mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-09-21 14:22:14 +03:00
b97bc59f4f
Merged as part of the owner batch of 2026-09-11. This PR had a live worktree in another session, so it sat outside the main 39. Merged on your explicit call, validated first rather than taken on trust: boarded with the other 10 worktree-held PRs into a consolidated worktree off `release/v3.8.51`. - ESLint over every changed file: no errors - `typecheck:core` clean; `check:dashboard-typecheck` OK; `check:changelog-integrity` OK - complexity 2821 / baseline 3218 and cognitive-complexity 1272 / baseline 1437 - 203 of 208 assertions green. The 5 remaining (`guide-settings-route` ×4, `hard-session-lease-bypass-inventory` ×1) reproduce on the pure tip with nothing from this batch applied. - `imageGeneration.ts` rebaselined 3259 → 3293 for #12945's image-only-model guard, landed separately in #13392 so nothing was pushed onto a live branch. ⚠️ base-red inherited: #12732 — provider count 356 vs 358 and `open-sse/utils/stream.ts` 3115 > frozen 3098, both reproducing on the pure tip.
33 lines
1.8 KiB
Docker
33 lines
1.8 KiB
Docker
# OmniRoute persistent VNC login browser.
|
|
#
|
|
# Extends linuxserver/chromium, which ships Chromium + a noVNC-style web UI on
|
|
# port 3000 (Selkies) and a persistent profile dir at /config. We add:
|
|
# - CHROME_CLI flags so the *visible* browser also opens a DevTools port, and
|
|
# - a small in-container TCP bridge (cdp-bridge.py) that republishes
|
|
# Chromium's loopback CDP (127.0.0.1:9222) onto 0.0.0.0:9223, because
|
|
# Chrome 150 ignores --remote-debugging-address and binds loopback only.
|
|
# The OmniRoute server harvests cookies over the host-mapped 9223.
|
|
#
|
|
# SECURITY (#12571): 9223 is gated by a per-session shared secret
|
|
# (CDP_BRIDGE_TOKEN, injected via `-e` by src/lib/vncSession/service.ts) that
|
|
# every caller must present as an `X-Omni-Cdp-Token` header before the bridge
|
|
# forwards a single byte to Chromium — see cdp-bridge.py for the check. The
|
|
# container also runs on a dedicated Docker network (not the default bridge)
|
|
# so sibling containers can't reach 9223 either. Do not remove either control
|
|
# or the CDP bridge reverts to an unauthenticated, full-session-takeover proxy.
|
|
#
|
|
# Alpine/Debian package mirrors are unreachable from the build sandbox, so we
|
|
# extend a prebuilt image rather than apt/apk-installing anything.
|
|
FROM linuxserver/chromium:latest
|
|
|
|
COPY cdp-bridge.py /usr/local/bin/cdp-bridge.py
|
|
COPY svc-de-run /etc/s6-overlay/s6-rc.d/svc-de/run
|
|
RUN chmod +x /usr/local/bin/cdp-bridge.py /etc/s6-overlay/s6-rc.d/svc-de/run
|
|
|
|
# 3000 = noVNC web UI (base), 9222 = Chromium CDP loopback (base),
|
|
# 9223 = bridged CDP on all interfaces (ours).
|
|
EXPOSE 3000 9222 9223
|
|
|
|
# The base launches the visible browser via ${CHROME_CLI}; we add the CDP port.
|
|
ENV CHROME_CLI="--remote-debugging-port=9222 --no-first-run --no-default-browser-check --disable-background-networking"
|