Merge pull request #2067 from reallav0/agent/include-playwright-headless-shell

fix(docker): include Playwright headless shell

Author: ntohidi

Dockerfile

@@ -178,7 +178,9 @@ RUN crawl4ai-setup
 RUN playwright install --with-deps
 
 RUN mkdir -p /home/appuser/.cache/ms-playwright \
-    && cp -r /root/.cache/ms-playwright/chromium-* /home/appuser/.cache/ms-playwright/ \
+    && cp -r /root/.cache/ms-playwright/chromium-* \
+        /root/.cache/ms-playwright/chromium_headless_shell-* \
+        /home/appuser/.cache/ms-playwright/ \
     && chown -R appuser:appuser /home/appuser/.cache/ms-playwright
 
 RUN crawl4ai-doctor
@@ -227,4 +229,4 @@ ENV PYTHON_ENV=production
 # Start via entrypoint.sh, which resolves the socket-level auth/egress posture
 # (loopback unless a credential is present) and the redis password, then execs
 # supervisord.
-CMD ["bash", "entrypoint.sh"]
+CMD ["bash", "entrypoint.sh"]

deploy/docker/tests/test_security_container_posture.py

@@ -57,6 +57,19 @@ def test_artifact_dir_created_0700(self, dockerfile):
         assert "/var/lib/crawl4ai/outputs" in dockerfile
         assert "chmod 700 /var/lib/crawl4ai/outputs" in dockerfile
 
+    def test_playwright_headless_shell_is_copied_to_runtime_cache(self, dockerfile):
+        # Playwright launches chromium_headless_shell for headless crawls. The
+        # image runs as appuser, so both Chromium artifacts must be copied out
+        # of root's install cache.
+        cache_copy = re.search(
+            r"cp -r(?P<artifacts>(?:(?!&&).)*)/home/appuser/\.cache/ms-playwright/",
+            dockerfile,
+            re.DOTALL,
+        )
+        assert cache_copy, "Dockerfile must copy Playwright artifacts into appuser's cache"
+        assert "chromium-*" in cache_copy.group("commands")
+        assert "chromium_headless_shell-*" in cache_copy.group("commands")
+
     def test_runs_as_non_root(self, dockerfile):
         assert re.search(r"^USER\s+appuser", dockerfile, re.MULTILINE)