feat: Simplify Docker builds and centralize frontend API configuration

Dockerfile

@@ -2,60 +2,26 @@ FROM golang:1.24-alpine AS builder
 
 WORKDIR /app
 
-# Install dependencies for builder including sqlc
 RUN apk add --no-cache git make bash curl
 
-# Install sqlc
-# RUN curl -L https://github.com/sqlc-dev/sqlc/releases/download/v1.29.0/sqlc_1.29.0_linux_amd64.tar.gz | tar -xz -C /usr/local/bin
-
 COPY go.mod go.sum ./
 RUN sed -i '/^tool github.com\/evilmartians\/lefthook/d' go.mod
 RUN go mod download
 
-# Copy source files needed for sqlc generation
-# COPY sqlc.yaml ./sqlc.yaml
-# COPY db/ ./db/
-
-# Generate sqlc code
-# RUN sqlc generate
-
-# Copy remaining source files (excluding db/ since it's already copied)
 COPY cmd/ ./cmd/
 COPY internal/ ./internal/
 COPY api/ ./api/
 COPY docs/ ./docs/
 COPY templates/ ./templates/
 COPY go.mod go.sum ./
 
-# Initial build of the application
 RUN CGO_ENABLED=0 GOOS=linux go build -a -installsuffix cgo -o guac cmd/guac/main.go
 
-# Final stage for running the application
-FROM alpine:3.20
-
-# Install Go, bash, ca-certificates, and openssl.
-# Go and bash are needed for Tilt's live_update run steps if they compile/run scripts.
-RUN apk --no-cache add ca-certificates openssl go bash
-
+FROM gcr.io/distroless/static:nonroot
 WORKDIR /app
-
-# Copy the built binary from the builder stage.
-COPY --from=builder /app/guac /app/guac
-# Copy templates (if your application uses them from filesystem at runtime)
-COPY --from=builder /app/templates /app/templates
-
-# Create and copy certificates as before
-RUN mkdir -p /app/certs
-# COPY --from=builder /app/certs/ /app/certs/ # This line might not be needed if certs are always generated
-RUN echo "Generating self-signed certificates..." && \
-    openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
-      -keyout /app/certs/private.key \
-      -out /app/certs/certificate.crt \
-      -subj "/C=US/ST=California/L=San Francisco/O=My Company/CN=mydomain.com"
-
-ENV CERT_PATH=/app/certs/certificate.crt
-ENV CERT_KEY_PATH=/app/certs/private.key
-ENV GUACD_ADDRESS=guacd:4822 
-
+COPY --from=builder --chown=nonroot:nonroot /app/guac /app/guac
+COPY --from=builder --chown=nonroot:nonroot /app/templates /app/templates
+ENV GUACD_ADDRESS=guacd:4822
 EXPOSE 4567
+USER nonroot:nonroot
 CMD ["/app/guac"]

Dockerfile.tilt

@@ -1,27 +1,8 @@
-FROM alpine:3.20
-
-# Install runtime dependencies only
-RUN apk --no-cache add ca-certificates openssl bash
-
+FROM gcr.io/distroless/static:debug-nonroot
 WORKDIR /app
-
-# Copy pre-compiled binary from local build
-COPY .tilt/guac /app/guac
-RUN chmod +x /app/guac
-
-# Copy templates
-COPY templates/ /app/templates/
-
-# Generate self-signed certificates
-RUN mkdir -p /app/certs && \
-    openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
-      -keyout /app/certs/private.key \
-      -out /app/certs/certificate.crt \
-      -subj "/C=US/ST=California/L=San Francisco/O=My Company/CN=mydomain.com"
-
-ENV CERT_PATH=/app/certs/certificate.crt
-ENV CERT_KEY_PATH=/app/certs/private.key
+COPY --chmod=755 --chown=nonroot:nonroot .tilt/guac /app/guac
+COPY --chown=nonroot:nonroot templates/ /app/templates/
 ENV GUACD_ADDRESS=guacd:4822
-
 EXPOSE 4567
+USER nonroot:nonroot
 CMD ["/app/guac"]

Makefile

@@ -1,25 +1,5 @@
 all: run
 
-# check if the certs directory exists and .key and .crt files exist
-ifneq ("$(wildcard certs)","")
-	ifneq ("$(wildcard certs/private.key)","")
-		ifneq ("$(wildcard certs/certificate.crt)","")
-			CERTS_EXIST := true
-		endif
-	endif
-endif
-# if certs exist, set the cert path and key path
-ifeq ($(CERTS_EXIST), true)
-	CERT_PATH := "$(shell pwd)/certs/certificate.crt"
-	CERT_KEY_PATH := "$(shell pwd)/certs/private.key"
-else
-	CERT_PATH := "$(shell pwd)/certs/certificate.crt"
-	CERT_KEY_PATH := "$(shell pwd)/certs/private.key"
-	bash ./certs/generate.sh
-endif
-
-
-
 # Install dependencies
 deps:
 	go mod tidy
@@ -52,9 +32,8 @@ lint:
 # run the server
 run: deps
 	@echo "Running server..."
-	@echo "Using certs from $(CERT_PATH) and $(CERT_KEY_PATH)"
 	@echo "Starting server..."
-	CERT_PATH=./certs/certificate.crt CERT_KEY_PATH=./certs/private.key go run cmd/guac/main.go
+	go run cmd/guac/main.go
 
 run_frontend:
 	@echo "Running frontend..."

