feat: myuser support for images

.gitattributes

@@ -0,0 +1,2 @@
+**/warn-myuser.sh linguist-generated
+scripts/warn-myuser.sh -linguist-generated

.github/actions/version-matrix/data/cache-states-beta.json

@@ -16,8 +16,8 @@
 		"hashEntries": "APIFY_VERSION=2.2.1;PYTHON_VERSION=3.9,3.10,3.11,3.12,3.13"
 	},
 	"python:playwright": {
-		"hash": "f1568eff432c27be9af509dacc11f7daa70881c7f8e0e53b5c01cf392ccfe5e1",
-		"hashEntries": "APIFY_VERSION=2.2.1;PLAYWRIGHT_VERSION=1.47.0,1.48.0,1.49.0,1.49.1,1.50.0;PYTHON_VERSION=3.9,3.10,3.11,3.12,3.13"
+		"hash": "db96247acb01cb5a585e9689433142693336c3b4038215f4b630366736c6df4a",
+		"hashEntries": "APIFY_VERSION=2.7.2;PLAYWRIGHT_VERSION=1.50.0,1.51.0,1.52.0,1.53.0,1.54.0;PYTHON_VERSION=3.9,3.10,3.11,3.12,3.13"
 	},
 	"python:selenium": {
 		"hash": "c6474bc43d1960f1d2867c774278e9d38dfdadda7070d42edc3c839043d8df20",

Makefile

@@ -19,6 +19,17 @@ ALL_TESTS = test-node test-playwright test-playwright-chrome test-playwright-fir
 ALL_NODE_TESTS = test-node test-playwright test-playwright-chrome test-playwright-firefox test-playwright-webkit test-puppeteer-chrome test-playwright-camoufox
 ALL_PYTHON_TESTS = test-python test-python-playwright test-python-selenium
 
+IMAGES_THAT_NEED_MYUSER_SCRIPT = node python python-playwright python-selenium
+
+copy-myuser-script:
+	chmod +x scripts/warn-myuser.sh
+
+	@for image in $(IMAGES_THAT_NEED_MYUSER_SCRIPT); do \
+		echo "Copying myuser script to $$image"; \
+		cp scripts/warn-myuser.sh $$image/warn-myuser.sh; \
+		chmod +x $$image/warn-myuser.sh; \
+	done
+
 what-tests:
 	@echo "Available tests:"
 	@for test in $(ALL_TESTS); do \

node/Dockerfile

@@ -1,21 +1,30 @@
-ARG NODE_VERSION=20
-FROM --platform=linux/amd64 node:${NODE_VERSION}-alpine
+ARG NODE_VERSION=22
+FROM node:${NODE_VERSION}-alpine
 
 LABEL maintainer="[email protected]" description="Base image for simple Apify Actors"
 
 # Globally disable the update-notifier.
-RUN npm config --global set update-notifier false
-
-# Create app directory
-RUN mkdir -p /usr/src/app
-WORKDIR /usr/src/app
+RUN npm config --global set update-notifier false \
+    # add user
+    && addgroup -S myuser \
+    && adduser -S -h /home/myuser -s /bin/sh -D myuser -G myuser \
+    && adduser myuser audio \
+    && adduser myuser video \
+    && mkdir -p /home/myuser/Downloads \
+    && chown -R myuser:myuser /home/myuser \
+    && mkdir -p /usr/src \
+    && ln -s /home/myuser /usr/src/app
+
+COPY warn-myuser.sh /build/warn-myuser.sh
+ONBUILD RUN /build/warn-myuser.sh node
+
+WORKDIR /home/myuser
 
