From 5787b4ccd47c6dffcb6836e4c13bfdfffc607b50 Mon Sep 17 00:00:00 2001 From: Yury Semikhatsky Date: Tue, 3 Nov 2026 08:29:21 -0800 Subject: [PATCH 1/3] devops(docker): keep the checkout credentials out of the publish pipeline and the build context Check out the repository without persisting the credentials in the git config, and exclude .git from the Docker build context. --- .azure-pipelines/publish-docker.yml | 1 + .dockerignore | 4 +++- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/.azure-pipelines/publish-docker.yml b/.azure-pipelines/publish-docker.yml index 48ef7f9a6..c0842b54d 100644 --- a/.azure-pipelines/publish-docker.yml +++ b/.azure-pipelines/publish-docker.yml @@ -48,6 +48,7 @@ extends: steps: - checkout: self displayName: "Checkout code" + persistCredentials: false - task: UseNode@1 inputs: diff --git a/.dockerignore b/.dockerignore index f609d7b5c..619ba174b 100644 --- a/.dockerignore +++ b/.dockerignore @@ -1,5 +1,7 @@ # The repository root is the Docker build context (see utils/docker/build.sh). -# Keep registry credentials written by the release pipeline out of the images. +# Keep VCS metadata and the registry credentials written by the release pipeline +# out of the build context. +.git **/.npmrc # Downloaded by publish_docker.sh after the first push. utils/docker/oras From cf800f75282af586c811f617655516e64614e53b Mon Sep 17 00:00:00 2001 From: Yury Semikhatsky Date: Tue, 3 Nov 2026 08:29:32 -0800 Subject: [PATCH 2/3] fix(docker): COPY only the Maven modules into the image build Copy the root POM and the driver, driver-bundle and playwright modules into the build instead of the whole build context, and keep the target directories out of the build context. --- .dockerignore | 5 +++-- utils/docker/Dockerfile.jammy | 6 +++++- utils/docker/Dockerfile.noble | 6 +++++- utils/docker/Dockerfile.resolute | 6 +++++- utils/docker/build.sh | 4 ++-- 5 files changed, 20 insertions(+), 7 deletions(-) diff --git a/.dockerignore b/.dockerignore index 619ba174b..a3519a74b 100644 --- a/.dockerignore +++ b/.dockerignore @@ -1,7 +1,8 @@ # The repository root is the Docker build context (see utils/docker/build.sh). -# Keep VCS metadata and the registry credentials written by the release pipeline -# out of the build context. +# Keep VCS metadata, build output and the registry credentials written by the +# release pipeline out of the build context. .git +**/target **/.npmrc # Downloaded by publish_docker.sh after the first push. utils/docker/oras diff --git a/utils/docker/Dockerfile.jammy b/utils/docker/Dockerfile.jammy index 4440772ea..00c561f94 100644 --- a/utils/docker/Dockerfile.jammy +++ b/utils/docker/Dockerfile.jammy @@ -51,7 +51,11 @@ ENV PLAYWRIGHT_DRIVER_DIR=/ms-playwright-driver RUN mkdir /ms-playwright && \ mkdir /tmp/pw-java -COPY . /tmp/pw-java +# The build reads only the root POM and the Maven modules of the driver and the client. +COPY pom.xml /tmp/pw-java/ +COPY driver /tmp/pw-java/driver +COPY driver-bundle /tmp/pw-java/driver-bundle +COPY playwright /tmp/pw-java/playwright # The optional Maven settings secret routes dependency resolution through a mirror # (see .azure-pipelines/publish-docker.yml). diff --git a/utils/docker/Dockerfile.noble b/utils/docker/Dockerfile.noble index 52779ce15..6dc79cd7a 100644 --- a/utils/docker/Dockerfile.noble +++ b/utils/docker/Dockerfile.noble @@ -51,7 +51,11 @@ ENV PLAYWRIGHT_DRIVER_DIR=/ms-playwright-driver RUN mkdir /ms-playwright && \ mkdir /tmp/pw-java -COPY . /tmp/pw-java +# The build reads only the root POM and the Maven modules of the driver