qubicl-cli 0.1.0-dev.0 → 0.1.0

package/dist/assets/chromium-seccomp.json

@@ -0,0 +1,181 @@
+{
+  "defaultAction": "SCMP_ACT_ERRNO",
+  "defaultErrnoRet": 1,
+  "archMap": [
+    { "architecture": "SCMP_ARCH_X86_64", "subArchitectures": ["SCMP_ARCH_X86", "SCMP_ARCH_X32"] },
+    { "architecture": "SCMP_ARCH_AARCH64", "subArchitectures": ["SCMP_ARCH_ARM"] },
+    { "architecture": "SCMP_ARCH_MIPS64", "subArchitectures": ["SCMP_ARCH_MIPS", "SCMP_ARCH_MIPS64N32"] },
+    { "architecture": "SCMP_ARCH_MIPS64N32", "subArchitectures": ["SCMP_ARCH_MIPS", "SCMP_ARCH_MIPS64"] },
+    { "architecture": "SCMP_ARCH_MIPSEL64", "subArchitectures": ["SCMP_ARCH_MIPSEL", "SCMP_ARCH_MIPSEL64N32"] },
+    { "architecture": "SCMP_ARCH_MIPSEL64N32", "subArchitectures": ["SCMP_ARCH_MIPSEL", "SCMP_ARCH_MIPSEL64"] },
+    { "architecture": "SCMP_ARCH_S390X", "subArchitectures": ["SCMP_ARCH_S390"] },
+    { "architecture": "SCMP_ARCH_RISCV64", "subArchitectures": null }
+  ],
+  "syscalls": [
+    {
+      "names": [
+        "accept", "accept4", "access", "adjtimex", "alarm", "bind", "brk", "capget", "capset",
+        "chdir", "chmod", "chown", "chown32", "clock_adjtime", "clock_adjtime64", "clock_getres",
+        "clock_getres_time64", "clock_gettime", "clock_gettime64", "clock_nanosleep", "clock_nanosleep_time64",
+        "close", "close_range", "connect", "copy_file_range", "creat", "dup", "dup2", "dup3", "epoll_create",
+        "epoll_create1", "epoll_ctl", "epoll_ctl_old", "epoll_pwait", "epoll_pwait2", "epoll_wait", "epoll_wait_old",
+        "eventfd", "eventfd2", "execve", "execveat", "exit", "exit_group", "faccessat", "faccessat2", "fadvise64",
+        "fadvise64_64", "fallocate", "fanotify_mark", "fchdir", "fchmod", "fchmodat", "fchown",
+        "fchown32", "fchownat", "fcntl", "fcntl64", "fdatasync", "fgetxattr", "flistxattr", "flock", "fork",
+        "fremovexattr", "fsetxattr", "fstat", "fstat64", "fstatat64", "fstatfs", "fstatfs64", "fsync", "ftruncate",
+        "ftruncate64", "futex", "futex_time64", "futex_waitv",
+        "futimesat", "getcpu", "getcwd", "getdents", "getdents64", "getegid", "getegid32", "geteuid", "geteuid32",
+        "getgid", "getgid32", "getgroups", "getgroups32", "getitimer", "getpeername", "getpgid", "getpgrp", "getpid",
+        "getppid", "getpriority", "getrandom", "getresgid", "getresgid32", "getresuid", "getresuid32", "getrlimit",
+        "get_robust_list", "getrusage", "getsid", "getsockname", "getsockopt", "get_thread_area", "gettid",
+        "gettimeofday", "getuid", "getuid32", "getxattr", "inotify_add_watch", "inotify_init",
+        "inotify_init1", "inotify_rm_watch", "io_cancel", "ioctl", "io_destroy", "io_getevents", "io_pgetevents",
+        "io_pgetevents_time64", "ioprio_get", "ioprio_set", "io_setup", "io_submit", "ipc", "kill", "landlock_add_rule",
+        "landlock_create_ruleset", "landlock_restrict_self", "lchown", "lchown32", "lgetxattr", "link", "linkat",
+        "listen", "listxattr", "llistxattr", "_llseek", "lremovexattr", "lseek", "lsetxattr",
+        "lstat", "lstat64", "madvise", "membarrier", "memfd_create", "memfd_secret", "mincore",
