70 lines
2.7 KiB
Docker
70 lines
2.7 KiB
Docker
# Base image PINNED to a digest. The browser fingerprint LinkedIn sees is derived
|
|
# from the Chromium build below, which depends on this base. A floating tag would
|
|
# let a rebuild silently pull a newer Debian + newer Chromium, changing the
|
|
# fingerprint and triggering a LinkedIn forced-logout (root cause of the Jun 2026
|
|
# incident). Bump this digest only deliberately — it requires re-authenticating.
|
|
FROM node:22-slim@sha256:d9f850096136edbc402debdd8729579a288aac64574ada0ff4db26b6ae58b0b2
|
|
|
|
# Chromium PINNED to an exact version for a stable browser fingerprint.
|
|
# Do NOT unpin. Any Chromium change must be a conscious decision — it changes the
|
|
# fingerprint and will log the LinkedIn session out (Jun 2026 incident, §15).
|
|
#
|
|
# We fetch Chromium from snapshot.debian.org (a frozen, immutable Debian archive)
|
|
# instead of the live mirror. The live mirror only keeps the newest 1-2 Chromium
|
|
# builds, so it ROTATED 149 out (and the current live build, 150.0.7871.46, is a
|
|
# broken build that SIGTRAPs on launch — do not use it). The snapshot archive keeps
|
|
# every version forever, so this pin builds reproducibly regardless of the live
|
|
# mirror. Snapshot is served over http:// on purpose (its TLS cert isn't in the
|
|
# base image's CA bundle; apt would silently fall back to the live mirror otherwise).
|
|
# All three chromium packages are pinned together — chromium depends on
|
|
# chromium-common/chromium-sandbox at the exact same version or apt errors.
|
|
RUN echo "deb [check-valid-until=no] http://snapshot.debian.org/archive/debian/20260620T000000Z/ bookworm main" > /etc/apt/sources.list \
|
|
&& echo "deb [check-valid-until=no] http://snapshot.debian.org/archive/debian-security/20260620T000000Z/ bookworm-security main" >> /etc/apt/sources.list \
|
|
&& echo "Acquire::Check-Valid-Until false;" > /etc/apt/apt.conf.d/99snapshot \
|
|
&& apt-get -o Acquire::Retries=3 update && apt-get install -y --no-install-recommends \
|
|
curl \
|
|
chromium=149.0.7827.155-1~deb12u1 \
|
|
chromium-common=149.0.7827.155-1~deb12u1 \
|
|
chromium-sandbox=149.0.7827.155-1~deb12u1 \
|
|
libatk-bridge2.0-0 \
|
|
libatk1.0-0 \
|
|
libcups2 \
|
|
libdbus-1-3 \
|
|
libdrm2 \
|
|
libgbm1 \
|
|
libgtk-3-0 \
|
|
libnss3 \
|
|
libxcomposite1 \
|
|
libxdamage1 \
|
|
libxfixes3 \
|
|
libxkbcommon0 \
|
|
libxrandr2 \
|
|
xdg-utils \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Tell Playwright to use the system Chromium instead of downloading its own
|
|
ENV PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1
|
|
ENV PLAYWRIGHT_CHROMIUM_EXECUTABLE_PATH=/usr/bin/chromium
|
|
|
|
WORKDIR /app
|
|
|
|
COPY package*.json ./
|
|
RUN npm ci
|
|
|
|
COPY . .
|
|
|
|
ARG APP_VERSION=dev
|
|
ENV APP_VERSION=$APP_VERSION
|
|
|
|
RUN npm run build
|
|
|
|
# Data directory — mount a volume here to persist the SQLite DB
|
|
RUN mkdir -p /data && chown node:node /data
|
|
ENV LINKI_DB_PATH=/data/linki.db
|
|
|
|
USER node
|
|
|
|
EXPOSE 3000
|
|
|
|
CMD ["npm", "start"]
|