fix(docker): narrow the Docker build context and keep the checkout credentials out of it

.azure-pipelines/publish-docker.yml

@@ -48,6 +48,7 @@ extends:
         steps:
         - checkout: self
           displayName: "Checkout code"
+          persistCredentials: false
 
         - task: UseNode@1
           inputs:

.dockerignore

@@ -1,5 +1,8 @@
 # The repository root is the Docker build context (see utils/docker/build.sh).
-# Keep registry credentials written by the release pipeline out of the images.
+# Keep VCS metadata, build output and the registry credentials written by the
+# release pipeline out of the build context.
+.git
+**/target
 **/.npmrc
 # Downloaded by publish_docker.sh after the first push.
 utils/docker/oras

utils/docker/Dockerfile.jammy

@@ -19,6 +19,8 @@ RUN find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \) \
     wget \
     # Install utilities required for downloading driver
     unzip \
+    # The Node.js binary of the driver links against libatomic (since Node.js 25)
+    libatomic1 \
     # For the MSEdge install script
     gpg && \
     rm -rf /var/lib/apt/lists/* && \
@@ -51,7 +53,11 @@ ENV PLAYWRIGHT_DRIVER_DIR=/ms-playwright-driver
 RUN mkdir /ms-playwright && \
     mkdir /tmp/pw-java
 
-COPY . /tmp/pw-java
+# The build reads only the root POM and the Maven modules of the driver and the client.
+COPY pom.xml /tmp/pw-java/
+COPY driver /tmp/pw-java/driver
+COPY driver-bundle /tmp/pw-java/driver-bundle
+COPY playwright /tmp/pw-java/playwright
 
 # The optional Maven settings secret routes dependency resolution through a mirror
 # (see .azure-pipelines/publish-docker.yml).

utils/docker/Dockerfile.noble

@@ -19,6 +19,8 @@ RUN find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \) \
     wget \
     # Install utilities required for downloading driver
     unzip \
+    # The Node.js binary of the driver links against libatomic (since Node.js 25)
+    libatomic1 \
     # For the MSEdge install script
     gpg && \
     rm -rf /var/lib/apt/lists/* && \
@@ -51,7 +53,11 @@ ENV PLAYWRIGHT_DRIVER_DIR=/ms-playwright-driver
 RUN mkdir /ms-playwright && \
     mkdir /tmp/pw-java
 
-COPY . /tmp/pw-java
+# The build reads only the root POM and the Maven modules of the driver and the client.
+COPY pom.xml /tmp/pw-java/
+COPY driver /tmp/pw-java/driver
+COPY driver-bundle /tmp/pw-java/driver-bundle
+COPY playwright /tmp/pw-java/playwright
 
 # The optional Maven settings secret routes dependency resolution through a mirror
 # (see .azure-pipelines/publish-docker.yml).

utils/docker/Dockerfile.resolute

@@ -21,6 +21,8 @@ RUN find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \) \
     wget \
     # Install utilities required for downloading driver
     unzip \
+    # The Node.js binary of the driver links against libatomic (since Node.js 25)
+    libatomic1 \
     # For the MSEdge install script
     gpg && \
     rm -rf /var/lib/apt/lists/* && \
@@ -45,7 +47,11 @@ ENV PLAYWRIGHT_DRIVER_DIR=/ms-playwright-driver
 RUN mkdir /ms-playwright && \
     mkdir /tmp/pw-java
 
-COPY . /tmp/pw-java
+# The build reads only the root POM and the Maven modules of the driver and the client.
+COPY pom.xml /tmp/pw-java/
+COPY driver /tmp/pw-java/driver
+COPY driver-bundle /tmp/pw-java/driver-bundle
+COPY playwright /tmp/pw-java/playwright
 
 # The optional Maven settings secret routes dependency resolution through a mirror
 # (see .azure-pipelines/publish-docker.yml).

utils/docker/build.sh

@@ -34,8 +34,8 @@ fi
 
 PW_TARGET_ARCH=$(echo $1 | cut -c3-)
 
-# Assemble the driver on the host where npm is available; the Dockerfile picks
-# it up via `COPY . /tmp/pw-java`.
+# Assemble the driver on the host where npm is available; the Dockerfile COPYs
+# the driver modules into the build.
 ../../scripts/download_driver.sh
 
 # The jammy and noble images install this Maven (see the Dockerfiles). Fetch it with the