+        "mkdir", "mkdirat", "mknod", "mknodat", "mlock", "mlock2", "mlockall", "mmap", "mmap2", "mprotect",
+        "mq_getsetattr", "mq_notify", "mq_open", "mq_timedreceive", "mq_timedreceive_time64", "mq_timedsend",
+        "mq_timedsend_time64", "mq_unlink", "mremap", "msgctl", "msgget", "msgrcv", "msgsnd", "msync",
+        "munlock", "munlockall", "munmap", "nanosleep", "newfstatat", "_newselect", "open",
+        "openat", "openat2", "pause", "pidfd_open", "pidfd_send_signal", "pipe", "pipe2", "pkey_alloc", "pkey_free",
+        "pkey_mprotect", "poll", "ppoll", "ppoll_time64", "prctl", "pread64", "preadv", "preadv2", "prlimit64",
+        "process_mrelease", "pselect6", "pselect6_time64", "pwrite64", "pwritev", "pwritev2", "read", "readahead",
+        "readlink", "readlinkat", "readv", "recv", "recvfrom", "recvmmsg", "recvmmsg_time64", "recvmsg",
+        "remap_file_pages", "removexattr", "rename", "renameat", "renameat2", "restart_syscall",
+        "rmdir", "rseq", "rt_sigaction", "rt_sigpending", "rt_sigprocmask", "rt_sigqueueinfo",
+        "rt_sigreturn", "rt_sigsuspend", "rt_sigtimedwait", "rt_sigtimedwait_time64", "rt_tgsigqueueinfo",
+        "sched_getaffinity", "sched_getattr", "sched_getparam", "sched_get_priority_max", "sched_get_priority_min",
+        "sched_getscheduler", "sched_rr_get_interval", "sched_rr_get_interval_time64", "sched_setaffinity", "sched_setattr",
+        "sched_setparam", "sched_setscheduler", "sched_yield", "seccomp", "select", "semctl", "semget", "semop",
+        "semtimedop", "semtimedop_time64", "send", "sendfile", "sendfile64", "sendmmsg", "sendmsg", "sendto",
+        "setfsgid", "setfsgid32", "setfsuid", "setfsuid32", "setgid", "setgid32", "setgroups", "setgroups32",
+        "setitimer", "setpgid", "setpriority", "setregid", "setregid32", "setresgid", "setresgid32", "setresuid",
+        "setresuid32", "setreuid", "setreuid32", "setrlimit", "set_robust_list", "setsid", "setsockopt",
+        "set_thread_area", "set_tid_address", "setuid", "setuid32", "setxattr", "shmat", "shmctl",
+        "shmdt", "shmget", "shutdown", "sigaltstack", "signalfd", "signalfd4", "sigprocmask", "sigreturn",
+        "socketcall", "socketpair", "splice", "stat", "stat64", "statfs", "statfs64", "statx", "symlink",
+        "symlinkat", "sync", "sync_file_range", "syncfs", "sysinfo", "tee", "tgkill", "time", "timer_create",
+        "timer_delete", "timer_getoverrun", "timer_gettime", "timer_gettime64", "timer_settime", "timer_settime64",
+        "timerfd_create", "timerfd_gettime", "timerfd_gettime64", "timerfd_settime", "timerfd_settime64", "times",
+        "tkill", "truncate", "truncate64", "ugetrlimit", "umask", "uname", "unlink", "unlinkat", "utime",
+        "utimensat", "utimensat_time64", "utimes", "vfork", "vmsplice", "wait4", "waitid", "waitpid", "write", "writev"
+      ],
+      "action": "SCMP_ACT_ALLOW"
+    },
+    {
+      "names": ["process_vm_readv", "process_vm_writev", "ptrace"],
+      "action": "SCMP_ACT_ALLOW",
+      "includes": { "minKernel": "4.8" }
+    },
+    {
+      "names": ["socket"],
+      "action": "SCMP_ACT_ALLOW",
+      "args": [{ "index": 0, "value": 40, "op": "SCMP_CMP_NE" }]
