# DingTalk login sidecar: drives a headless Chromium to capture scan-code
# sessions and atomically refresh the browser capture file that the
# governance scanners read from /run/source-secrets.
FROM docker.m.daocloud.io/library/node:22-bookworm-slim

ENV PLAYWRIGHT_BROWSERS_PATH=/opt/playwright \
    PLAYWRIGHT_DOWNLOAD_HOST=https://cdn.npmmirror.com/binaries/playwright \
    NODE_ENV=production

WORKDIR /app
COPY package.json ./
RUN npm install --registry=https://registry.npmmirror.com
# Chromium + system deps for Playwright.
RUN apt-get update \
    && PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1 npx playwright install-deps chromium \
    && rm -rf /var/lib/apt/lists/*
RUN npx playwright install chromium

COPY server.mjs ./
RUN mkdir -p /profile && chown node:node /profile
USER node
EXPOSE 8091
CMD ["node", "server.mjs"]
