feat(sandbox): ship Chromium in the image and drop browser control

Author: chriswritescode-dev

README.md

@@ -564,7 +564,7 @@ docker save oc-forge-sandbox:latest -o forge-sandbox.tar
 msb load --input forge-sandbox.tar --tag oc-forge-sandbox:latest
 ```
 
-The default image includes Node.js (NodeSource current channel), pnpm, Bun, Python 3 + uv, ripgrep, git, jq, and a full Docker Engine (docker-ce, CLI, containerd, Buildx, and Compose from Docker's official apt repo) that runs natively inside the microVM — `docker run`, `docker build`, and `docker compose` all work in-sandbox. The daemon is started on demand by `forge-dockerd-start` (msb boots its own `agentd` as PID 1 and ignores the image's entrypoint, so nothing runs dockerd at boot); `/var/lib/docker` is backed by a dedicated block device because overlayfs cannot run on a virtiofs mount. The built image is roughly 1.65 GB. Chromium and Browser Control are an opt-in image feature: set `sandbox.imageFeatures.browserControl` to `true`, then run `Build sandbox template` from the command palette to rebuild and load the configured image tag.
+The default image includes Node.js (NodeSource current channel), pnpm, Bun, Python 3 + uv, ripgrep, git, jq, and a full Docker Engine (docker-ce, CLI, containerd, Buildx, and Compose from Docker's official apt repo) that runs natively inside the microVM — `docker run`, `docker build`, and `docker compose` all work in-sandbox. The daemon is started on demand by `forge-dockerd-start` (msb boots its own `agentd` as PID 1 and ignores the image's entrypoint, so nothing runs dockerd at boot); `/var/lib/docker` is backed by a dedicated block device because overlayfs cannot run on a virtiofs mount. The built image is roughly 1.65 GB. The image also ships the current Playwright Chromium build as `chromium` (Google publishes no linux/arm64 Chrome build, so Chromium is the arm64 equivalent).
 
 The `container/Dockerfile` ships with the plugin package. If the image is missing when OpenCode starts, Forge shows a warning toast with a "Build sandbox template" command in the palette. You can also trigger the build from the command palette at any time by searching for `Build sandbox template`, which opens a confirmation dialog and runs the build/save/load sequence automatically. The dialog stays open for the duration and shows a live progress bar, the current Docker step, elapsed time, and streamed build output; on failure it keeps the last lines of Docker output so the cause is visible. A first build takes several minutes. Closing the dialog does not cancel the build — it finishes in the background and reports with a toast.
 

container/Dockerfile

@@ -78,27 +78,38 @@ ENV HOME=/opt/forge \
 RUN mkdir -p /opt/forge/.cache /opt/forge/.local/share/pnpm/store /opt/forge/.npm \
     && chmod -R 0777 /opt/forge
 
-# fallow CLI — dead-code analysis tool — installed globally with the same pnpm
-# setup used by the rest of the sandbox image. Binaries are linked into
-# /usr/local/bin so they are on PATH for arbitrary container UIDs.
+# fallow CLI — dead-code analysis tool — and the current Playwright Chromium
+# browser, installed globally with the same pnpm setup used by the rest of the
+# sandbox image. Binaries are linked into /usr/local/bin so they are on PATH for
+# arbitrary container UIDs.
 #
-# The trailing chmod is load-bearing: this global install runs as root and populates the
+# Chromium comes from playwright-core because Google publishes no linux/arm64
+# Chrome build, so on arm64 hosts it is the closest current Chrome build
+# available; `install --with-deps` pulls the system libraries Chromium needs at
+# runtime.
+#
+# The trailing chmod is load-bearing: these global installs run as root and populate the
 # pnpm store (store/v10/{files,index,projects}) with root-owned 0755 dirs, AFTER the earlier
 # `chmod -R 0777 /opt/forge`. Because the container runs as root but agent commands run as the
 # image's `agent` user via `msb exec`, that UID could not write into the root-owned store and
 # `pnpm install` failed with EACCES when registering the project — which previously drove the
 # agent to relocate the store onto the msb-mounted project directory (huge, slow file transfers).
 # Re-asserting 0777 here, as the last build step that touches /opt/forge, keeps the store
 # writable by any exec UID. Any future build step that runs pnpm as root must do the same.
+RUN pnpm add -g fallow@latest --global-bin-dir /usr/local/bin \
+    && pnpm add -g playwright-core@latest --global-bin-dir /usr/local/bin \
+    && package_root="$(readlink -f "$(find "$(pnpm root -g)" -maxdepth 4 -path '*/node_modules/playwright-core' -print -quit)")" \
+    && node "$package_root/cli.js" install --with-deps chromium \
+    && ln -s "$(node --input-type=module -e "import { chromium } from 'file://$package_root/index.mjs'; console.log(chromium.executablePath())")" /usr/local/bin/chromium \
+    && chmod -R 0777 /opt/forge
 
 # Docker Engine from Docker's official apt repository. The microVM boots a real
 # kernel, so the daemon runs natively — no privileged-container or nested-
 # virtualization tricks. `/var/lib/docker` is mounted as a dedicated msb block
 # device and public egress is the default, so `docker run` and registry pulls
 # work out of the box. The `agent` user joins the `docker` group for socket
 # access without sudo; starting the daemon itself stays root-only via the
-# passwordless sudo granted above. Installed before the INSTALL_BROWSER_CONTROL
-# toggle so rebuilding with that flag on does not re-fetch the Docker stack.
+# passwordless sudo granted above.
 RUN install -m 0755 -d /etc/apt/keyrings \
     && curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc \
     && chmod a+r /etc/apt/keyrings/docker.asc \
@@ -166,19 +177,9 @@ tail -n 20 "$log" 2>/dev/null >&2
 exit 1
 EOF
 
-ARG INSTALL_BROWSER_CONTROL=false
-
-RUN pnpm add -g fallow@latest --global-bin-dir /usr/local/bin \
-    && if [ "$INSTALL_BROWSER_CONTROL" = "true" ]; then \
-      pnpm add -g @opencode-ai/browser-control@latest --global-bin-dir /usr/local/bin \
-      && package_link="$(find "$(pnpm root -g)" -maxdepth 4 -type l -path '*/node_modules/@opencode-ai/browser-control' -print -quit)" \
-      && package_root="$(readlink -f "$package_link")" \
-      && package_modules="$(dirname "$(dirname "$package_root")")" \
-      && node "$package_modules/playwright-core/cli.js" install --with-deps chromium \
-      && ln -s "$package_root/extension/dist" /opt/browser-control-extension \
-      && ln -s "$(node --input-type=module -e "import { chromium } from 'file://$package_modules/playwright-core/index.mjs'; console.log(chromium.executablePath())")" /usr/local/bin/chromium; \
-    fi \
-    && chmod -R 0777 /opt/forge
+# fallow CLI — dead-code analysis tool — installed globally with the same pnpm
+# setup used by the rest of the sandbox image. Binaries are linked into
+# /usr/local/bin so they are on PATH for arbitrary container UIDs.
 
 # Allow git to operate on the msb-mounted project directory regardless of owner UID.
 RUN git config --system --add safe.directory '*'

docs/api/README.md

@@ -566,7 +566,7 @@ docker save oc-forge-sandbox:latest -o forge-sandbox.tar
 msb load --input forge-sandbox.tar --tag oc-forge-sandbox:latest
 ```
 