+    },
+    { "names": ["personality"], "action": "SCMP_ACT_ALLOW", "args": [{ "index": 0, "value": 0, "op": "SCMP_CMP_EQ" }] },
+    { "names": ["personality"], "action": "SCMP_ACT_ALLOW", "args": [{ "index": 0, "value": 8, "op": "SCMP_CMP_EQ" }] },
+    { "names": ["personality"], "action": "SCMP_ACT_ALLOW", "args": [{ "index": 0, "value": 131072, "op": "SCMP_CMP_EQ" }] },
+    { "names": ["personality"], "action": "SCMP_ACT_ALLOW", "args": [{ "index": 0, "value": 131080, "op": "SCMP_CMP_EQ" }] },
+    { "names": ["personality"], "action": "SCMP_ACT_ALLOW", "args": [{ "index": 0, "value": 4294967295, "op": "SCMP_CMP_EQ" }] },
+    {
+      "names": ["sync_file_range2", "swapcontext"],
+      "action": "SCMP_ACT_ALLOW",
+      "includes": { "arches": ["ppc64le"] }
+    },
+    {
+      "names": ["arm_fadvise64_64", "arm_sync_file_range", "sync_file_range2", "breakpoint", "cacheflush", "set_tls"],
+      "action": "SCMP_ACT_ALLOW",
+      "includes": { "arches": ["arm", "arm64"] }
+    },
+    { "names": ["arch_prctl"], "action": "SCMP_ACT_ALLOW", "includes": { "arches": ["amd64", "x32"] } },
+    { "names": ["modify_ldt"], "action": "SCMP_ACT_ALLOW", "includes": { "arches": ["amd64", "x32", "x86"] } },
+    {
+      "names": ["s390_pci_mmio_read", "s390_pci_mmio_write", "s390_runtime_instr"],
+      "action": "SCMP_ACT_ALLOW",
+      "includes": { "arches": ["s390", "s390x"] }
+    },
+    { "names": ["riscv_flush_icache"], "action": "SCMP_ACT_ALLOW", "includes": { "arches": ["riscv64"] } },
+    { "names": ["open_by_handle_at"], "action": "SCMP_ACT_ALLOW", "includes": { "caps": ["CAP_DAC_READ_SEARCH"] } },
+    {
+      "names": ["bpf", "clone", "clone3", "fanotify_init", "fsconfig", "fsmount", "fsopen", "fspick",
+        "lookup_dcookie", "mount", "mount_setattr", "move_mount", "name_to_handle_at", "open_tree",
+        "perf_event_open", "quotactl", "quotactl_fd", "setdomainname", "sethostname",
+        "setns", "syslog", "umount", "umount2", "unshare"],
+      "action": "SCMP_ACT_ALLOW",
+      "includes": { "caps": ["CAP_SYS_ADMIN"] }
+    },
+    {
+      "names": ["clone"],
+      "action": "SCMP_ACT_ALLOW",
+      "args": [{ "index": 0, "value": 2114060288, "op": "SCMP_CMP_MASKED_EQ" }],
+      "excludes": { "caps": ["CAP_SYS_ADMIN"], "arches": ["s390", "s390x"] }
+    },
+    {
+      "names": ["clone"],
+      "action": "SCMP_ACT_ALLOW",
+      "args": [{ "index": 1, "value": 2114060288, "op": "SCMP_CMP_MASKED_EQ" }],
+      "comment": "s390 parameter ordering for clone is different",
+      "includes": { "arches": ["s390", "s390x"] },
+      "excludes": { "caps": ["CAP_SYS_ADMIN"] }
+    },
+    {
+      "names": ["clone"],
+      "action": "SCMP_ACT_ALLOW",
+      "args": [{ "index": 0, "value": 2114060288, "valueTwo": 268435456, "op": "SCMP_CMP_MASKED_EQ" }],
+      "comment": "Qubicl session only: Chromium user-namespace feature probe.",
+      "excludes": { "arches": ["s390", "s390x"] }
+    },
+    {
+      "names": ["clone"],
+      "action": "SCMP_ACT_ALLOW",
+      "args": [{ "index": 0, "value": 2114060288, "valueTwo": 805306368, "op": "SCMP_CMP_MASKED_EQ" }],
