From d04268c6390aafc73c7dedfedca832451200f53d Mon Sep 17 00:00:00 2001
From: splitsec2 <35583321+splitsec2@users.noreply.github.com>
Date: Sat, 31 Oct 2026 01:21:05 -0600
Subject: [PATCH] fix(docker): drop the unused selenium-manager binaries from
 the image (#1615)

Came out of looking at what is in the image after @wrycu's #1606. The
selenium package ships prebuilt `selenium-manager` binaries for four
platforms (about 22MB uncompressed), and none of them are used here.
They only run when selenium has to find a webdriver, and the bypasser
drives the browser through SeleniumBase's Pure-CDP driver, which doesn't
use one.

This deletes them (and their SBOM file) in the same `RUN` as `uv sync`,
so the layer doesn't carry them. As a side effect image scanners stop
reporting on the Rust crates compiled into those binaries.

To check nothing needs them, I deleted the files in a throwaway
container from the current `dev` image and ran `internal_bypasser.get()`
against example.com. It started the browser, loaded the page and
returned it, same as without the deletion. I haven't run a full image
build of this branch, so CI is the first time that exact `RUN` line gets
executed.

TL;DR dropping an unused feature from an included package lowering size
and eliminating flags for security vulnerabilities that don't get
exercised.

@calibrain this one is optional too, but I don't see a downside, your
call.
---
 Dockerfile | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/Dockerfile b/Dockerfile
index 610d7f8a..7d683363 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -180,7 +180,12 @@ RUN echo "deb [check-valid-until=no] https://snapshot.debian.org/archive/debian-
 # Install the browser automation stack used by the full image
 RUN --mount=type=cache,target=/root/.cache/uv \
     --mount=from=uv,source=/uv,target=/usr/local/bin/uv \
-    uv sync --locked --no-default-groups --extra browser
+    uv sync --locked --no-default-groups --extra browser && \
+    # Selenium ships prebuilt selenium-manager binaries (about 22MB) for every
+    # platform. They only run when selenium has to locate a webdriver, and the
+    # bypasser drives the browser through SeleniumBase's Pure-CDP driver, which
+    # needs none. Removed in this layer so the image does not carry them.
+    find /app/.venv/lib -name 'selenium-manager*' -delete
 
 # Deterministically resolve the Xlib namespace collision.
 # pyautogui/mouseinfo pull the stale `python3-xlib` (0.15, 2014), while the