Just gauging interest in this since this is how i prefer to run the desktop-tool myself. If you think this could be useful for others, happy to raise a pull request.
What
Add a Dockerfile to run the desktop-tool in a container, as an alternative to
downloading and running the compiled binary.
Why
Currently, users must download a compiled binary and run it directly on their system with full access to their filesystem, network, and credentials. This requires trusting the binary completely.
A Docker container provides:
- Sandboxing — the tool only sees a mounted volume with order files, not the entire host filesystem
- Portability — docker run works the same on any OS with Docker, no platform-specific binaries needed
- Simpler setup — no need to deal with Python versions, Chrome installations, or binary compatibility
How
The container runs the tool from Python source (no Nuitka compilation needed) with Chromium and a noVNC server. Users interact with the browser by opening localhost:6080 in their own browser — no VNC client needed.
docker run -it --rm \
-p 127.0.0.1:6080:6080 \
-v ./my-orders:/data \
ghcr.io/chilli-axe/mpc-autofill/desktop-tool:latest
I've got a working prototype at https://github.com/hotpheex/mpc-autofill/blob/desktpop-tool-docker/desktop-tool/Dockerfile
Implementation notes
- Based on python:3.13-slim with Chromium, TigerVNC, and noVNC
- WORKDIR /data so the tool's existing os.getcwd() logic finds XML files in the volume mount naturally
- tini as init process for signal handling
client_secrets.json is baked into the Nuitka binary at build time; for Docker it could also be baked in during image build in Github actions- A GitHub Actions workflow could build and push the image to GHCR on release (tagging version & latest)
Note: Due to baking in the browser environment for portability, the resulting image is quite big at ~ 1.3GB. If this is prohibitively large, there are alternative ways to cut it, but wouldn't quite work as an "all in one" package:
- python:3.13-slim base: ~150MB
- Chromium + deps (X11, GTK, fonts, media libs): ~900MB
- Python packages: ~200MB
- Everything else: ~50MB
Just gauging interest in this since this is how i prefer to run the desktop-tool myself. If you think this could be useful for others, happy to raise a pull request.
What
Add a Dockerfile to run the desktop-tool in a container, as an alternative to
downloading and running the compiled binary.
Why
Currently, users must download a compiled binary and run it directly on their system with full access to their filesystem, network, and credentials. This requires trusting the binary completely.
A Docker container provides:
How
The container runs the tool from Python source (no Nuitka compilation needed) with Chromium and a noVNC server. Users interact with the browser by opening localhost:6080 in their own browser — no VNC client needed.
I've got a working prototype at https://github.com/hotpheex/mpc-autofill/blob/desktpop-tool-docker/desktop-tool/Dockerfile
Implementation notes
client_secrets.jsonis baked into the Nuitka binary at build time; for Docker it could also be baked in during image build in Github actionsNote: Due to baking in the browser environment for portability, the resulting image is quite big at ~ 1.3GB. If this is prohibitively large, there are alternative ways to cut it, but wouldn't quite work as an "all in one" package: