The login browser is real Chrome - #276
Merged
Merged
Conversation
The login browser ran Playwright's bundled Chromium (shipped as Chrome for Testing). Its client hints report the `Chromium` brand while the user-agent string claims `Chrome`, and a login gate reads that split. Install real Google Chrome and launch it through Playwright's `chrome` channel, so the browser presents Chrome's fingerprint. Google ships no arm64 Linux build, so Chrome is amd64-only; session-launch falls back to the bundled chromium where Chrome is absent. Honor TZ on the container, so the browser's timezone can be aligned with the login egress.
czpython
force-pushed
the
eng-browser-real-chrome
branch
from
August 17, 2026 16:53
f2d2d78 to
1140ba4
Compare
czpython
changed the title
The sandbox and browser images publish only on push to main, and the two pull-request workflows watch backend and frontend paths, so a change under deploy/ reached main with nothing having built it. Add a pull-request workflow that builds both images (amd64, no push) when their contexts change, so a broken Dockerfile fails the PR rather than the deploy.
czpython
enabled auto-merge (squash)
August 17, 2026 17:12
czpython
disabled auto-merge
August 17, 2026 17:15
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The login browser ran Playwright's bundled Chromium, which ships as Chrome for Testing. Its client hints report the
Chromiumbrand while the user-agent string claimsChrome/151— a login gate reads that split. This installs real Google Chrome and launches it through Playwright'schromechannel, so the login browser presents Chrome's fingerprint.Verified on a from-scratch amd64 build of this image:
navigator.userAgentData.brandsgoes fromChromium | Not=A?BrandtoNot=A?Brand | Google Chrome | Chromium.Also in this change:
autocutselnow owns both selections (CLIPBOARDandPRIMARY).TZis honored on the container, so the browser's timezone can be aligned with the login egress.Arch note
Google ships no arm64 Linux build of Chrome, and the image is published multi-arch. Chrome is therefore installed on
amd64only;session-launchfalls back to the bundled chromium wherever Chrome is absent, so the arm64 image keeps working. Prod is amd64 and gets real Chrome.Not in scope
Egress. This is the browser-side fix and stands on its own. Whether the login also needs a residential egress IP is a separate, still-untested question.