `node` uid (1000) via gosu. # - One /data volume holds the DB (/data/db), composed exports (/data/compose via a symlink from the # non-overridable /app/compose), the config (/data/config.json), and the embedded mongo creds. # -# AVX NOTE: on amd64, mongod 7.0 requires a CPU with AVX (same constraint as the standard mongo:7.0.15 -# image). On hosts without AVX, use the multi-container compose stack instead. +# AVX NOTE: on amd64, mongod 5.0+ requires a CPU with AVX (same constraint as the standard mongo:7.0.15 +# image), so the DEFAULT build will not start on older Atom/Celeron/pre-2011 Xeon hosts or on a +# hypervisor exposing a kvm64/qemu64 CPU model — mongod dies instantly with SIGILL ("Illegal +# instruction"). Those hosts want the mongo4.4-* tags built by .github/workflows/docker-publish-mongo44.yml +# (4.4 predates the AVX requirement), or the multi-container compose stack with `image: mongo:4.4`. # ----------------------------------------------------------------------------- + +# ---- Base-image matrix (build args) ---- +# The DEFAULTS below reproduce the standard mongo-7 image exactly — the normal workflow passes only +# APP_VERSION. `Build and Publish Mongo 4.4` overrides all four TOGETHER, because they are not +# independent: MONGO_IMAGE's Ubuntu base decides which OpenSSL the copied-in mongod needs, and the Rust +# sidecar is dynamically linked against the RUNTIME glibc, so RUST_IMAGE must track RUNTIME_IMAGE or +# masq-proxy fails to load with `GLIBC_2.34 not found`. +# +# MONGO_IMAGE -> needs -> RUNTIME_IMAGE / NODE_IMAGE -> RUST_IMAGE +# mongo:7.0.15 (jammy 22.04, glibc 2.35) OpenSSL 3 node:22*-bookworm-slim rust:1-bookworm +# mongo:4.4.30-focal (focal 20.04, glibc 2.31) OpenSSL 1.1 node:22*-bullseye-slim rust:1-bullseye +# +# (bullseye reaches EOL ~2026-08-31; once Debian moves it to archive.debian.org the runtime apt blocks +# below will 404 on that variant only — fix is an sources.list rewrite to archive.debian.org plus +# `-o Acquire::Check-Valid-Until=false`. The default bookworm build is unaffected.) ARG NODE_IMAGE=node:22.11.0-bookworm-slim +ARG RUNTIME_IMAGE=node:22-bookworm-slim +ARG RUST_IMAGE=rust:1-bookworm +ARG MONGO_IMAGE=mongo:7.0.15 # ---- mongod binary source: the official multi-arch mongo image (amd64 + arm64) ---- # MongoDB ships arm64 ONLY via its Ubuntu builds — the Debian apt repo is amd64-only (its bookworm # InRelease advertises no arm64), which is why an apt install fails the arm64 build. The official -# `mongo` image is multi-arch and built from those Ubuntu (jammy) packages, so we copy mongod out of it -# per target arch. The jammy binary runs on the bookworm runtime below (glibc is forward-compatible and -# the openssl 3 ABI matches; libcurl4 added there satisfies its last dep — verified). Pinned to 7.0.15 -# to match docker-compose.yml's MONGO = 7.0.15. -FROM mongo:7.0.15 AS mongo +# `mongo` image is multi-arch and built from those Ubuntu packages, so we copy mongod out of it per +# target arch. The Ubuntu binary runs on the Debian runtime below because glibc is forward-compatible +# and the OpenSSL ABI is paired by the matrix above (7.0/jammy needs libssl3, which bookworm has; +# 4.4/focal needs libssl1.1, which bullseye has) — libcurl4, added in the runtime, satisfies its last +# dep in both cases. The 7.0.15 default matches docker-compose.yml's MONGO = 7.0.15. +FROM ${MONGO_IMAGE} AS mongo # ---- Stage 1: build the SPA (root package) — MIRRORS docker/app.Dockerfile ---- FROM ${NODE_IMAGE} AS spa-build @@ -67,12 +90,15 @@ COPY server/src/ ./src/ RUN npm run build # tsc -p . -> /server/dist # ---- Stage 2b: build the Rust video-proxy sidecar (masq-proxy) — MIRRORS docker/app.Dockerfile ---- -# Debian bookworm base → glibc, matching the