+      "comment": "Qubicl session only: Chromium user and PID namespaces.",
+      "excludes": { "arches": ["s390", "s390x"] }
+    },
+    {
+      "names": ["clone"],
+      "action": "SCMP_ACT_ALLOW",
+      "args": [{ "index": 0, "value": 2114060288, "valueTwo": 1342177280, "op": "SCMP_CMP_MASKED_EQ" }],
+      "comment": "Qubicl session only: Chromium user and network namespaces.",
+      "excludes": { "arches": ["s390", "s390x"] }
+    },
+    {
+      "names": ["clone"],
+      "action": "SCMP_ACT_ALLOW",
+      "args": [{ "index": 0, "value": 2114060288, "valueTwo": 1879048192, "op": "SCMP_CMP_MASKED_EQ" }],
+      "comment": "Qubicl session only: Chromium user, PID, and network namespaces.",
+      "excludes": { "arches": ["s390", "s390x"] }
+    },
+    {
+      "names": ["clone"],
+      "action": "SCMP_ACT_ALLOW",
+      "args": [{ "index": 0, "value": 2114060288, "valueTwo": 536870912, "op": "SCMP_CMP_MASKED_EQ" }],
+      "comment": "Qubicl session only: Chromium forks inside its established user namespace into a PID namespace.",
+      "excludes": { "arches": ["s390", "s390x"] }
+    },
+    {
+      "names": ["unshare"],
+      "action": "SCMP_ACT_ALLOW",
+      "args": [{ "index": 0, "value": 2114060288, "valueTwo": 268435456, "op": "SCMP_CMP_MASKED_EQ" }],
+      "comment": "Qubicl session only: Chromium enters a second unprivileged user namespace."
+    },
+    { "names": ["clone3"], "action": "SCMP_ACT_ERRNO", "errnoRet": 38, "excludes": { "caps": ["CAP_SYS_ADMIN"] } },
+    { "names": ["reboot"], "action": "SCMP_ACT_ALLOW", "includes": { "caps": ["CAP_SYS_BOOT"] } },
+    { "names": ["chroot"], "action": "SCMP_ACT_ALLOW", "includes": { "caps": ["CAP_SYS_CHROOT"] } },
+    { "names": ["delete_module", "init_module", "finit_module"], "action": "SCMP_ACT_ALLOW", "includes": { "caps": ["CAP_SYS_MODULE"] } },
+    { "names": ["acct"], "action": "SCMP_ACT_ALLOW", "includes": { "caps": ["CAP_SYS_PACCT"] } },
+    {
+      "names": ["kcmp", "pidfd_getfd", "process_madvise", "process_vm_readv", "process_vm_writev", "ptrace"],
+      "action": "SCMP_ACT_ALLOW",
+      "includes": { "caps": ["CAP_SYS_PTRACE"] }
+    },
+    { "names": ["iopl", "ioperm"], "action": "SCMP_ACT_ALLOW", "includes": { "caps": ["CAP_SYS_RAWIO"] } },
+    { "names": ["settimeofday", "stime", "clock_settime", "clock_settime64"], "action": "SCMP_ACT_ALLOW", "includes": { "caps": ["CAP_SYS_TIME"] } },
+    { "names": ["vhangup"], "action": "SCMP_ACT_ALLOW", "includes": { "caps": ["CAP_SYS_TTY_CONFIG"] } },
+    { "names": ["get_mempolicy", "mbind", "set_mempolicy"], "action": "SCMP_ACT_ALLOW", "includes": { "caps": ["CAP_SYS_NICE"] } },
+    { "names": ["syslog"], "action": "SCMP_ACT_ALLOW", "includes": { "caps": ["CAP_SYSLOG"] } },
+    { "names": ["bpf"], "action": "SCMP_ACT_ALLOW", "includes": { "caps": ["CAP_BPF"] } },
+    { "names": ["perf_event_open"], "action": "SCMP_ACT_ALLOW", "includes": { "caps": ["CAP_PERFMON"] } }
+  ]
+}

package/dist/assets/computer/BROWSER_SKILLS_THIRD_PARTY_NOTICES.txt

@@ -0,0 +1,23 @@
+Qubicl browser document-inspection dependencies
+
+The exact dependency closure is pinned in browser-skills-requirements.txt.