and the client. +COPY pom.xml /tmp/pw-java/ +COPY driver /tmp/pw-java/driver +COPY driver-bundle /tmp/pw-java/driver-bundle +COPY playwright /tmp/pw-java/playwright # The optional Maven settings secret routes dependency resolution through a mirror # (see .azure-pipelines/publish-docker.yml). diff --git a/utils/docker/Dockerfile.resolute b/utils/docker/Dockerfile.resolute index 905962beb..68313365b 100644 --- a/utils/docker/Dockerfile.resolute +++ b/utils/docker/Dockerfile.resolute @@ -45,7 +45,11 @@ ENV PLAYWRIGHT_DRIVER_DIR=/ms-playwright-driver RUN mkdir /ms-playwright && \ mkdir /tmp/pw-java -COPY . /tmp/pw-java +# The build reads only the root POM and the Maven modules of the driver and the client. +COPY pom.xml /tmp/pw-java/ +COPY driver /tmp/pw-java/driver +COPY driver-bundle /tmp/pw-java/driver-bundle +COPY playwright /tmp/pw-java/playwright # The optional Maven settings secret routes dependency resolution through a mirror # (see .azure-pipelines/publish-docker.yml). diff --git a/utils/docker/build.sh b/utils/docker/build.sh index c1225245d..456b8aaee 100755 --- a/utils/docker/build.sh +++ b/utils/docker/build.sh @@ -34,8 +34,8 @@ fi PW_TARGET_ARCH=$(echo $1 | cut -c3-) -# Assemble the driver on the host where npm is available; the Dockerfile picks -# it up via `COPY . /tmp/pw-java`. +# Assemble the driver on the host where npm is available; the Dockerfile COPYs +# the driver modules into the build. ../../scripts/download_driver.sh # The jammy and noble images install this Maven (see the Dockerfiles). Fetch it with the From 420cc749ae28cd24b726a1ef5e0f55b3a228d5bd Mon Sep 17 00:00:00 2001 From: Yury Semikhatsky Date: Tue, 3 Nov 2026 08:32:53 -0800 Subject: [PATCH 3/3] fix(docker): install libatomic1 for the Node.js binary of the driver The official Node.js Linux binaries link against libatomic since Node.js 25, and the driver runs before install-deps adds it. --- utils/docker/Dockerfile.jammy | 2 ++ utils/docker/Dockerfile.noble | 2 ++ utils/docker/Dockerfile.resolute | 2 ++ 3 files changed, 6 insertions(+) diff --git a/utils/docker/Dockerfile.jammy b/utils/docker/Dockerfile.jammy index 00c561f94..ed3c07135 100644 --- a/utils/docker/Dockerfile.jammy +++ b/utils/docker/Dockerfile.jammy @@ -19,6 +19,8 @@ RUN find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \) \ wget \ # Install utilities required for downloading driver unzip \ + # The Node.js binary of the driver links against libatomic (since Node.js 25) + libatomic1 \ # For the MSEdge install script gpg && \ rm -rf /var/lib/apt/lists/* && \ diff --git a/utils/docker/Dockerfile.noble b/utils/docker/Dockerfile.noble index 6dc79cd7a..2e99000d7 100644 --- a/utils/docker/Dockerfile.noble +++ b/utils/docker/Dockerfile.noble @@ -19,6 +19,8 @@ RUN find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \) \ wget \ # Install utilities required for downloading driver unzip \ + # The Node.js binary of the driver links against libatomic (since Node.js 25) + libatomic1 \ # For the MSEdge install script gpg && \ rm -rf /var/lib/apt/lists/* && \ diff --git a/utils/docker/Dockerfile.resolute b/utils/docker/Dockerfile.resolute index 68313365b..b49aa52e9 100644 --- a/utils/docker/Dockerfile.resolute +++ b/utils/docker/Dockerfile.resolute @@ -21,6 +21,8 @@ RUN find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \) \ wget \ # Install utilities required for downloading driver unzip \ + # The Node.js binary of the driver links against libatomic (since Node.js 25) + libatomic1 \ # For the MSEdge install script gpg && \ rm -rf /var/lib/apt/lists/* && \