feat(docker): browser desktop image (Selkies Wayland + headed camofox) and optional TLS proxy

Selkies baseimage (debiantrixie, digest-pinned) with camofox 1.17.0 copied
from camofox-browser:1.17.0, run headed under labwc so the desktop shows the
same Firefox the agent drives. s6 service waits for wayland-0 and depends on
svc-de and svc-dbus so shutdown persists login state. Selkies control/view
passwords derive from CAMOFOX_ACCESS_KEY. Compose defaults to the new image;
CAMOFOX_IMAGE=camofox-browser:1.17.0 switches back. Optional caddy (profile tls).

Co-Authored-By: Claude Opus 5.5 <[email protected]>

docker-compose.yml

@@ -33,25 +33,27 @@ services:
     stop_grace_period: 30s
     logging: *logging
 
-  # camofox-browser(jo-inc/camofox-browser v1.17.0,commit 389c996):上游不发布镜像,按锁定的 tag 从源码构建
+  # 浏览器服务:camofox-browser(jo-inc v1.17.0,commit 389c996)。缺省镜像 = 浏览器桌面(docker/browser-desktop:
-  # (docker/camofox/Dockerfile,修了上游 v1.17.0 Dockerfile 的构建错误)。本机已有同名镜像时 `up` 不会重新构建。
+  # linuxserver baseimage-selkies Wayland 桌面 + 有头 camofox,原站视图"桌面模式"看到的就是 Agent 驱动的同一个 Firefox);
+  # 它从旧镜像 camofox-browser:1.17.0(docker/camofox)复制 camofox,所以要先有旧镜像(见 docs/runbook/browser.md §1.1、§8)。
+  # 切回旧的纯截图镜像:CAMOFOX_IMAGE=camofox-browser:1.17.0(同一个卷,登录状态通用;原站视图自动回退截图模式)。
+  # 端口一律不映射:9377(camofox API)与 3000(Selkies)只给 app;桌面画面只经 app 的 /api/v1/browser/desktop/* 反代。
   camofox:
     build:
-      context: docker/camofox
+      context: docker/browser-desktop
-      additional_contexts:
-        upstream: https://github.com/jo-inc/camofox-browser.git#v1.17.0
       args:
         APT_MIRROR: ${APT_MIRROR:-}
-    image: ${CAMOFOX_IMAGE:-camofox-browser:1.17.0}
+    image: ${CAMOFOX_IMAGE:-umt-browser-desktop:1.17.0}
     restart: unless-stopped
     deploy:
       # 0 = 不起浏览器服务(同时设 BROWSER_ENABLED=false)
       replicas: ${CAMOFOX_REPLICAS:-1}
     environment:
       CAMOFOX_PORT: "9377"
-      # 设置后除 /health 外全部接口要求 Authorization: Bearer <key>;app 用同一个值
+      # 设置后除 /health 外全部接口要求 Authorization: Bearer <key>;app 用同一个值。
+      # 桌面镜像还用它派生 Selkies 的控制 / 只读口令(app 用同一算法注入),不设则桌面模式不可用
       CAMOFOX_ACCESS_KEY: ${CAMOFOX_ACCESS_KEY:-}
-      # 登录状态(cookies + localStorage)按 userId 存 /root/.camofox/profiles,随卷持久化
+      # 登录状态(cookies + localStorage)按 userId 存这里,随卷持久化(两个镜像同一路径)
       CAMOFOX_PROFILE_DIR: /root/.camofox/profiles
       # 上游缺省把崩溃报告发到它的中继服务;这里关掉
       CAMOFOX_CRASH_REPORT_ENABLED: "false"
@@ -63,18 +65,71 @@ services:
       MAX_SESSIONS: ${CAMOFOX_MAX_SESSIONS:-8}
       CAMOFOX_LOCALE: ${CAMOFOX_LOCALE:-}
       CAMOFOX_TIMEZONE: ${CAMOFOX_TIMEZONE:-}
+      # ── 以下只对桌面镜像生效(旧镜像忽略)──
+      TZ: ${TZ:-Asia/Shanghai}
