# Browser sandbox: one container per running tutorial.
# Build (as the cPanel user):  podman build -t tutorial-sandbox:latest sandbox/
#   or with Docker:            docker build -t tutorial-sandbox:latest sandbox/
FROM docker.io/library/debian:bookworm-slim

ENV DEBIAN_FRONTEND=noninteractive \
    DISPLAY=:1 \
    SCREEN_W=1920 SCREEN_H=1080 DEVICE_SCALE=1.25

RUN apt-get update && apt-get install -y --no-install-recommends \
        chromium xvfb x11-utils xdotool imagemagick ffmpeg \
        x11vnc novnc websockify \
        fonts-noto fonts-noto-color-emoji fonts-liberation fonts-dejavu-core \
        curl procps ca-certificates \
    && rm -rf /var/lib/apt/lists/*

# Chrome policies: no password manager / autofill prompts, no sign-in, no translate bar.
COPY chromium-policy.json /etc/chromium/policies/managed/tutorial.json
COPY start.sh /usr/local/bin/start.sh
RUN chmod +x /usr/local/bin/start.sh \
    && useradd -m -u 1000 app \
    && mkdir -p /profile /recordings && chmod 777 /profile /recordings

# Default user; at runtime the worker maps the container to the cPanel account's own uid.
USER app
WORKDIR /tmp
EXPOSE 6080
CMD ["/usr/local/bin/start.sh"]
