Dockerfile.browser

# ROMarrNG's browser edition: the same app on glibc with Playwright's Python
# client installed. Chromium stays in a separate browser container so users
# who only use direct downloads do not carry its large runtime image.

ARG PLAYWRIGHT_VERSION=1.62.0

FROM python:3.14-slim@sha256:9aaa474097d094040649f2162a627c0049b408f52138d980916788d80f04802f AS builder
ARG PLAYWRIGHT_VERSION

# pyseccomp links against libseccomp; CFFI also needs libffi headers when pip
# builds from source. Build tools and headers stay out of the runtime image.
COPY docker/debian.sources /etc/apt/sources.list.d/debian.sources
RUN apt-get update \
 && apt-get install -y --no-install-recommends build-essential libseccomp-dev libffi-dev \
 && rm -rf /var/lib/apt/lists/*

COPY requirements-browser.lock requirements-build.lock /tmp/
RUN pip install --no-cache-dir --require-hashes -r /tmp/requirements-build.lock \
 && pip install --no-cache-dir --no-build-isolation --require-hashes --prefix=/install -r /tmp/requirements-browser.lock


FROM python:3.14-slim@sha256:9aaa474097d094040649f2162a627c0049b408f52138d980916788d80f04802f

ARG PLAYWRIGHT_VERSION

# gosu is su-exec's Debian twin; the shared entrypoint uses the same uid:gid
# command form on both images. Chromium is intentionally not installed here.
COPY docker/debian.sources /etc/apt/sources.list.d/debian.sources
RUN apt-get update \
 && apt-get install -y --no-install-recommends \
      gosu tzdata libarchive-tools libseccomp2 git ca-certificates \
 && ln -s "$(command -v gosu)" /usr/local/bin/su-exec \
 && rm -rf /var/lib/apt/lists/*

COPY --from=builder /install /usr/local

WORKDIR /app
COPY romarr/ /app/romarr/
COPY docker/entrypoint.sh /entrypoint.sh
RUN chmod +x /entrypoint.sh && mkdir -p /config /roms

ENV ROMARR_DATA=/config/romarr.json \
    ROM_HUB_HOME=/config/rom-hub \
    ROMARR_HOST=0.0.0.0 \
    ROMARR_PORT=6868 \
    PUID=1000 \
    PGID=1000 \
    UMASK=002 \
    PLAYWRIGHT_VERSION=${PLAYWRIGHT_VERSION} \
    PYTHONUNBUFFERED=1 \
    PYTHONDONTWRITEBYTECODE=1

VOLUME /config
EXPOSE 6868

HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
    CMD python -m romarr.healthcheck
# The probe reads ROMARR_PORT and ROMARR_SSL_CERT/ROMARR_SSL_KEY.

LABEL org.opencontainers.image.title="ROMarrNG (browser edition)" \
      org.opencontainers.image.description="ROMarrNG on Debian with the Playwright client for the Headless Browser download client" \
      org.opencontainers.image.source="https://github.com/snapetech-org/ROMarrNG" \
      org.opencontainers.image.licenses="MIT"

ENTRYPOINT ["/entrypoint.sh"]
CMD ["python", "-m", "romarr"]