+Distribution license texts are retained under
+/usr/share/doc/qubicl/skills-python-licenses in browser images. These packages
+are installed only in the isolated /opt/qubicl/skills-venv.
+
+Package                     Version     License
+cffi                        2.1.1       MIT-0
+charset-normalizer          3.5.1       MIT
+cryptography                50.0.0      Apache-2.0 OR BSD-3-Clause
+pdfminer.six                20260107    MIT
+pdfplumber                  0.11.10     MIT
+pillow                      12.3.0      MIT-CMU
+pycparser                   3.0         BSD-3-Clause
+pypdf                       6.16.1      BSD-3-Clause
+pypdfium2                   5.13.0      BSD-3-Clause / Apache-2.0 / bundled notices
+reportlab                   5.0.1       BSD
+typing_extensions           4.16.0      PSF-2.0
+
+No Hermes Agent runtime is installed or required. PyMuPDF, pymupdf4llm, and
+pymupdf-layout are not bundled because their AGPL-3.0-or-commercial licensing
+is outside Qubicl's curated permissive Python dependency policy.

package/dist/assets/computer/Dockerfile

@@ -1,4 +1,4 @@
-FROM node:22-trixie-slim@sha256:db8a96a63e5264607ada2d206758876ebbed6a12be2ada7517793cbfb0c2a29c
+FROM node:22-trixie-slim@sha256:db8a96a63e5264607ada2d206758876ebbed6a12be2ada7517793cbfb0c2a29c AS filesystem-base
 
 ARG QUBICL_VERSION=development
 ARG QUBICL_REVISION=unknown
@@ -6,7 +6,7 @@ ARG QUBICL_CREATED=unknown
 ARG QUBICL_SOURCE=https://github.com/EldanRing/qubicl
 
 LABEL org.opencontainers.image.title="Qubicl computer" \
-      org.opencontainers.image.description="Private Docker computer and desktop for compatible AI agents" \
+      org.opencontainers.image.description="Private Docker computer for compatible AI agents" \
       org.opencontainers.image.licenses="Apache-2.0" \
       org.opencontainers.image.source="$QUBICL_SOURCE" \
       org.opencontainers.image.url="$QUBICL_SOURCE" \
@@ -18,73 +18,215 @@ ENV DEBIAN_FRONTEND=noninteractive
 RUN apt-get update \
  && apt-get upgrade -y \
  && apt-get install -y --no-install-recommends \
-    atril \
-    build-essential \
-    ca-certificates \
-    chromium \
-    chromium-sandbox \
-    curl \
-    dbus-x11 \
-    file \
-    fonts-dejavu-core \
-    git \
-    libreoffice \
-    mousepad \
-    novnc \
-    patch \
-    procps \
-    python3 \
-    python3-pip \
-    ristretto \
-    scrot \
-    sudo \
-    thunar \
-    tini \
-    websockify \
-    x11vnc \
-    x11-utils \
-    x11-xserver-utils \
-    xclip \
-    xdotool \
-    xdg-utils \
-    xfce4 \
-    xfce4-terminal \
-    xserver-xorg-core \
-    xvfb \
+      ca-certificates \
+      curl \
+      fd-find \
+      file \
+      gh \
+      git \
+      jq \
+      procps \
+      python3 \
+      python3-venv \
+      ripgrep \
+      sudo \
+      tini \
+      tree \
+      unzip \
+      wget \
+      zip \
+ && ln -s /usr/bin/fdfind /usr/local/bin/fd \
  && rm -rf /var/lib/apt/lists/*
 
 ARG NPM_VERSION=12.0.2
-# npm 12.0.2's lock still selects vulnerable, semver-compatible transitive versions.