-The default image includes Node.js (NodeSource current channel), pnpm, Bun, Python 3 + uv, ripgrep, git, jq, and a full Docker Engine (docker-ce, CLI, containerd, Buildx, and Compose from Docker's official apt repo) that runs natively inside the microVM — `docker run`, `docker build`, and `docker compose` all work in-sandbox. The daemon is started on demand by `forge-dockerd-start` (msb boots its own `agentd` as PID 1 and ignores the image's entrypoint, so nothing runs dockerd at boot); `/var/lib/docker` is backed by a dedicated block device because overlayfs cannot run on a virtiofs mount. The built image is roughly 1.65 GB. Chromium and Browser Control are an opt-in image feature: set `sandbox.imageFeatures.browserControl` to `true`, then run `Build sandbox template` from the command palette to rebuild and load the configured image tag.
+The default image includes Node.js (NodeSource current channel), pnpm, Bun, Python 3 + uv, ripgrep, git, jq, and a full Docker Engine (docker-ce, CLI, containerd, Buildx, and Compose from Docker's official apt repo) that runs natively inside the microVM — `docker run`, `docker build`, and `docker compose` all work in-sandbox. The daemon is started on demand by `forge-dockerd-start` (msb boots its own `agentd` as PID 1 and ignores the image's entrypoint, so nothing runs dockerd at boot); `/var/lib/docker` is backed by a dedicated block device because overlayfs cannot run on a virtiofs mount. The built image is roughly 1.65 GB. The image also ships the current Playwright Chromium build as `chromium` (Google publishes no linux/arm64 Chrome build, so Chromium is the arm64 equivalent).
 
