fix(docker): keep browser setup in one layer

nightcityblade · nightcityblade · commit 14291fac78d8 · 2026-07-29T23:08:54.000+08:00
diff --git a/Dockerfile b/Dockerfile
@@ -173,17 +173,15 @@ RUN pip install --no-cache-dir --upgrade pip && \
     python -c "import crawl4ai; print('✅ crawl4ai is ready to rock!')" && \
     python -c "from playwright.sync_api import sync_playwright; print('✅ Playwright is feeling dramatic!')"
 
-RUN crawl4ai-setup
-
-RUN playwright install --with-deps \
+RUN crawl4ai-setup \
+    && playwright install --with-deps chromium \
+    && crawl4ai-doctor \
     && mkdir -p /home/appuser/.cache/ms-playwright \
     && cp -r /root/.cache/ms-playwright/chromium-* \
         /root/.cache/ms-playwright/chromium_headless_shell-* \
         /home/appuser/.cache/ms-playwright/ \
     && chown -R appuser:appuser /home/appuser/.cache/ms-playwright \
-    && rm -rf /root/.cache/ms-playwright
-
-RUN crawl4ai-doctor \
+    && rm -rf /root/.cache/ms-playwright \
     && find "${APP_HOME}" -maxdepth 1 -type f -name '*.core' -delete
 
 # Ensure all cache directories belong to appuser
diff --git a/deploy/docker/tests/test_security_container_posture.py b/deploy/docker/tests/test_security_container_posture.py
@@ -74,19 +74,25 @@ def test_playwright_headless_shell_is_copied_to_runtime_cache(self, dockerfile):
         assert "chromium_headless_shell-*" in cache_copy.group("artifacts")
 
     def test_build_artifacts_removed_before_layer_commit(self, dockerfile):
-        for command, cleanup in (
-            ("playwright install --with-deps", "rm -rf /root/.cache/ms-playwright"),
-            ("crawl4ai-doctor", "-name '*.core' -delete"),
+        layer = re.search(
+            r"^RUN crawl4ai-setup(?P<body>(?:(?!^[A-Z]+\s).)*)",
+            dockerfile,
+            re.MULTILINE | re.DOTALL,
+        )
+        assert layer, "Dockerfile must run crawl4ai-setup"
+        positions = []
+        for command in (
+            "playwright install --with-deps chromium",
+            "crawl4ai-doctor",
+            "cp -r /root/.cache/ms-playwright/chromium-*",
+            "rm -rf /root/.cache/ms-playwright",
+            "-name '*.core' -delete",
         ):
-            layer = re.search(
-                rf"^RUN {re.escape(command)}(?P<body>(?:(?!^[A-Z]+\s).)*)",
-                dockerfile,
-                re.MULTILINE | re.DOTALL,
-            )
-            assert layer, f"Dockerfile must run {command}"
-            assert cleanup in layer.group(
+            assert command in layer.group(
                 "body"
-            ), f"{cleanup} must run in the {command} layer"
+            ), f"{command} must run in the crawl4ai-setup layer"
+            positions.append(layer.group("body").index(command))
+        assert positions == sorted(positions), "Docker build steps must remain ordered"
 
     def test_runs_as_non_root(self, dockerfile):
         assert re.search(r"^USER\s+appuser", dockerfile, re.MULTILINE)