-# Replace only those bundled copies until a later npm release includes the fixes.
 RUN npm install --global "npm@$NPM_VERSION" \
  && npm install --prefix /tmp/npm-security-patches \
-      --ignore-scripts \
-      --no-audit \
-      --no-fund \
-      --package-lock=false \
-      brace-expansion@5.0.9 \
-      ip-address@10.3.1 \
+      --ignore-scripts --no-audit --no-fund --package-lock=false \
+      brace-expansion@5.0.9 ip-address@10.3.1 tar@7.5.21 \
  && rm -rf \
       /usr/local/lib/node_modules/npm/node_modules/brace-expansion \
       /usr/local/lib/node_modules/npm/node_modules/ip-address \
+      /usr/local/lib/node_modules/npm/node_modules/tar \
  && cp -a /tmp/npm-security-patches/node_modules/brace-expansion \
       /usr/local/lib/node_modules/npm/node_modules/brace-expansion \
  && cp -a /tmp/npm-security-patches/node_modules/ip-address \
       /usr/local/lib/node_modules/npm/node_modules/ip-address \
+ && cp -a /tmp/npm-security-patches/node_modules/tar \
+      /usr/local/lib/node_modules/npm/node_modules/tar \
  && rm -rf /tmp/npm-security-patches \
  && npm cache clean --force
 
 RUN groupmod --new-name qubicl node \
  && usermod --login qubicl --home /home/qubicl --move-home --shell /bin/bash node \
- && printf 'qubicl ALL=(ALL) NOPASSWD:ALL\n' >/etc/sudoers.d/qubicl \
- && chmod 0440 /etc/sudoers.d/qubicl \
- && printf 'CHROMIUM_FLAGS="$CHROMIUM_FLAGS --no-sandbox"\n' >/etc/chromium.d/qubicl-container \
+ && rm -f /etc/sudoers.d/qubicl \
  && install -d -o qubicl -g qubicl /opt/qubicl
 
 COPY --chown=qubicl:qubicl control.mjs /opt/qubicl/control.mjs
-COPY LICENSE THIRD_PARTY_NOTICES.txt /usr/share/doc/qubicl/
+COPY --chown=qubicl:qubicl web-provider.py /opt/qubicl/web-provider.py
+COPY web-requirements.txt /opt/qubicl/web-requirements.txt
+COPY --chown=qubicl:qubicl skills /opt/qubicl/skills
+COPY LICENSE THIRD_PARTY_NOTICES.txt WEB_THIRD_PARTY_NOTICES.txt /usr/share/doc/qubicl/
 COPY entrypoint.sh /usr/local/bin/qubicl-entrypoint
-RUN chmod 0755 /usr/local/bin/qubicl-entrypoint
+RUN python3 -m venv /opt/qubicl/web-venv \
+ && /opt/qubicl/web-venv/bin/pip install --no-cache-dir --requirement /opt/qubicl/web-requirements.txt \
+ && install -d /usr/share/doc/qubicl/web-python-licenses \
+ && find /opt/qubicl/web-venv/lib -type f \( -iname 'LICENSE*' -o -iname 'COPYING*' \) \
+      -exec cp --parents '{}' /usr/share/doc/qubicl/web-python-licenses/ \; \
+ && find /opt/qubicl/web-venv -type d -name __pycache__ -prune -exec rm -rf '{}' + \
+ && chmod 0755 /usr/local/bin/qubicl-entrypoint /opt/qubicl/web-provider.py \
+ && chown -R qubicl:qubicl /opt/qubicl/web-venv
 
-EXPOSE 3212 6080 6081
 ENTRYPOINT ["/usr/bin/tini", "--", "/usr/local/bin/qubicl-entrypoint"]
+
+FROM filesystem-base AS display-browser-base
+
+COPY --chown=qubicl:qubicl node_modules/playwright-core /opt/qubicl/node_modules/playwright-core
+COPY PLAYWRIGHT_THIRD_PARTY_NOTICES.txt /usr/share/doc/qubicl/
+COPY chromium-wrapper.sh /usr/local/bin/qubicl-chromium
+
+# noVNC is static browser content at runtime. Extract Debian's signed package
+# without installing its unnecessary dependency on Debian's second Node stack.
