From a23cdc0ae74385cc865852ecc9c171a9cb67a2e7 Mon Sep 17 00:00:00 2001 From: SGavrl Date: Wed, 13 May 2026 22:01:22 +0000 Subject: [PATCH] feat: add Dockerfile + --host flag for containerized deployment MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Adds a multi-stage Dockerfile (rust:1-slim-bookworm builder → distroless/cc runtime) plus a --host flag for obscura serve that defaults to 127.0.0.1 for safety but can be set to 0.0.0.0 so the container's port is reachable via docker run -p mapping. Dockerfile cherry-picked from #84. The SPA chunk loading commit from that PR was left out — verified it didn't actually fix the Next.js webpack errors on kiwi.com (#86). --- Dockerfile | 50 ++++++++++++++++++++++++++++++++ crates/obscura-cdp/src/lib.rs | 2 +- crates/obscura-cdp/src/server.rs | 21 +++++++++++--- crates/obscura-cli/src/main.rs | 11 +++++-- 4 files changed, 77 insertions(+), 7 deletions(-) create mode 100644 Dockerfile diff --git a/Dockerfile b/Dockerfile new file mode 100644 index 0000000..40c7098 --- /dev/null +++ b/Dockerfile @@ -0,0 +1,50 @@ +FROM rust:1-slim-bookworm AS builder + +RUN apt-get update && apt-get install -y --no-install-recommends \ + curl \ + ca-certificates \ + perl \ + make \ + && rm -rf /var/lib/apt/lists/* + +WORKDIR /build + +# Cache dependency compilation by copying manifests first +COPY Cargo.toml Cargo.lock ./ +COPY crates/obscura-dom/Cargo.toml crates/obscura-dom/Cargo.toml +COPY crates/obscura-net/Cargo.toml crates/obscura-net/Cargo.toml +COPY crates/obscura-browser/Cargo.toml crates/obscura-browser/Cargo.toml +COPY crates/obscura-cdp/Cargo.toml crates/obscura-cdp/Cargo.toml +COPY crates/obscura-js/Cargo.toml crates/obscura-js/Cargo.toml +COPY crates/obscura-mcp/Cargo.toml crates/obscura-mcp/Cargo.toml +COPY crates/obscura-cli/Cargo.toml crates/obscura-cli/Cargo.toml + +# Create stub src files so cargo can resolve the dependency graph +RUN for crate in obscura-dom obscura-net obscura-browser obscura-cdp obscura-js obscura-mcp; do \ + mkdir -p crates/$crate/src && echo "// stub" > crates/$crate/src/lib.rs; \ + done && \ + mkdir -p crates/obscura-cli/src && \ + echo "fn main() {}" > crates/obscura-cli/src/main.rs && \ + echo "fn main() {}" > crates/obscura-cli/src/worker.rs + +RUN cargo build --release --bin obscura --bin obscura-worker 2>/dev/null || true + +# Copy real sources and build +COPY crates/ crates/ +RUN touch crates/*/src/*.rs && cargo build --release --bin obscura --bin obscura-worker + +# --- + +# distroless/cc: glibc + libgcc + CA certs only — no shell, no package manager +FROM gcr.io/distroless/cc-debian12 + +COPY --from=builder /build/target/release/obscura /obscura +COPY --from=builder /build/target/release/obscura-worker /obscura-worker + +EXPOSE 9222 + +# Bind to 0.0.0.0 so the port is reachable via `docker run -p 9222:9222`. +# Native binary still defaults to 127.0.0.1 (loopback only) — this override +# is just for the container. +ENTRYPOINT ["/obscura"] +CMD ["serve", "--port", "9222", "--host", "0.0.0.0"] diff --git a/crates/obscura-cdp/src/lib.rs b/crates/obscura-cdp/src/lib.rs index 271ec96..5f7382b 100644 --- a/crates/obscura-cdp/src/lib.rs +++ b/crates/obscura-cdp/src/lib.rs @@ -3,4 +3,4 @@ pub mod dispatch; pub mod types; pub mod domains; -pub use server::{start, start_with_full_options, start_with_options}; +pub use server::{start, start_with_full_options, start_with_host, start_with_options}; diff --git a/crates/obscura-cdp/src/server.rs b/crates/obscura-cdp/src/server.rs index 0201964..4ac7ec7 100644 --- a/crates/obscura-cdp/src/server.rs +++ b/crates/obscura-cdp/src/server.rs @@ -46,13 +46,26 @@ pub async fn start_with_full_options( stealth: bool, user_agent: Option, ) -> anyhow::Result<()> { - let addr = SocketAddr::from(([127, 0, 0, 1], port)); + start_with_host(port, "127.0.0.1", proxy, stealth, user_agent).await +} + +pub async fn start_with_host( + port: u16, + host: &str, + proxy: Option, + stealth: bool, + user_agent: Option, +) -> anyhow::Result<()> { + let ip: std::net::IpAddr = host + .parse() + .map_err(|e| anyhow::anyhow!("invalid --host '{}': {}", host, e))?; + let addr = SocketAddr::new(ip, port); let listener = TcpListener::bind(&addr).await?; - info!("Obscura CDP server listening on ws://127.0.0.1:{}", port); + info!("Obscura CDP server listening on ws://{}:{}", host, port); info!( - "DevTools endpoint: ws://127.0.0.1:{}/devtools/browser", - port + "DevTools endpoint: ws://{}:{}/devtools/browser", + host, port ); let local = tokio::task::LocalSet::new(); diff --git a/crates/obscura-cli/src/main.rs b/crates/obscura-cli/src/main.rs index 49b80eb..65cafda 100644 --- a/crates/obscura-cli/src/main.rs +++ b/crates/obscura-cli/src/main.rs @@ -35,6 +35,13 @@ enum Command { #[arg(short, long, default_value_t = 9222)] port: u16, + // Bind address. Defaults to 127.0.0.1 (loopback only) for safety. + // Set to 0.0.0.0 to listen on all interfaces (e.g. inside a Docker + // container where you want the port to be reachable from the host + // via -p mapping). + #[arg(long, default_value = "127.0.0.1")] + host: String, + #[arg(long)] proxy: Option, @@ -181,7 +188,7 @@ async fn main() -> anyhow::Result<()> { let global_proxy = args.proxy.clone(); match args.command { - Some(Command::Serve { port, proxy, user_agent, stealth, workers }) => { + Some(Command::Serve { port, host, proxy, user_agent, stealth, workers }) => { let proxy = merge_proxy(global_proxy.clone(), proxy); print_banner(port); if let Some(ref proxy) = proxy { @@ -203,7 +210,7 @@ async fn main() -> anyhow::Result<()> { tracing::info!("{} worker processes", workers); run_multi_worker_serve(port, workers, proxy, stealth, user_agent).await?; } else { - obscura_cdp::start_with_full_options(port, proxy, stealth, user_agent).await?; + obscura_cdp::start_with_host(port, &host, proxy, stealth, user_agent).await?; } } Some(Command::Fetch { url, dump, selector, wait, timeout, wait_until, user_agent, stealth, eval, output, quiet }) => {