deployments/manifest.yml

@@ -255,7 +255,7 @@ spec:
       serviceAccountName: browser-sandbox-sa
       containers:
         - name: api
-          image:  ghcr.io/browsersec/kubebrowse:sha-09dfa1f
+          image: ghcr.io/browsersec/kubebrowse:sha-09dfa1f
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 4567
@@ -397,7 +397,6 @@ roleRef:
   name: pod-manager
   apiGroup: rbac.authorization.k8s.io
 ---
-
 # ---
 # Cron Job to cleanup idle sessions
 # apiVersion: batch/v1
@@ -490,11 +489,11 @@ spec:
               cpu: "200m"
           env:
             - name: VITE_GUAC_CLIENT_URL
-              value: "https://browser-sandbox-api.browser-sandbox.svc.cluster.local:4567"
+              value: "http://browser-sandbox-api.browser-sandbox.svc.cluster.local:4567"
             - name: GUAC_CLIENT_URL
-              value: "https://browser-sandbox-api.browser-sandbox.svc.cluster.local:4567"
+              value: "http://browser-sandbox-api.browser-sandbox.svc.cluster.local:4567"
             - name: CADDY_GUAC_CLIENT_URL
-              value: "https://browser-sandbox-api.browser-sandbox.svc.cluster.local:4567"
+              value: "http://browser-sandbox-api.browser-sandbox.svc.cluster.local:4567"
 ---
 # Frontend Service
 apiVersion: v1
@@ -509,7 +508,7 @@ spec:
   ports:
     - port: 80
       targetPort: 80
-     # nodePort: 30007
+      # nodePort: 30007
   selector:
     app: "browser-sandbox-frontend"
 ---
@@ -527,4 +526,4 @@ spec:
     - name: rdp
       port: 3389
       targetPort: rdp # Matches the named port "rdp" (3389) in the pod spec
----
+---

frontend/.env.example

@@ -0,0 +1,2 @@
+# Backend origin for local development (no TLS)
+VITE_API_BASE_URL=http://localhost:4567

frontend/Caddyfile

@@ -17,10 +17,6 @@
     # Authentication endpoints - proxy to backend API
     handle /auth/* {
         reverse_proxy {$CADDY_GUAC_CLIENT_URL} {
-            transport http {
-                tls
-                tls_insecure_skip_verify
-            }
             header_up Host {http.reverse_proxy.upstream.hostport}
             header_up Connection {header.Connection}
             header_up Upgrade {header.Upgrade}
@@ -34,10 +30,6 @@
     # Session management endpoints
     handle /sessions/* {
         reverse_proxy {$CADDY_GUAC_CLIENT_URL} {
-            transport http {
-                tls
-                tls_insecure_skip_verify
-            }
             header_up Host {http.reverse_proxy.upstream.hostport}
             header_up Connection {header.Connection}
             header_up Upgrade {header.Upgrade}
@@ -51,10 +43,6 @@
     # API v1 endpoints
     handle /api/v1/* {
         reverse_proxy {$CADDY_GUAC_CLIENT_URL} {
-            transport http {
-                tls
-                tls_insecure_skip_verify
-            }
             header_up Host {http.reverse_proxy.upstream.hostport}
             header_up Connection {header.Connection}
             header_up Upgrade {header.Upgrade}
@@ -68,10 +56,6 @@
     # Tunnel endpoints
     handle /tunnel* {
         reverse_proxy {$CADDY_GUAC_CLIENT_URL} {
-            transport http {
-                tls
-                tls_insecure_skip_verify
-            }
             header_up Host {http.reverse_proxy.upstream.hostport}
             header_up Connection {header.Connection}
             header_up Upgrade {header.Upgrade}
@@ -85,10 +69,6 @@
     # WebSocket tunnel endpoints
     handle /websocket-tunnel* {
         reverse_proxy {$CADDY_GUAC_CLIENT_URL} {
-            transport http {
-                tls
-                tls_insecure_skip_verify
-            }
             header_up Host {http.reverse_proxy.upstream.hostport}
             header_up Connection {header.Connection}
             header_up Upgrade {header.Upgrade}

frontend/index.html

@@ -4,7 +4,7 @@
     <meta charset="UTF-8" />
     <link rel="icon" type="image/svg+xml" href="/vite.svg" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-    <title>Vite + React</title>
+    <title>KubeBrowse</title>
   </head>
   <body>
     <div id="root"></div>

frontend/src/components/BrowserSession.jsx

@@ -4,11 +4,7 @@ import SessionReconnectStatus from "./SessionReconnectStatus";
 import { Button } from "@/components/ui/button";
 import { Card, CardContent } from "@/components/ui/card";
 import { Badge } from "@/components/ui/badge";
-
-// const API_BASE = import.meta.env.VITE_GUAC_CLIENT_URL || `${isSecure ? 'https' : 'http'}://${location.host}`;
-// const API_BASE = 'https://152.53.244.80:30006'
-// const API_BASE = 'http://localhost:4567'
-const API_BASE = ""; // Use relative URLs to leverage Vite's proxy
+import { API_BASE } from "../config";
 
 // Session persistence keys
 const SESSION_STORAGE_KEY = "kubeBrowse_browserSession";