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends \
+      chromium \
+      dbus-x11 \
+      fonts-dejavu-core \
+      scrot \
+      websockify \
+      x11-utils \
+      x11-xserver-utils \
+      x11vnc \
+      xclip \
+      xdotool \
+      xdg-utils \
+      xserver-xorg-core \
+      xvfb \
+ && install -d -m 0755 -o _apt -g root /tmp/qubicl-novnc-package \
+ && cd /tmp/qubicl-novnc-package \
+ && apt-get download novnc \
+ && dpkg-deb --extract ./novnc_*.deb / \
+ && cd / \
+ && test -s /usr/share/novnc/vnc.html \
+ && test -s /usr/share/doc/novnc/copyright \
+ && rm -rf /tmp/qubicl-novnc-package /var/lib/apt/lists/* \
+ && rm -f /etc/chromium.d/dev-shm \
+ && chmod 0755 /usr/local/bin/qubicl-chromium \
+ && printf 'CHROMIUM_FLAGS="$CHROMIUM_FLAGS --no-first-run --no-default-browser-check"\n' >/etc/chromium.d/qubicl-container
+
+FROM display-browser-base AS document-inspection-base
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends \
+      poppler-utils \
+      tesseract-ocr \
+      tesseract-ocr-eng \
+ && rm -rf /var/lib/apt/lists/*
+
+FROM document-inspection-base AS browser-runtime
+COPY browser-skills-requirements.txt /opt/qubicl/browser-skills-requirements.txt
+COPY BROWSER_SKILLS_THIRD_PARTY_NOTICES.txt /usr/share/doc/qubicl/
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends openbox \
+ && rm -rf /var/lib/apt/lists/* \
+ && python3 -m venv /opt/qubicl/skills-venv \
+ && /opt/qubicl/skills-venv/bin/pip install --no-cache-dir --requirement /opt/qubicl/browser-skills-requirements.txt \
+ && install -d /usr/share/doc/qubicl/skills-python-licenses \
+ && find /opt/qubicl/skills-venv/lib -type f \( -iname 'LICENSE*' -o -iname 'COPYING*' \) \
+      -exec cp --parents '{}' /usr/share/doc/qubicl/skills-python-licenses/ \; \
+ && find /opt/qubicl/skills-venv -type d -name __pycache__ -prune -exec rm -rf '{}' + \
+ && chown -R qubicl:qubicl /opt/qubicl/skills-venv
+
+FROM document-inspection-base AS computer-runtime
+COPY skills-requirements.txt /opt/qubicl/skills-requirements.txt
+COPY SKILLS_THIRD_PARTY_NOTICES.txt /usr/share/doc/qubicl/
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends \
+      mousepad \
+      nano \
+      openssh-client \
+      openssh-server \
+      python3-pip \
+      thunar \
+      vim \
+      xfce4-panel \
+      xfce4-session \
+      xfce4-settings \
+      xfce4-terminal \
+      xfdesktop4 \
+      xfwm4 \
+ && rm -rf /var/lib/apt/lists/* \
+ && rm -f /etc/ssh/ssh_host_*_key* \
+ && python3 -m venv /opt/qubicl/skills-venv \
+ && /opt/qubicl/skills-venv/bin/pip install --no-cache-dir --requirement /opt/qubicl/skills-requirements.txt \
+ && install -d /usr/share/doc/qubicl/skills-python-licenses \
+ && find /opt/qubicl/skills-venv/lib -type f \( -iname 'LICENSE*' -o -iname 'COPYING*' \) \
+      -exec cp --parents '{}' /usr/share/doc/qubicl/skills-python-licenses/ \; \