+      # 桌面里浏览器进程的运行用户(登录状态目录启动时 chown 给它)
+      PUID: ${CAMOFOX_PUID:-1000}
+      PGID: ${CAMOFOX_PGID:-1000}
+      TITLE: 原站视图
+      # 分辨率锁定(浏览器窗口最大化铺满,无标题栏);DPI 锁 96 保证 DPR = 1
+      SELKIES_MANUAL_WIDTH: ${BROWSER_DESKTOP_WIDTH:-1280}
+      SELKIES_MANUAL_HEIGHT: ${BROWSER_DESKTOP_HEIGHT:-900}
+      SELKIES_SCALING_DPI: "96|locked"
+      # 纯 CPU 编码:帧率上限 30;有 GPU 时挂 /dev/dri 自动启用硬编
+      SELKIES_FRAMERATE: ${BROWSER_DESKTOP_FRAMERATE:-24,8-30}
+      # 只允许文本剪贴板;音频、麦克风、摄像头、手柄、文件传输、打印、命令、共享一律关闭
+      SELKIES_ENABLE_BINARY_CLIPBOARD: "false|locked"
+      SELKIES_AUDIO_ENABLED: "false|locked"
+      SELKIES_MICROPHONE_ENABLED: "false|locked"
+      SELKIES_WEBCAM_ENABLED: "false|locked"
+      SELKIES_GAMEPAD_ENABLED: "false|locked"
+      SELKIES_FILE_TRANSFERS: ""
+      SELKIES_PRINTING_ENABLED: "false|locked"
+      SELKIES_COMMAND_ENABLED: "false|locked"
+      SELKIES_ENABLE_SHARING: "false|locked"
+      SELKIES_UI_SIDEBAR_SHOW_FILES: "false"
+      SELKIES_UI_SIDEBAR_SHOW_APPS: "false"
+      SELKIES_UI_SIDEBAR_SHOW_SHARING: "false"
+      SELKIES_UI_SIDEBAR_SHOW_GAMEPADS: "false"
+      SELKIES_UI_SIDEBAR_SHOW_WEBCAM: "false"
+      SELKIES_UI_SIDEBAR_SHOW_AUDIO_SETTINGS: "false"
+      # 容器内输入法(备选;缺省用访问者本机输入法):fcitx5 = 启动 fcitx5(拼音 + mozc,Ctrl+Space 切换)
+      UMT_DESKTOP_IME: ${BROWSER_DESKTOP_IME:-}
     volumes:
       - umt-camofox:/root/.camofox
     # Firefox 多进程需要较大的 /dev/shm(上游 Makefile 用 2g)
     shm_size: 2gb
-    mem_limit: ${CAMOFOX_MEM_LIMIT:-2g}
+    # 桌面镜像另有 labwc + Selkies + nginx 常驻(实测见 runbook §8);纯截图旧镜像 2g 足够
+    mem_limit: ${CAMOFOX_MEM_LIMIT:-3g}
     healthcheck:
       test: ["CMD", "curl", "-fsS", "-o", "/dev/null", "http://127.0.0.1:9377/health"]
       interval: 30s
       timeout: 5s
       start_period: 30s
       retries: 3
-    stop_grace_period: 20s
+    # 桌面镜像由 s6 逐级停止,camofox 关机要落盘登录状态
+    stop_grace_period: 30s
+    logging: *logging
+
+  # 可选 HTTPS 入口(profile tls):桌面模式的视频解码(WebCodecs)与剪贴板只在 HTTPS(或 localhost)下可用。
+  # 已有反代(nginx / Caddy / Traefik)终结 TLS 时不需要它。配置见 docker/browser-desktop/Caddyfile:
+  #   TLS_DOMAIN 不设 = 自签(Caddy 内部 CA);TLS_DOMAIN=域名 + TLS_ISSUER=邮箱 = ACME 自动证书
+  #   docker compose --profile tls up -d
+  caddy:
+    image: caddy:2-alpine
+    profiles: ["tls"]
+    restart: unless-stopped
+    depends_on:
+      - app
+    environment:
+      # 空 = https://(任意主机名,自签按需签发)
+      TLS_DOMAIN: ${TLS_DOMAIN:-https://}
+      TLS_ISSUER: ${TLS_ISSUER:-internal}
+    ports:
+      - "${TLS_BIND:-0.0.0.0}:${TLS_PORT:-443}:443"
+    volumes:
+      - ./docker/browser-desktop/Caddyfile:/etc/caddy/Caddyfile:ro
+      - umt-caddy:/data
     logging: *logging
 