 The `container/Dockerfile` ships with the plugin package. If the image is missing when OpenCode starts, Forge shows a warning toast with a "Build sandbox template" command in the palette. You can also trigger the build from the command palette at any time by searching for `Build sandbox template`, which opens a confirmation dialog and runs the build/save/load sequence automatically. The dialog stays open for the duration and shows a live progress bar, the current Docker step, elapsed time, and streamed build output; on failure it keeps the last lines of Docker output so the cause is visible. A first build takes several minutes. Closing the dialog does not cancel the build — it finishes in the background and reports with a toast.
 

docs/api/_media/configuration.md

@@ -247,7 +247,6 @@ See [Sandbox](sandbox.md) for detailed behavior and security notes.
 | `sandbox.enabled` | `true` | Enable sandboxed execution. When enabled and the msb CLI or host virtualization is unavailable, sandbox startup fails rather than falling back to the host; set `false` to run worktree-only. |
 | `sandbox.mode` | `"msb"` | Sandbox mode. `msb` is currently the only supported mode. A stale `"mode": "sbx"` from an older install is reported as a migration warning in the log and, when running in the TUI, as a toast. |
 | `sandbox.image` | `"oc-forge-sandbox:latest"` | msb image reference used for sandboxed execution. |
-| `sandbox.imageFeatures.browserControl` | `false` | Include Chromium, the Browser Control CLI/MCP server, and its extension when building the bundled sandbox image. Rebuild the image after changing it. |
 | `sandbox.resources.memory` | `"8g"` | Memory the sandbox gets (`msb create -m`). Fixed for the sandbox's life; there is no autoscaling, so size it for the heaviest command it will run or that command is OOM-killed. |
 | `sandbox.resources.cpus` | `"4"` | CPU count the sandbox gets (`msb create -c`; integer-only). Fixed for the sandbox's life. |
 | `sandbox.resources.dockerDisk` | `"16g"` | Size of the dedicated block device backing the sandbox's in-VM Docker Engine data dir (`/var/lib/docker`, `--mount-named ...:kind=disk,size=<size>`). The disk is sparse, so the generous default costs no real disk up front. |

docs/api/_media/sandbox.md

@@ -26,51 +26,18 @@ msb load --input forge-sandbox.tar --tag oc-forge-sandbox:latest
 
 `msb load` registers the archive under the tag Forge looks up (`sandbox.image`, default `oc-forge-sandbox:latest`); list loaded images with `msb images --format json`.
 
-The default image includes Node.js 24, pnpm, Bun, Python 3 + uv, ripgrep, git, jq, and Docker Engine (see [Nested Docker](#nested-docker)).
+The default image includes Node.js 24, pnpm, Bun, Python 3 + uv, ripgrep, git, jq, Chromium, and Docker Engine (see [Nested Docker](#nested-docker)).
 
 The sandbox image grants the `agent` user passwordless sudo, so loops can install whatever software they need at runtime. Commands arrive via `msb exec` without `-u`, so they run as the image's `USER agent` (keeping host-mapped worktree files owned by the host user); system-wide installs use an explicit `sudo` prefix, for example `sudo apt-get install ruby`.
 
