feat: add Dockerfile + --host flag for containerized deployment

Adds a multi-stage Dockerfile (rust:1-slim-bookworm builder → distroless/cc
runtime) plus a --host flag for obscura serve that defaults to 127.0.0.1
for safety but can be set to 0.0.0.0 so the container's port is reachable
via docker run -p mapping.

Dockerfile cherry-picked from #84. The SPA chunk loading commit from that
PR was left out — verified it didn't actually fix the Next.js webpack
errors on kiwi.com (#86).

Dockerfile

@@ -0,0 +1,50 @@
+FROM rust:1-slim-bookworm AS builder
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        curl \
+        ca-certificates \
+        perl \
+        make \
+    && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /build
+
+# Cache dependency compilation by copying manifests first
+COPY Cargo.toml Cargo.lock ./
+COPY crates/obscura-dom/Cargo.toml       crates/obscura-dom/Cargo.toml
+COPY crates/obscura-net/Cargo.toml       crates/obscura-net/Cargo.toml
+COPY crates/obscura-browser/Cargo.toml   crates/obscura-browser/Cargo.toml
+COPY crates/obscura-cdp/Cargo.toml       crates/obscura-cdp/Cargo.toml
+COPY crates/obscura-js/Cargo.toml        crates/obscura-js/Cargo.toml
+COPY crates/obscura-mcp/Cargo.toml       crates/obscura-mcp/Cargo.toml
+COPY crates/obscura-cli/Cargo.toml       crates/obscura-cli/Cargo.toml
+
+# Create stub src files so cargo can resolve the dependency graph
+RUN for crate in obscura-dom obscura-net obscura-browser obscura-cdp obscura-js obscura-mcp; do \
+        mkdir -p crates/$crate/src && echo "// stub" > crates/$crate/src/lib.rs; \
+    done && \
+    mkdir -p crates/obscura-cli/src && \
+    echo "fn main() {}" > crates/obscura-cli/src/main.rs && \
+    echo "fn main() {}" > crates/obscura-cli/src/worker.rs
+
+RUN cargo build --release --bin obscura --bin obscura-worker 2>/dev/null || true
+
+# Copy real sources and build
+COPY crates/ crates/
+RUN touch crates/*/src/*.rs && cargo build --release --bin obscura --bin obscura-worker
+
+# ---
+
+# distroless/cc: glibc + libgcc + CA certs only — no shell, no package manager
+FROM gcr.io/distroless/cc-debian12
+
+COPY --from=builder /build/target/release/obscura /obscura
+COPY --from=builder /build/target/release/obscura-worker /obscura-worker
+
+EXPOSE 9222
+
+# Bind to 0.0.0.0 so the port is reachable via `docker run -p 9222:9222`.
+# Native binary still defaults to 127.0.0.1 (loopback only) — this override
+# is just for the container.
+ENTRYPOINT ["/obscura"]
+CMD ["serve", "--port", "9222", "--host", "0.0.0.0"]

crates/obscura-cdp/src/lib.rs

@@ -3,4 +3,4 @@ pub mod dispatch;
 pub mod types;
 pub mod domains;
 
-pub use server::{start, start_with_full_options, start_with_options};
+pub use server::{start, start_with_full_options, start_with_host, start_with_options};

crates/obscura-cdp/src/server.rs

@@ -46,13 +46,26 @@ pub async fn start_with_full_options(
     stealth: bool,
     user_agent: Option<String>,
 ) -> anyhow::Result<()> {
-    let addr = SocketAddr::from(([127, 0, 0, 1], port));
+    start_with_host(port, "127.0.0.1", proxy, stealth, user_agent).await
+}
+
+pub async fn start_with_host(
+    port: u16,
+    host: &str,
+    proxy: Option<String>,
+    stealth: bool,
+    user_agent: Option<String>,
+) -> anyhow::Result<()> {
+    let ip: std::net::IpAddr = host
+        .parse()
+        .map_err(|e| anyhow::anyhow!("invalid --host '{}': {}", host, e))?;
+    let addr = SocketAddr::new(ip, port);
     let listener = TcpListener::bind(&addr).await?;
 
-    info!("Obscura CDP server listening on ws://127.0.0.1:{}", port);
+    info!("Obscura CDP server listening on ws://{}:{}", host, port);
     info!(
-        "DevTools endpoint: ws://127.0.0.1:{}/devtools/browser",
+        "DevTools endpoint: ws://{}:{}/devtools/browser",
-        port
+        host, port
     );
 
     let local = tokio::task::LocalSet::new();

crates/obscura-cli/src/main.rs

@@ -35,6 +35,13 @@ enum Command {
         #[arg(short, long, default_value_t = 9222)]
         port: u16,
 
+        // Bind address. Defaults to 127.0.0.1 (loopback only) for safety.
+        // Set to 0.0.0.0 to listen on all interfaces (e.g. inside a Docker
+        // container where you want the port to be reachable from the host
+        // via -p mapping).
+        #[arg(long, default_value = "127.0.0.1")]
+        host: String,
+
         #[arg(long)]
         proxy: Option<String>,
 
@@ -181,7 +188,7 @@ async fn main() -> anyhow::Result<()> {
     let global_proxy = args.proxy.clone();
 
     match args.command {
-        Some(Command::Serve { port, proxy, user_agent, stealth, workers }) => {
+        Some(Command::Serve { port, host, proxy, user_agent, stealth, workers }) => {
             let proxy = merge_proxy(global_proxy.clone(), proxy);
             print_banner(port);
             if let Some(ref proxy) = proxy {
@@ -203,7 +210,7 @@ async fn main() -> anyhow::Result<()> {
                 tracing::info!("{} worker processes", workers);
                 run_multi_worker_serve(port, workers, proxy, stealth, user_agent).await?;
             } else {
-                obscura_cdp::start_with_full_options(port, proxy, stealth, user_agent).await?;
+                obscura_cdp::start_with_host(port, &host, proxy, stealth, user_agent).await?;
             }
         }
         Some(Command::Fetch { url, dump, selector, wait, timeout, wait_until, user_agent, stealth, eval, output, quiet }) => {