   app:
@@ -110,6 +165,8 @@ services:
       BROWSER_PROVIDER_URL: ${BROWSER_PROVIDER_URL:-http://camofox:9377}
       BROWSER_ACCESS_KEY: ${BROWSER_ACCESS_KEY:-${CAMOFOX_ACCESS_KEY:-}}
       BROWSER_ENABLED: ${BROWSER_ENABLED:-true}
+      # 原站视图桌面模式的上游(桌面镜像的 Selkies);缺省由 BROWSER_PROVIDER_URL 推出(端口换 3000)
+      BROWSER_DESKTOP_URL: ${BROWSER_DESKTOP_URL:-}
     ports:
       - "${UMT_BIND:-0.0.0.0}:${UMT_PORT:-4380}:4380"
     volumes:
@@ -125,6 +182,7 @@ volumes:
   umt-pg-data:
   umt-data:
   umt-camofox:
+  umt-caddy:
 
 networks:
   # 固定网段(属于 172.16.0.0/12),便于宿主防火墙按网段放行容器到宿主的代理/中继端口

docker/browser-desktop/Caddyfile

@@ -0,0 +1,20 @@
+# 可选 HTTPS 入口(docker-compose.yml 的 caddy 服务,profile tls;docs/runbook/browser.md §8.4)。
+# 桌面模式的视频解码(WebCodecs)与剪贴板只在安全上下文(HTTPS 或 localhost)可用。
+#   TLS_DOMAIN 未设:自签(Caddy 内部 CA,按访问的主机名 / IP 现场签发),浏览器需手动放行或导入根证书
+#                    (容器内 /data/caddy/pki/authorities/local/root.crt)
+#   TLS_DOMAIN=media.example.com + [email protected]:ACME 自动申请(80/443 需公网可达)
+# TLS_UPSTREAM:反代目标,缺省 app:4380(app 不在同一 compose 网络时改)
+{
+	auto_https disable_redirects
+}
+
+{$TLS_DOMAIN:https://} {
+	tls {$TLS_ISSUER:internal} {
+		on_demand
+	}
+	encode zstd gzip
+	reverse_proxy {$TLS_UPSTREAM:app:4380} {
+		# SSE 与桌面 WebSocket 不缓冲
+		flush_interval -1
+	}
+}