runtime stage (and this image's copied-in mongod). The durable -# video DATA PLANE that node spawns + supervises on loopback (server/src/proxy/sidecar.ts). Produces -# /proxy/target/release/masq-proxy. cargo-chef splits the dependency compile into its own gha-cacheable -# layer (busts only on Cargo.toml/Cargo.lock change). See app.Dockerfile for the full rationale (keep the -# two in sync). -FROM rust:1-bookworm AS chef +# Debian base → glibc, and it MUST be the SAME Debian release as RUNTIME_IMAGE: masq-proxy is dynamically +# linked, so a bookworm-built binary (glibc 2.36) will not load on a bullseye runtime (glibc 2.31). That +# is the whole reason RUST_IMAGE exists as an arg — it moves with RUNTIME_IMAGE, never on its own. There +# is no OpenSSL coupling here: the crate uses rustls + RustCrypto, not system OpenSSL (proxy/Cargo.toml). +# The durable video DATA PLANE that node spawns + supervises on loopback (server/src/proxy/sidecar.ts). +# Produces /proxy/target/release/masq-proxy. cargo-chef splits the dependency compile into its own +# gha-cacheable layer (busts only on Cargo.toml/Cargo.lock change). See app.Dockerfile for the full +# rationale (keep the two in sync). +FROM ${RUST_IMAGE} AS chef RUN cargo install cargo-chef --locked WORKDIR /proxy @@ -87,11 +113,13 @@ COPY proxy/ ./ RUN cargo build --release # only the masq-proxy crate recompiles # ---- Stage 3: runtime (app + mongod + config-init supervisor) ---- -# Debian (bookworm) base — same as app.Dockerfile (both are glibc). This image additionally MUST stay glibc -# regardless of the app image: the mongod binary copied in from the official mongo image (the `mongo` stage) is -# a glibc build and won't run on musl. The dulo browser here is Debian's apt `chromium` (same as app.Dockerfile). -# mongod is copied (not apt-installed) because MongoDB's Debian repo has no arm64. -FROM node:22-bookworm-slim AS runtime +# Debian base (bookworm by default) — same as app.Dockerfile (both are glibc). This image additionally MUST +# stay glibc regardless of the app image: the mongod binary copied in from the official mongo image (the +# `mongo` stage) is a glibc build and won't run on musl. It must also ship the OpenSSL major that mongod was +# linked against — see the base-image matrix at the top; that pairing is why RUNTIME_IMAGE and MONGO_IMAGE +# are overridden together and never one at a time. The dulo browser here is Debian's apt `chromium` (same as +# app.Dockerfile). mongod is copied (not apt-installed) because MongoDB's Debian repo has no arm64. +FROM ${RUNTIME_IMAGE} AS runtime # BACKUPS_DIR redirects the scheduled-backup target into the single /data volume (the server seeds # settings.backupLocation from this env default). The standard image instead defaults to /backups (a # bind-mountable dir created in app.Dockerfile) — an intentional all-in-one delta, like the /data redirect. @@ -120,14 +148,18 @@ COPY server/package.json server/package-lock.json ./ RUN npm ci --omit=dev && npm cache clean --force # All-in-one additions: gosu (per-process privilege drop) + libcurl4 (the one mongod runtime lib not -# already in node:bookworm-slim). The Node runtime already present does the mongod readiness probe and -# the first-boot user creation via the transitive mongodb driver, so no mongosh is needed. +# already in the node:*-slim base). This line is variant-agnostic and MUST NOT name an libssl package: +# libcurl4 itself Depends on libssl3 in bookworm and on libssl1.1 in bullseye, which is exactly what +# mongod 7.0 and 4.4 respectively link against — so the matrix at the top drags in the right one for free, +# whereas a hardcoded libssl would break the other variant. The Node runtime already present does the +# mongod readiness