-### Browser Control (opt-in)
+### Chromium
 
-Chromium and Browser Control add a substantial browser payload, so they are excluded by default. Enable them for future image builds:
-
-```jsonc
-{
-  "sandbox": {
-    "imageFeatures": {
-      "browserControl": true
-    }
-  }
-}
-```
-
-Then run `Build sandbox template` from the command palette. Changing the option does not modify an already-loaded image; rebuild it explicitly. The equivalent manual Docker build is:
+The image ships the current Playwright Chromium build as `chromium`. Google publishes no linux/arm64 Chrome build, so Chromium is the arm64 equivalent of a current Chrome. Launch it headless with the usual sandbox flags:
 
 ```bash
-docker build \
-  --build-arg INSTALL_BROWSER_CONTROL=true \
-  -t oc-forge-sandbox:latest \
-  container/
-docker save oc-forge-sandbox:latest -o forge-sandbox.tar
-msb load --input forge-sandbox.tar --tag oc-forge-sandbox:latest
-```
-
-The resulting image provides `browser-control`, `browser-control-mcp`, Chromium as `chromium`, and the unpacked extension at `/opt/browser-control-extension`.
-
-Browser Control connects to a browser in the same sandbox. Launch Chromium with the packaged extension path resolved to its installation directory:
-
-```bash
-extension="$(readlink -f /opt/browser-control-extension)"
-xvfb-run -a chromium \
-  --no-sandbox \
-  --disable-dev-shm-usage \
-  --disable-extensions-except="$extension" \
-  --load-extension="$extension" \
-  --user-data-dir=/opt/forge/.browser-control-profile
+chromium --no-sandbox --disable-dev-shm-usage --headless
 ```
 
-It cannot control a browser running on the host because sandbox networking cannot reach the host loopback interface.
-
 ## How It Works
 
 1. A sandbox loop uses its isolated git worktree. A host-session sandbox instead uses the project root selected from the TUI.

docs/configuration.md

@@ -247,7 +247,6 @@ See [Sandbox](sandbox.md) for detailed behavior and security notes.
 | `sandbox.enabled` | `true` | Enable sandboxed execution. When enabled and the msb CLI or host virtualization is unavailable, sandbox startup fails rather than falling back to the host; set `false` to run worktree-only. |
 | `sandbox.mode` | `"msb"` | Sandbox mode. `msb` is currently the only supported mode. A stale `"mode": "sbx"` from an older install is reported as a migration warning in the log and, when running in the TUI, as a toast. |
 | `sandbox.image` | `"oc-forge-sandbox:latest"` | msb image reference used for sandboxed execution. |
-| `sandbox.imageFeatures.browserControl` | `false` | Include Chromium, the Browser Control CLI/MCP server, and its extension when building the bundled sandbox image. Rebuild the image after changing it. |
 | `sandbox.resources.memory` | `"8g"` | Memory the sandbox gets (`msb create -m`). Fixed for the sandbox's life; there is no autoscaling, so size it for the heaviest command it will run or that command is OOM-killed. |
 | `sandbox.resources.cpus` | `"4"` | CPU count the sandbox gets (`msb create -c`; integer-only). Fixed for the sandbox's life. |
 | `sandbox.resources.dockerDisk` | `"16g"` | Size of the dedicated block device backing the sandbox's in-VM Docker Engine data dir (`/var/lib/docker`, `--mount-named ...:kind=disk,size=<size>`). The disk is sparse, so the generous default costs no real disk up front. |

docs/sandbox.md

@@ -26,51 +26,18 @@ msb load --input forge-sandbox.tar --tag oc-forge-sandbox:latest
 
 `msb load` registers the archive under the tag Forge looks up (`sandbox.image`, default `oc-forge-sandbox:latest`); list loaded images with `msb images --format json`.
 
-The default image includes Node.js 24, pnpm, Bun, Python 3 + uv, ripgrep, git, jq, and Docker Engine (see [Nested Docker](#nested-docker)).
+The default image includes Node.js 24, pnpm, Bun, Python 3 + uv, ripgrep, git, jq, Chromium, and Docker Engine (see [Nested Docker](#nested-docker)).
 
 The sandbox image grants the `agent` user passwordless sudo, so loops can install whatever software they need at runtime. Commands arrive via `msb exec` without `-u`, so they run as the image's `USER agent` (keeping host-mapped worktree files owned by the host user); system-wide installs use an explicit `sudo` prefix, for example `sudo apt-get install ruby`.
 