 # Copy source code
-COPY package.json main.js /usr/src/app/
+COPY --chown=myuser:myuser package.json main.js .
 
 # Install default dependencies, print versions of everything
 RUN npm --quiet set progress=false \
-	&& npm config --global set update-notifier false \
 	&& npm install --omit=dev --omit=optional --no-package-lock --prefer-online \
 	&& echo "Installed NPM packages:" \
 	&& (npm list --omit=dev --omit=optional || true) \
@@ -36,4 +45,4 @@ ENV NODE_OPTIONS="--max_old_space_size=30000 --max-http-header-size=80000"
 # NOTEs:
 # - This needs to be compatible with CLI.
 # - Using CMD instead of ENTRYPOINT, to allow manual overriding
-CMD npm start --silent
+CMD ["npm", "start", "--silent"]

python-playwright/Dockerfile

@@ -2,7 +2,7 @@
 ARG PYTHON_VERSION
 
 # Extend from the latest Debian and its slim version to keep the image as small as possible
 FROM python:${PYTHON_VERSION}-slim-bookworm
 
 # Add labels to the image to identify it as an Apify Actor
 LABEL maintainer="[email protected]" \
@@ -35,13 +35,36 @@
 # Set up XVFB
 ENV XVFB_WHD=1920x1080x24+32
 
+ENV PLAYWRIGHT_BROWSERS_PATH=/pw-browsers
+
+COPY warn-myuser.sh /build/warn-myuser.sh
+ONBUILD RUN /build/warn-myuser.sh python
+
 # Install xvfb and xauth
 RUN apt update \
-    && apt install -y xvfb xauth --no-install-recommends \
-    && rm -rf /var/lib/apt/lists/* \
-    && rm -rf /src/*.deb \
-    && apt clean -y && apt autoremove -y \
-    && mkdir -p /tmp/.X11-unix && chmod 1777 /tmp/.X11-unix
+    && apt install -y xvfb xauth git procps curl wget --no-install-recommends \
+    # Install playwright browser dependencies
+    && python3 -m pip install --user playwright~=${PLAYWRIGHT_VERSION} \
+    && python3 -m playwright install-deps \
+    # Install browsers in a specific path
+    && python3 -m playwright install \
+    && python3 -m pip uninstall -y playwright \
+    && mkdir -p /tmp/.X11-unix && chmod 1777 /tmp/.X11-unix \
+    # Add user so we don't need --no-sandbox.
+    && groupadd -r myuser && useradd -r -g myuser -G audio,video myuser \
+    && mkdir -p /home/myuser/Downloads \
+    && chown -R myuser:myuser /home/myuser \
+    && mkdir -p /usr/src \
+    && chown -R myuser:myuser /usr/src \
+    && ln -s /home/myuser /usr/src/app \
+    # Clean up
+    && apt autoremove -yqq --purge \
+    && apt clean \
+    && rm -rf /var/lib/apt/lists/* /var/log/*
+
+WORKDIR /home/myuser
+
+ENV PATH="/home/myuser/.local/bin:$PATH"
 
 # This instruction:
 # - Upgrades pip to the latest version
@@ -54,14 +77,6 @@
     apify~=${APIFY_VERSION} \
     playwright~=${PLAYWRIGHT_VERSION}
 
-# Install Playwright and its dependencies
-RUN playwright install-deps && \
-    playwright install
-
-# Create app directory
-RUN mkdir -p /usr/src/app
-WORKDIR /usr/src/app
-
 # Copy the dummy source code to the image
 COPY . .
 

python-selenium/Dockerfile

@@ -2,7 +2,7 @@
 ARG PYTHON_VERSION
 
 # Extend from the latest Debian and its slim version to keep the image as small as possible
 FROM python:${PYTHON_VERSION}-slim-bookworm
 
 # Add labels to the image to identify it as an Apify Actor
 LABEL maintainer="[email protected]" \
@@ -35,9 +35,19 @@
 # Set up XVFB
 ENV XVFB_WHD=1920x1080x24+32
 
