From f432b2bc07d8c419ee069782de3eec79db148f45 Mon Sep 17 00:00:00 2001
From: Jad Seifeddine <jad.seifeddine@icloud.com>
Date: Mon, 19 Oct 2026 14:48:27 +0700
Subject: [PATCH] docker: ship the seccomp profile in the image

Copy contrib/docker/seccomp-chromium.json to
/opt/rustguac/seccomp-chromium.json so users of the published image can
extract the profile that matches their image version, the same way the
docs already extract config.toml.default:

  docker run --rm --entrypoint cat <image> \
    /opt/rustguac/seccomp-chromium.json > seccomp-chromium.json

The file is only read by the Docker client when the container is
created; nothing inside the container uses it.

Refs #307
---
 Dockerfile | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/Dockerfile b/Dockerfile
index 5145b70..9b5b655 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -120,6 +120,10 @@ COPY --from=rust-builder /build/target/release/rustguac /opt/rustguac/bin/rustgu
 # Install static web assets
 COPY static/ /opt/rustguac/static/
 
+# Seccomp profile that lets Chromium's sandbox start, for the host to pass to
+# `docker run --security-opt seccomp=...` (see docs/web-sessions.md)
+COPY contrib/docker/seccomp-chromium.json /opt/rustguac/seccomp-chromium.json
+
 # Library path for guacd
 RUN echo "/opt/rustguac/lib" > /etc/ld.so.conf.d/rustguac.conf && ldconfig