Skip to content

fix(bot): bake Chrome into the sandbox image at build time #2416

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ascorbic merged 1 commit into from
Aug 11, 2026
Merged

fix(bot): bake Chrome into the sandbox image at build time #2416

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 15 additions & 3 deletions infra/emdash-bot/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,7 @@
# Container image for the emdash-bot investigate agent's sandbox.
#
# Phase 0 (this spike): minimal. Node 22 + pnpm + git, so the agent can clone
# the repo and run JS commands. No browser yet — Chromium + agent-browser land
# in Phase 2 once we know the simpler agent path works end-to-end.
# Node 22 + pnpm + git for repo installs and JS commands, plus agent-browser
# with a pre-baked Chrome for the browser-driven repro skills.
#
# Multi-stage build: copy Node from the official Node Slim image rather than
# downloading it inside the cloudflare/sandbox base. The sandbox base ships
Expand All @@ -25,6 +24,15 @@ RUN npm install -g pnpm@11.1.3 bgproc@0.3.0 agent-browser@0.30.1 \
&& bgproc --version || true \
&& agent-browser --version || true

# Bake Chrome at build time. At runtime the sandbox egress allowlist only
# passes GitHub/npm hosts, so `agent-browser install` (Chrome for Testing,
# served from Google hosts) can never succeed inside a running container --
# the browser must already be in the image. The Chrome version is pinned by
# the image build: agent-browser 0.30.1 fetches the stable channel at build
# time and the daemon auto-detects the single baked copy under
# /root/.agent-browser/browsers.
RUN agent-browser install

FROM cloudflare/sandbox:0.12.1

# Base OS packages: git for the repo clone the agent does in revise mode,
Expand Down Expand Up @@ -79,6 +87,10 @@ COPY --from=node-source /usr/local/bin/node /usr/local/bin/node
COPY --from=node-source /usr/local/lib/node_modules /usr/local/lib/node_modules
COPY --from=node-source /usr/local/include/node /usr/local/include/node

# The Chrome that `agent-browser install` baked in the source stage. The
# daemon looks here first, so no runtime download is ever attempted.
COPY --from=node-source /root/.agent-browser /root/.agent-browser

# Recreate the CLI symlinks the slim image had (Docker COPY flattens symlinks
# to file copies). Then chmod the .cjs/.js entry points so they're executable.
RUN ln -sf /usr/local/lib/node_modules/npm/bin/npm-cli.js /usr/local/bin/npm \
Expand Down
Loading