docker/browser-desktop/Dockerfile

@@ -0,0 +1,64 @@
+# 浏览器桌面镜像(原站视图桌面模式,docs/design/webtop-remote-browser.md、docs/runbook/browser.md §8):
+# linuxserver baseimage-selkies(Webtop 4.0 的底座:pixelflux + labwc Wayland 桌面 + Selkies Web 客户端)
+# + camofox-browser 1.17.0 以有头模式跑在同一个 Wayland 会话里 → 桌面上看到的就是 Agent 驱动的那个 Firefox。
+#
+# camofox 部分不重新下载:直接从旧镜像 camofox-browser:1.17.0(docker/camofox/Dockerfile 构建)复制
+# node、/app 与 Camoufox 浏览器包,两个镜像的 camofox 完全一致,可随时用 CAMOFOX_IMAGE 切回旧镜像。
+# 手工构建:
+#   docker build -t camofox-browser:1.17.0 --build-context upstream=… docker/camofox     # 先有旧镜像
+#   docker build -t umt-browser-desktop:1.17.0 docker/browser-desktop
+ARG CAMOFOX_BASE=camofox-browser:1.17.0
+# baseimage-selkies debiantrixie(Selkies 2.x、labwc 0.8.3,已含 fonts-noto-cjk);按 digest 锁定,升级需重新核验
+ARG SELKIES_BASE=ghcr.io/linuxserver/baseimage-selkies:debiantrixie@sha256:f3ca0b10e923a603941a996ea1c3356b9527cc53163259f4e836f61fd4523e12
+
+FROM ${CAMOFOX_BASE} AS camofox
+
+FROM ${SELKIES_BASE}
+
+ARG APT_MIRROR=
+# 1 = 装容器内输入法 fcitx5(拼音 + mozc,缺省装;是否启动由运行时 UMT_DESKTOP_IME=fcitx5 决定)
+ARG WITH_FCITX5=1
+
+RUN if [ -n "$APT_MIRROR" ]; then sed -i "[email protected]@${APT_MIRROR}@g" /etc/apt/sources.list.d/debian.sources; fi \
+  && apt-get update \
+  && apt-get install -y --no-install-recommends \
+    libdbus-glib-1-2 libxt6t64 libasound2t64 libx11-xcb1 libxcomposite1 libxcursor1 libxdamage1 libxfixes3 \
+    libxi6 libxrandr2 libxrender1 libxss1 libxtst6 libegl1 libgl1-mesa-dri libgbm1 \
+    fonts-noto-cjk fonts-noto-cjk-extra fonts-noto-color-emoji fontconfig \
+  && if [ "$WITH_FCITX5" = "1" ]; then \
+       apt-get install -y --no-install-recommends \
+         fcitx5 fcitx5-chinese-addons fcitx5-mozc fcitx5-frontend-gtk3 fcitx5-config-qt- ; \
+     fi \
+  && apt-get clean && rm -rf /var/lib/apt/lists/* /tmp/*
+
+COPY --from=camofox /usr/local/bin/node /usr/local/bin/node
+COPY --from=camofox /app /opt/camofox
+COPY --from=camofox /root/.cache/camoufox /opt/camoufox
+COPY root/ /
+
+LABEL org.opencontainers.image.title="umt-browser-desktop" \
+      org.opencontainers.image.description="camofox-browser 1.17.0 (headed, Wayland) on linuxserver baseimage-selkies" \
+      org.opencontainers.image.version="1.17.0"
+
+ENV CAMOUFOX_INSTALL_DIR=/opt/camoufox \
+    NODE_ENV=production \
+    CAMOFOX_PORT=9377 \
+    CAMOFOX_INTERACTIVE=desktop \
+    MOZ_ENABLE_WAYLAND=1 \
+    PIXELFLUX_WAYLAND=true \
+    START_DOCKER=false \
+    NO_GAMEPAD=true \
+    NO_WEBCAM=true \
+    CUSTOM_USER=umt \
+    TITLE="原站视图" \
+    NO_DECOR=true \
+    HARDEN_DESKTOP=true \
+    HARDEN_OPENBOX=true \
+    # HARDEN_OPENBOX 缺省会开 RESTART_APP(看门狗每秒重跑 autostart);浏览器由 svc-camofox 管,不需要
+    RESTART_APP=false \
+    SELKIES_ENABLE_BASIC_AUTH=true \
+    # s6 停服务的宽限:camofox 关机要落盘登录状态(缺省 3 秒不够)
+    S6_SERVICES_GRACETIME=25000 \
+    S6_KILL_GRACETIME=5000
+
+EXPOSE 3000 9377

docker/browser-desktop/root/defaults/autostart_wayland

@@ -0,0 +1,6 @@
+#!/bin/sh
+# labwc autostart(UMT 浏览器桌面):不自启应用;浏览器窗口由 svc-camofox(camofox-browser)按会话打开。
+# 容器内输入法是备选(缺省用访问者本机输入法,由 Selkies 注入上屏文本);UMT_DESKTOP_IME=fcitx5 时启用
+if [ "$UMT_DESKTOP_IME" = "fcitx5" ] && command -v fcitx5 >/dev/null 2>&1; then
+  fcitx5 -d --replace >/dev/null 2>&1 &
+fi

