feat(image): add Playwright CLI + Chromium to code agent sandbox#17
Merged
durandom merged 10 commits intoJul 15, 2026
Merged
Conversation
The e2e-fix agent needs these tools for nightly failure analysis: - gcloud CLI (pinned v526.0.0): downloads test artifacts from GCS buckets where Prow stores nightly/PR E2E results. Only the base SDK is installed (no extra components). Auth is runtime-only — no credentials baked into the image. - pwtrace (pinned v0.3.0): Playwright trace analysis CLI that lets agents inspect browser actions, DOM state, console errors, and network requests from failed test traces. Both are version-pinned for reproducible builds and installed under USER root before dropping back to sandbox. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
curl and python3 are already in the base image. Use dpkg --print-architecture instead of uname+sed for the download URL. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
subhashkhileri
force-pushed
the
feat/e2e-agent-tooling
branch
from
June 19, 2026 10:26
c9b5aab to
003ed32
Compare
subhashkhileri
changed the title
Replace the pwtrace npm package with the official Playwright CLI (1.59.1) and baked-in Chromium browser. pwtrace was a thin wrapper; the official `npx playwright trace` (added in Playwright 1.59) is the upstream equivalent with full feature parity. Most trace subcommands (actions, requests, console, errors) are pure Node.js JSON parsing and don't need a browser. But `trace snapshot` and `trace screenshot` launch headless Chromium to render frozen DOM snapshots, run accessibility tree queries, and capture screenshots — so the browser binary must be pre-installed. - PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1 prevents npm install auto-download - `npx playwright install chromium --with-deps` installs browser + apt deps - PLAYWRIGHT_BROWSERS_PATH=/opt/playwright-browsers for sandbox user access - Pinned to 1.59.1 matching the E2E test suite version Assisted-by: Claude Code Co-Authored-By: Claude Code
subhashkhileri
changed the title
Member
Author
|
/fs-review |
The workspace @playwright/test peer dep resolves to 1.61.1 which needs chromium_headless_shell-1228. The previous 1.59.1 installed v1217, causing "Executable doesn't exist" when running trace snapshot. Assisted-by: Claude Code Co-Authored-By: Claude Code
…bility OpenShell sandbox isolation hides /opt/ from the agent. Move browsers to /sandbox/playwright-browsers/ and symlink playwright binary to /sandbox/bin/ so both are accessible inside the sandbox. Assisted-by: Claude Code Co-Authored-By: Claude Code
…_PATH The symlink to /usr/bin/playwright was broken in the sandbox because OpenShell hides /usr/. npx playwright already respects the PLAYWRIGHT_BROWSERS_PATH env var to find chromium — no global binary needed. Assisted-by: Claude Code Co-Authored-By: Claude Code
…solation OpenShell mounts its own filesystem over /sandbox/ at sandbox creation, discarding any content our derived image adds there. /tmp/ is NOT mounted over, so content installed to /tmp/playwright-browsers/ persists into the sandbox. Verified: /tmp/corepack/ (from base image) is accessible in sandbox, confirming /tmp/ is preserved. Also adds /tmp/bin/playwright symlink for direct invocation. Assisted-by: Claude Code Co-Authored-By: Claude Code
Both /tmp and /sandbox survive from derived image layers, but /sandbox is more semantically appropriate for the sandbox user's space. Also removed the /tmp/bin symlink — /usr/bin/playwright (from npm install -g) is directly accessible in the sandbox. Assisted-by: Claude Code Co-Authored-By: Claude Code
OpenShell resets /sandbox during initialization, wiping derived-layer additions. /tmp survives reliably. Verified end-to-end. Assisted-by: Claude Code Co-Authored-By: Claude Code
subhashkhileri
changed the title
subhashkhileri
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds Playwright 1.61.1 + Chromium to the
rhdh-fullsend-codesandbox image for E2E failure debugging.Most trace CLI commands (
actions,requests,console,errors) are pure Node.js JSON parsing. Buttrace snapshotandtrace screenshotneed a real headless Chromium to render frozen DOM snapshots and run accessibility tree queries — the most powerful debugging commands for UI failures.Key decisions
npm install -g playwright) — binary lands at/usr/bin/playwright, directly accessible in the sandbox withoutnpx/tmp/playwright-browsers—/sandbox/(user home) is reset by OpenShell during sandbox init, wiping derived image layers./tmp/survives and is writable under the sandbox Landlock policyPLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1— prevents npm from auto-downloading during install;npx playwright install chromium --with-depshandles it explicitly so apt system deps are also installedTest plan
podman build --no-cache -t rhdh-fullsend-code:local -f images/code/Containerfile images/code/playwright --versionreturnsVersion 1.61.1playwright trace --helplistssnapshotandscreenshotsubcommands/tmp/playwright-browsers/playwright trace snapshotrenders frozen DOM without download errorsAssisted-by: Claude Code