-### Browser Control (opt-in)
+### Chromium
 
-Chromium and Browser Control add a substantial browser payload, so they are excluded by default. Enable them for future image builds:
-
-```jsonc
-{
-  "sandbox": {
-    "imageFeatures": {
-      "browserControl": true
-    }
-  }
-}
-```
-
-Then run `Build sandbox template` from the command palette. Changing the option does not modify an already-loaded image; rebuild it explicitly. The equivalent manual Docker build is:
+The image ships the current Playwright Chromium build as `chromium`. Google publishes no linux/arm64 Chrome build, so Chromium is the arm64 equivalent of a current Chrome. Launch it headless with the usual sandbox flags:
 
 ```bash
-docker build \
-  --build-arg INSTALL_BROWSER_CONTROL=true \
-  -t oc-forge-sandbox:latest \
-  container/
-docker save oc-forge-sandbox:latest -o forge-sandbox.tar
-msb load --input forge-sandbox.tar --tag oc-forge-sandbox:latest
-```
-
-The resulting image provides `browser-control`, `browser-control-mcp`, Chromium as `chromium`, and the unpacked extension at `/opt/browser-control-extension`.
-
-Browser Control connects to a browser in the same sandbox. Launch Chromium with the packaged extension path resolved to its installation directory:
-
-```bash
-extension="$(readlink -f /opt/browser-control-extension)"
-xvfb-run -a chromium \
-  --no-sandbox \
-  --disable-dev-shm-usage \
-  --disable-extensions-except="$extension" \
-  --load-extension="$extension" \
-  --user-data-dir=/opt/forge/.browser-control-profile
+chromium --no-sandbox --disable-dev-shm-usage --headless
 ```
 
-It cannot control a browser running on the host because sandbox networking cannot reach the host loopback interface.
-
 ## How It Works
 
 1. A sandbox loop uses its isolated git worktree. A host-session sandbox instead uses the project root selected from the TUI.

forge-config.jsonc

@@ -104,10 +104,7 @@
   "sandbox": {
     "enabled": true,
     "mode": "msb",
-    "image": "oc-forge-sandbox:latest",
-    "imageFeatures": {
-      "browserControl": false
-    }
+    "image": "oc-forge-sandbox:latest"
     // Mount the source project directory read-only at its identical host path. Defaults to true.
     // "mountProjectReadonly": true,
     // Network access configuration. msb egress is allow-by-default: with no hosts configured,

src/index.ts

@@ -353,7 +353,6 @@ export function createForgePlugin(config: PluginConfig): Plugin {
           ...(sandboxMountConfigs.length > 0 ? { customMounts: sandboxMountConfigs } : {}),
           ...(config.sandbox?.network ? { network: config.sandbox.network } : {}),
           buildContextDir: resolveBundledContainerDir(),
-          browserControl: config.sandbox?.imageFeatures?.browserControl === true,
           ...(config.sandbox?.resources ? { resources: config.sandbox.resources } : {}),
         }, logger, defaultGitService)
         logger.log('Sandbox manager initialized')
@@ -382,7 +381,6 @@ export function createForgePlugin(config: PluginConfig): Plugin {
     if (sandboxManager && forgeClient) {
       const sandboxImage = config.sandbox?.image ?? DEFAULT_SANDBOX_IMAGE
       const buildContextDir = resolveBundledContainerDir()
-      const browserControl = config.sandbox?.imageFeatures?.browserControl === true
       void (async () => {
         try {
           const available = await runtime.checkAvailable()
@@ -412,7 +410,7 @@ export function createForgePlugin(config: PluginConfig): Plugin {
               directory,
               logger,
               title: 'Sandbox template not found',
-              message: `Sandbox template "${sandboxImage}" is missing. Build it from the command palette: "Build sandbox template", or run: ${formatTemplateBuildCommands(buildContextDir, sandboxImage, { browserControl })}`,
+              message: `Sandbox template "${sandboxImage}" is missing. Build it from the command palette: "Build sandbox template", or run: ${formatTemplateBuildCommands(buildContextDir, sandboxImage)}`,
               variant: 'warning',
               duration: 10_000,
             })