docker/browser-desktop/root/etc/s6-overlay/s6-rc.d/init-umt-desktop/run

@@ -0,0 +1,30 @@
+#!/usr/bin/with-contenv bash
+# UMT 浏览器桌面:在 linuxserver 的 init-selkies-config 之后、Selkies/桌面启动之前执行(root)。
+# 1) Selkies 双口令:由 CAMOFOX_ACCESS_KEY 经 HMAC 派生(app 用同一算法),不另设密钥;
+# 2) labwc autostart 每次覆盖(只起可选 fcitx5,不起终端等其它应用);
+# 3) 登录状态目录(与旧 camofox 镜像同一个卷 /root/.camofox)交给运行用户 abc。
+set -e
+ENVDIR=/run/s6/container_environment
+derive() { printf '%s' "$1" | openssl dgst -sha256 -hmac "$CAMOFOX_ACCESS_KEY" -r | cut -c1-48; }
+if [ -n "${CAMOFOX_ACCESS_KEY}" ]; then
+  printf '%s' "$(derive umt-desktop/control)" > "$ENVDIR/SELKIES_BASIC_AUTH_PASSWORD"
+  printf '%s' "$(derive umt-desktop/view)" > "$ENVDIR/SELKIES_BASIC_AUTH_VIEWONLY_PASSWORD"
+else
+  echo "[umt-desktop] CAMOFOX_ACCESS_KEY 未设置:桌面口令随机生成,app 无法接入桌面模式(原站视图回退截图模式)"
+  printf '%s' "$(openssl rand -hex 24)" > "$ENVDIR/SELKIES_BASIC_AUTH_PASSWORD"
+  printf '%s' "$(openssl rand -hex 24)" > "$ENVDIR/SELKIES_BASIC_AUTH_VIEWONLY_PASSWORD"
+fi
+# 口令只经 Selkies 自己的 basic auth 校验;nginx 层不开(设 PASSWORD 会让 nginx 只认单口令,拦掉只读口令)
+printf 'true' > "$ENVDIR/SELKIES_ENABLE_BASIC_AUTH"
+rm -f "$ENVDIR/PASSWORD" "$ENVDIR/PASSWD"
+
+LABWC_DIR="$HOME/.config/labwc"
+mkdir -p "$LABWC_DIR"
+cp /defaults/autostart_wayland "$LABWC_DIR/autostart"
+chown root:abc "$LABWC_DIR/autostart"
+chmod 550 "$LABWC_DIR/autostart"
+
+PROFILE_ROOT="$(dirname "${CAMOFOX_PROFILE_DIR:-/root/.camofox/profiles}")"
+mkdir -p "${CAMOFOX_PROFILE_DIR:-/root/.camofox/profiles}"
+chown -R abc:abc "$PROFILE_ROOT"
+chmod 711 /root