-# Install curl, firefox, jq, unzip, xvfb and dependencies of Chrome and its driver
-RUN apt update && \
-    apt install -y --no-install-recommends \
+COPY warn-myuser.sh /build/warn-myuser.sh
+ONBUILD RUN /build/warn-myuser.sh python
+
+# Setup the less privileged user
+RUN groupadd -r myuser && useradd -r -g myuser -G audio,video myuser \
+    && mkdir -p /home/myuser/Downloads \
+    && chown -R myuser:myuser /home/myuser \
+    && mkdir -p /usr/src \
+    && chown -R myuser:myuser /usr/src \
+    && ln -s /home/myuser /usr/src/app \
+    # Install curl, firefox, jq, unzip, xvfb and dependencies of Chrome and its driver
+    && apt update \
+    && apt install -y --no-install-recommends \
     ca-certificates \
     curl \
     firefox-esr \
@@ -69,10 +79,10 @@
     unzip \
     xdg-utils \
     xvfb \
-    xauth && \
-    apt autoremove -yqq --purge && \
-    apt clean && \
-    rm -rf /var/lib/apt/lists/* /var/log/*
+    xauth \
+    && apt autoremove -yqq --purge \
+    && apt clean \
+    && rm -rf /var/lib/apt/lists/* /var/log/*
 
 # Download and install Geckodriver
 RUN GECKO_DRIVER_URL="https://github.com/mozilla/geckodriver/releases/download/v0.33.0/geckodriver-v0.33.0-linux64.tar.gz" && \
@@ -100,6 +110,10 @@
     unzip /tmp/chromedriver-linux64.zip -d /usr/local/bin/ && \
     rm -f /tmp/chromedriver-linux64.zip
 
+WORKDIR /home/myuser
+
+ENV PATH="/home/myuser/.local/bin:$PATH"
+
 # This instruction:
 # - Upgrades pip to the latest version
 # - Preinstalls the latest versions of setuptools and wheel to improve package installation speed
@@ -111,10 +125,6 @@
     apify~=${APIFY_VERSION} \
     selenium~=${SELENIUM_VERSION}
 
-# Create app directory
-RUN mkdir -p /usr/src/app
-WORKDIR /usr/src/app
-
 # Copy the dummy source code to the image
 COPY . .
 

python/Dockerfile

@@ -2,7 +2,7 @@
 ARG PYTHON_VERSION
 
 # Extend from the latest Debian and its slim version to keep the image as small as possible
 FROM python:${PYTHON_VERSION}-slim-bookworm
 
 # Add labels to the image to identify it as an Apify Actor
 LABEL maintainer="[email protected]" \
@@ -29,6 +29,30 @@
 # Disable warnings about running pip as root
 ENV PIP_ROOT_USER_ACTION=ignore
 
+COPY warn-myuser.sh /build/warn-myuser.sh
+ONBUILD RUN /build/warn-myuser.sh python
+
+# Setup the less privileged user
+RUN apt update && \
+    apt install -y --no-install-recommends \
+    curl \
+    git \
+    procps \
+    wget \
+    && groupadd -r myuser && useradd -r -g myuser -G audio,video myuser \
+    && mkdir -p /home/myuser/Downloads \
+    && chown -R myuser:myuser /home/myuser \
+    && mkdir -p /usr/src \
+    && chown -R myuser:myuser /usr/src \
+    && ln -s /home/myuser /usr/src/app \
+    && apt autoremove -yqq --purge \
+    && apt clean \
+    && rm -rf /var/lib/apt/lists/* /var/log/*
+
+WORKDIR /home/myuser
+
+ENV PATH="/home/myuser/.local/bin:$PATH"
+
 # This instruction:
 # - Upgrades pip to the latest version
 # - Preinstalls the latest versions of setuptools and wheel to improve package installation speed
@@ -39,10 +63,6 @@
     wheel \
     apify~=${APIFY_VERSION}
 
-# Create app directory
-RUN mkdir -p /usr/src/app
-WORKDIR /usr/src/app
-
 # Copy the dummy source code to the image
 COPY . .