From 1d30a88a8453550f8ee38e2121cc5ff425bfcce0 Mon Sep 17 00:00:00 2001
From: swibrow <15628653+swibrow@users.noreply.github.com>
Date: Wed, 29 Jul 2026 22:24:06 +0200
Subject: [PATCH] feat(actions-runner): bake in headless Chromium libs for
 Playwright suites

Playwright workflows on ARC runners fail at `playwright install
--with-deps`: it escalates to root to apt-install Chromium's system
libraries, and this image is rootless with no sudo (su: Authentication
failure). Baking the libraries in lets workflows run a plain
`playwright install chromium` as the runner user.

The package list is Playwright 1.62.0's nativeDeps for ubuntu24.04
(identical on arm64), minus xvfb and the xfonts-* server fonts that
only headed X11 mode needs. The font packages stay so screenshot
suites render emoji and CJK text instead of tofu boxes.

Signed-off-by: swibrow <15628653+swibrow@users.noreply.github.com>
---
 images/actions-runner/Dockerfile    | 38 +++++++++++++++++++++++++++++
 images/actions-runner/metadata.yaml |  4 +--
 2 files changed, 40 insertions(+), 2 deletions(-)

diff --git a/images/actions-runner/Dockerfile b/images/actions-runner/Dockerfile
index f82b465..50ef229 100644
--- a/images/actions-runner/Dockerfile
+++ b/images/actions-runner/Dockerfile
@@ -21,14 +21,52 @@ ENV DEBIAN_FRONTEND=noninteractive \
 
 # libatomic1: the Node that actions/setup-node installs links libatomic.so.1
 # tmux: workflows that drive a real tmux session
+#
+# The lib*/fonts-* block is headless Chromium's runtime for Playwright suites:
+# `playwright install --with-deps` escalates to root for these and this image
+# is rootless (su: Authentication failure), so they are baked in instead and
+# workflows run plain `playwright install chromium`. List taken from
+# Playwright 1.62.0 nativeDeps ubuntu24.04 (same set on arm64), minus xvfb and
+# the xfonts-* server fonts that only headed X11 mode needs. The fonts stay:
+# screenshot suites need emoji and CJK fallbacks to render, not tofu boxes.
 RUN apt-get update \
     && apt-get install -y --no-install-recommends \
         ca-certificates \
         curl \
+        fonts-freefont-ttf \
+        fonts-ipafont-gothic \
+        fonts-liberation \
+        fonts-noto-color-emoji \
+        fonts-tlwg-loma-otf \
+        fonts-unifont \
+        fonts-wqy-zenhei \
         git \
         git-lfs \
         jq \
+        libasound2t64 \
+        libatk-bridge2.0-0t64 \
+        libatk1.0-0t64 \
         libatomic1 \
+        libatspi2.0-0t64 \
+        libcairo2 \
+        libcups2t64 \
+        libdbus-1-3 \
+        libdrm2 \
+        libfontconfig1 \
+        libfreetype6 \
+        libgbm1 \
+        libglib2.0-0t64 \
+        libnspr4 \
+        libnss3 \
+        libpango-1.0-0 \
+        libx11-6 \
+        libxcb1 \
+        libxcomposite1 \
+        libxdamage1 \
+        libxext6 \
+        libxfixes3 \
+        libxkbcommon0 \
+        libxrandr2 \
         tmux \
         unzip \
         zstd \
diff --git a/images/actions-runner/metadata.yaml b/images/actions-runner/metadata.yaml
index 4d1ba42..6205d06 100644
--- a/images/actions-runner/metadata.yaml
+++ b/images/actions-runner/metadata.yaml
@@ -7,8 +7,8 @@ description: GitHub Actions runner for Actions Runner Controller, with docker CL
 # tracks upstream on RUNNER_VERSION in the Dockerfile — deliberately not
 # annotated here, since a -N suffix is a semver pre-release and would be
 # "upgraded" straight back to the bare release.
-version: 2.336.0-1
+version: 2.336.0-2
 platforms:
   - linux/amd64
   - linux/arm64
-test: /home/runner/bin/Runner.Listener --version && tmux -V && docker --version && docker buildx version && dpkg -s libatomic1 >/dev/null && test "$LANG" = C.UTF-8 && id -nG | grep -qw docker
+test: /home/runner/bin/Runner.Listener --version && tmux -V && docker --version && docker buildx version && dpkg -s libatomic1 libnss3 libgbm1 fonts-noto-color-emoji >/dev/null && test "$LANG" = C.UTF-8 && id -nG | grep -qw docker