probe and the first-boot user creation via the transitive mongodb driver, so no mongosh +# is needed. RUN apt-get update \ && apt-get install -y --no-install-recommends gosu libcurl4 \ && rm -rf /var/lib/apt/lists/* -# mongod 7.0 (server only) — the binary lifted from the official multi-arch mongo image (see the `mongo` -# stage). COPY --from selects the matching-arch mongod per build platform. +# mongod (server only) — the binary lifted from the official multi-arch mongo image named by MONGO_IMAGE +# (see the `mongo` stage). COPY --from selects the matching-arch mongod per build platform. COPY --from=mongo /usr/bin/mongod /usr/bin/mongod # Compiled server + built SPA + committed source snapshots (MIRROR app.Dockerfile). diff --git a/docker/app.Dockerfile b/docker/app.Dockerfile index 06c9b13..c3b5109 100644 --- a/docker/app.Dockerfile +++ b/docker/app.Dockerfile @@ -30,7 +30,13 @@ # cannot dlopen), AMD VAAPI, and Intel QSV. The dulo streamed-login browser drives Debian's `chromium` apt package # via puppeteer-core. Keep the Node major in lockstep with CLAUDE.md. # ----------------------------------------------------------------------------- + +# Base-image args — MIRRORS docker/aio.Dockerfile (which additionally carries MONGO_IMAGE, since only the +# all-in-one bundles mongod). RUNTIME_IMAGE and RUST_IMAGE must move as a pair: masq-proxy is dynamically +# linked against the runtime glibc. Nothing overrides these today — the defaults are the shipped image. ARG NODE_IMAGE=node:22.11.0-bookworm-slim +ARG RUNTIME_IMAGE=node:22-bookworm-slim +ARG RUST_IMAGE=rust:1-bookworm # ---- Stage 1: build the SPA (root package) ---------------------------------- FROM ${NODE_IMAGE} AS spa-build @@ -69,7 +75,7 @@ RUN npm run build # tsc -p . -> /server/dist # reruns. cargo-chef is installed from crates.io onto the same trusted rust:1-bookworm base — no # third-party base image, so the supply chain is unchanged. (Cargo.lock is committed; --locked-free cook # still respects it since it's in the recipe.) -FROM rust:1-bookworm AS chef +FROM ${RUST_IMAGE} AS chef RUN cargo install cargo-chef --locked WORKDIR /proxy @@ -88,7 +94,7 @@ RUN cargo build --release # only the masq-proxy # the only remaining divergence is the config bootstrap (see SYNC NOTE). The dulo streamed-login browser drives # Debian's apt `chromium`. (The video engine + all ffmpeg/GPU-hwaccel deps were removed in the video-engine # teardown — see the runtime deps below; the base stays Debian for mongod parity, not for NVENC.) -FROM node:22-bookworm-slim AS runtime +FROM ${RUNTIME_IMAGE} AS runtime ENV NODE_ENV=production \ MASQUERADARR_CONFIG=/app/config/config.json \ CHROMIUM_PATH=/usr/bin/chromium \ diff --git a/server/src/sources/adapters/dulo/loginBrowser.ts b/server/src/sources/adapters/dulo/loginBrowser.ts index 5d1028f..8ddd9c4 100644 --- a/server/src/sources/adapters/dulo/loginBrowser.ts +++ b/server/src/sources/adapters/dulo/loginBrowser.ts @@ -181,7 +181,8 @@ class DuloLoginBrowser { try { session.browser = await puppeteer.launch({ // executablePath points at the distro Chromium baked into the Docker image (CHROMIUM_PATH: Debian's apt - // /usr/bin/chromium — same path in app.Dockerfile and aio.Dockerfile, both bookworm). puppeteer-core + // /usr/bin/chromium — same path in app.Dockerfile and aio.Dockerfile on every base; note the aio + // mongo4.4-* variant is bullseye, whose chromium is frozen at 120 vs bookworm's). puppeteer-core // ships NO bundled browser, so this must resolve to a real binary; if unset the launch throws and the // feature degrades cleanly (caught below). HEADFUL: running headed (under Xvfb in the Docker runtime) is the // biggest lever against Google's "Continue with Google" gate after navigator.webdriver.