docker/browser-desktop/root/etc/s6-overlay/s6-rc.d/init-umt-desktop/type

@@ -0,0 +1 @@
+oneshot

docker/browser-desktop/root/etc/s6-overlay/s6-rc.d/init-umt-desktop/up

@@ -0,0 +1 @@
+/etc/s6-overlay/s6-rc.d/init-umt-desktop/run

docker/browser-desktop/root/etc/s6-overlay/s6-rc.d/svc-camofox/run

@@ -0,0 +1,17 @@
+#!/usr/bin/with-contenv bash
+# camofox-browser 以有头模式跑在 labwc(应用合成器 wayland-0)里:桌面画面上的窗口就是 Agent 驱动的同一个 Firefox 进程。
+SOCKET_PATH="${XDG_RUNTIME_DIR}/wayland-0"
+until [ -e "${SOCKET_PATH}" ]; do sleep 0.5; done
+export WAYLAND_DISPLAY=wayland-0
+export DISPLAY=:0
+export MOZ_ENABLE_WAYLAND="${MOZ_ENABLE_WAYLAND:-1}"
+export CAMOFOX_INTERACTIVE=desktop
+if [[ "${UMT_DESKTOP_IME,,}" == "fcitx5" ]]; then
+  # Wayland 下 Firefox 经 text-input-v3 接 fcitx5;不要设 GTK_IM_MODULE(会绕过 text-input-v3)
+  export XMODIFIERS=@im=fcitx
+fi
+# Selkies 的手柄/摄像头 LD_PRELOAD 不给浏览器
+unset LD_PRELOAD
+cd /opt/camofox
+# exec:SIGTERM 直达 node,持久化插件关机落盘(docker/camofox/Dockerfile 同样的教训)
+exec s6-setuidgid abc node --max-old-space-size="${MAX_OLD_SPACE_SIZE:-128}" server.js

docker/browser-desktop/root/etc/s6-overlay/s6-rc.d/svc-camofox/timeout-finish

@@ -0,0 +1 @@
+25000

docker/browser-desktop/root/etc/s6-overlay/s6-rc.d/svc-camofox/type

@@ -0,0 +1 @@
+longrun

docker/compose.env.example

@@ -29,7 +29,8 @@ LOG_LEVEL=info
 
 # ── 浏览器服务(camofox-browser,原站视图 / Agent 浏览器能力;docs/runbook/browser.md)──
 # 缺省随 compose 起一个 camofox 容器(只在内网,不映射端口),app 自动登记为 camofox-env。
-# 访问凭据:camofox 与 app 共用;建议设置(openssl rand -hex 24)
+# 缺省镜像是浏览器桌面(原站视图桌面模式,docker/browser-desktop);要先有 camofox-browser:1.17.0(runbook browser.md §1.1)。
+# 访问凭据:camofox 与 app 共用;建议设置(openssl rand -hex 24)。桌面模式的控制 / 只读口令也由它派生,不设则桌面模式不可用
 CAMOFOX_ACCESS_KEY=
 # 接自有 camofox 实例:改成它的地址与凭据,并把 CAMOFOX_REPLICAS 设 0
 # BROWSER_PROVIDER_URL=http://camofox:9377
@@ -41,6 +42,29 @@ CAMOFOX_ACCESS_KEY=
 # CAMOFOX_SESSION_TIMEOUT_MS=1800000
 # CAMOFOX_BROWSER_IDLE_TIMEOUT_MS=300000
 # CAMOFOX_MAX_SESSIONS=8
-# CAMOFOX_MEM_LIMIT=2g
+# CAMOFOX_MEM_LIMIT=3g
 # CAMOFOX_LOCALE=zh-CN
 # CAMOFOX_TIMEZONE=Asia/Shanghai
+
+# ── 原站视图桌面模式(docs/runbook/browser.md §8)──
+# 只要截图模式:改回纯截图镜像(同一个卷,登录状态通用)
+# CAMOFOX_IMAGE=camofox-browser:1.17.0
+# 桌面分辨率与帧率(纯 CPU 编码,持续滚动约占 1 核)
+# BROWSER_DESKTOP_WIDTH=1280
+# BROWSER_DESKTOP_HEIGHT=900
+# BROWSER_DESKTOP_FRAMERATE=24,8-30
+# 容器内输入法(备选;缺省用访问者本机输入法):fcitx5
+# BROWSER_DESKTOP_IME=
+# 桌面浏览器进程的运行用户
+# CAMOFOX_PUID=1000
+# CAMOFOX_PGID=1000
+# 桌面上游地址(缺省由 BROWSER_PROVIDER_URL 推出,端口换 3000)
+# BROWSER_DESKTOP_URL=http://camofox:3000
+
+# ── HTTPS(可选,compose profile tls;桌面模式的视频解码与剪贴板需要 HTTPS)──
+# docker compose --profile tls up -d
+# 不设 TLS_DOMAIN = 自签(Caddy 内部 CA);设域名 + TLS_ISSUER=邮箱 = ACME 自动证书
+# TLS_DOMAIN=media.example.com
+# [email protected]
+# TLS_PORT=443
+# TLS_BIND=0.0.0.0