From 346cc477a77831b16e4d5c28880ac7e4912f9d29 Mon Sep 17 00:00:00 2001 From: 0xallam Date: Sat, 25 Apr 2026 15:28:48 -0700 Subject: [PATCH] chore(image): drop sidecar/Playwright legacy + plug NO_PROXY hole MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Dockerfile carried forward three pieces of dead state from the pre-migration era: - ``/app/runtime`` and ``/app/tools`` mkdir entries — the FastAPI sidecar + in-container tool registry that those dirs hosted are gone. - ``/home/pentester/{configs,wordlists,output,scripts}`` — empty placeholders never populated by anything; greps for them in the whole repo come back empty. - ~20 explicit Chrome/Playwright runtime libs (``libnss3``, ``libnspr4``, ``libatk*``, ``libxcomposite1``, …) plus emoji / freefont packages. These were Playwright deps; the migration to ``agent-browser`` runs ``agent-browser install --with-deps`` which owns this list authoritatively. Keep ``libnss3-tools`` for ``certutil`` in the entrypoint's CA-trust step. Drive-by bug fix: ``NO_PROXY=localhost,127.0.0.1`` was set in the entrypoint (``/etc/profile.d/proxy.sh`` + ``/etc/environment``) but NOT in the SDK manifest's environment. ``docker exec``-spawned processes (which ``session.exec`` and the Shell capability use) inherit only manifest env, so ``agent-browser``'s CDP-localhost traffic was being looped back through Caido. Add it. Co-Authored-By: Claude Opus 4.7 (1M context) --- containers/Dockerfile | 12 +----------- strix/runtime/session_manager.py | 5 ++++- 2 files changed, 5 insertions(+), 12 deletions(-) diff --git a/containers/Dockerfile b/containers/Dockerfile index 18aeea3..45c3bf7 100644 --- a/containers/Dockerfile +++ b/containers/Dockerfile @@ -12,14 +12,7 @@ RUN useradd -m -s /bin/bash pentester && \ echo "pentester ALL=(ALL) NOPASSWD:ALL" >> /etc/sudoers && \ touch /home/pentester/.hushlogin -RUN mkdir -p /home/pentester/configs \ - /home/pentester/wordlists \ - /home/pentester/output \ - /home/pentester/scripts \ - /home/pentester/tools \ - /app/runtime \ - /app/tools \ - /app/certs && \ +RUN mkdir -p /home/pentester/tools /app/certs && \ chown -R pentester:pentester /app/certs /home/pentester/tools RUN apt-get update && \ @@ -39,9 +32,6 @@ RUN apt-get update && \ nodejs npm pipx \ libcap2-bin \ gdb \ - libnss3 libnspr4 libdbus-1-3 libatk1.0-0 libatk-bridge2.0-0 libcups2 libdrm2 libatspi2.0-0 \ - libxcomposite1 libxdamage1 libxfixes3 libxrandr2 libgbm1 libxkbcommon0 libpango-1.0-0 libcairo2 libasound2t64 \ - fonts-unifont fonts-noto-color-emoji fonts-freefont-ttf fonts-dejavu-core ttf-bitstream-vera \ libnss3-tools diff --git a/strix/runtime/session_manager.py b/strix/runtime/session_manager.py index 277092a..c4c48de 100644 --- a/strix/runtime/session_manager.py +++ b/strix/runtime/session_manager.py @@ -68,7 +68,9 @@ async def create_or_reuse( # Caido runs as an in-container sidecar; HTTP(S) traffic from any # process started via ``session.exec`` (the SDK's Shell tool, etc.) - # picks up these env vars automatically. + # picks up these env vars automatically. ``NO_PROXY`` keeps the + # agent-browser CDP daemon's localhost traffic from looping back + # through Caido. container_caido_url = f"http://127.0.0.1:{_CONTAINER_CAIDO_PORT}" manifest = Manifest( entries={"sources": LocalDir(src=sources_path)}, @@ -79,6 +81,7 @@ async def create_or_reuse( "http_proxy": container_caido_url, "https_proxy": container_caido_url, "ALL_PROXY": container_caido_url, + "NO_PROXY": "localhost,127.0.0.1", }, ), )