+ && find /opt/qubicl/skills-venv -type d -name __pycache__ -prune -exec rm -rf '{}' + \
+ && chown -R qubicl:qubicl /opt/qubicl/skills-venv
+
+FROM computer-runtime AS workstation-runtime
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends \
+      build-essential \
+      iproute2 \
+      libreoffice \
+      netcat-openbsd \
+ && rm -rf /var/lib/apt/lists/* \
+ && install -d -m 0755 /etc/skel/.config/libreoffice/4/user
+
+COPY libreoffice-registrymodifications.xcu /etc/skel/.config/libreoffice/4/user/registrymodifications.xcu
+
+FROM filesystem-base AS file-system
+ARG QUBICL_MANIFEST_SHA256
+ARG QUBICL_CONTRACT_PRESET
+ARG QUBICL_CONTRACT_COMPATIBILITY
+ARG QUBICL_CONTRACT_CAPABILITIES
+COPY --chown=qubicl:qubicl manifests/file-system.json /opt/qubicl/computer-manifest.json
+ENV QUBICL_IMAGE_STARTUP_PROFILE=file-system
+LABEL dev.qubicl.contract-version="1" \
+      dev.qubicl.preset="$QUBICL_CONTRACT_PRESET" \
+      dev.qubicl.compatibility="$QUBICL_CONTRACT_COMPATIBILITY" \
+      dev.qubicl.capabilities="$QUBICL_CONTRACT_CAPABILITIES" \
+      dev.qubicl.manifest-sha256="$QUBICL_MANIFEST_SHA256"
+EXPOSE 3212
+
+FROM browser-runtime AS browser
+ARG QUBICL_MANIFEST_SHA256
+ARG QUBICL_CONTRACT_PRESET
+ARG QUBICL_CONTRACT_COMPATIBILITY
+ARG QUBICL_CONTRACT_CAPABILITIES
+COPY --chown=qubicl:qubicl manifests/browser.json /opt/qubicl/computer-manifest.json
+ENV QUBICL_IMAGE_STARTUP_PROFILE=browser
+LABEL dev.qubicl.contract-version="1" \
+      dev.qubicl.preset="$QUBICL_CONTRACT_PRESET" \
+      dev.qubicl.compatibility="$QUBICL_CONTRACT_COMPATIBILITY" \
+      dev.qubicl.capabilities="$QUBICL_CONTRACT_CAPABILITIES" \
+      dev.qubicl.manifest-sha256="$QUBICL_MANIFEST_SHA256"
+EXPOSE 3212 6080 6081
+
+FROM computer-runtime AS computer
+ARG QUBICL_MANIFEST_SHA256
+ARG QUBICL_CONTRACT_PRESET
+ARG QUBICL_CONTRACT_COMPATIBILITY
+ARG QUBICL_CONTRACT_CAPABILITIES
+COPY --chown=qubicl:qubicl manifests/computer.json /opt/qubicl/computer-manifest.json
+ENV QUBICL_IMAGE_STARTUP_PROFILE=desktop
+LABEL dev.qubicl.contract-version="1" \
+      dev.qubicl.preset="$QUBICL_CONTRACT_PRESET" \
+      dev.qubicl.compatibility="$QUBICL_CONTRACT_COMPATIBILITY" \
+      dev.qubicl.capabilities="$QUBICL_CONTRACT_CAPABILITIES" \
+      dev.qubicl.manifest-sha256="$QUBICL_MANIFEST_SHA256"
+EXPOSE 3212 6080 6081
+
+FROM workstation-runtime AS workstation
+ARG QUBICL_MANIFEST_SHA256
+ARG QUBICL_CONTRACT_PRESET
+ARG QUBICL_CONTRACT_COMPATIBILITY
+ARG QUBICL_CONTRACT_CAPABILITIES
+COPY --chown=qubicl:qubicl manifests/workstation.json /opt/qubicl/computer-manifest.json
+ENV QUBICL_IMAGE_STARTUP_PROFILE=workstation
+LABEL dev.qubicl.contract-version="1" \
+      dev.qubicl.preset="$QUBICL_CONTRACT_PRESET" \
+      dev.qubicl.compatibility="$QUBICL_CONTRACT_COMPATIBILITY" \
+      dev.qubicl.capabilities="$QUBICL_CONTRACT_CAPABILITIES" \
+      dev.qubicl.manifest-sha256="$QUBICL_MANIFEST_SHA256"
+EXPOSE 3212 6080 6081