fix(docker): Address remaining PR #745 review comments

- Move Playwright install after node_modules copy to use pinned version
- Use local playwright binary instead of npx to avoid registry fetch
- Add --user automaker -w /app flags to docker exec commands
- Change bold text to proper heading in README (MD036 lint fix)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Dockerfile

@@ -119,13 +119,6 @@ RUN curl -fsSL https://opencode.ai/install | bash && \
     ls -la /home/automaker/.local/bin/ && \
     (which opencode && opencode --version) || echo "opencode installed (may need auth setup)"
 
-# Install Playwright Chromium browser for AI agent verification tests
-# This adds ~300MB to the image but enables automated testing mode out of the box
-# Clean up npx cache after installation to reduce image size
-RUN npx playwright install chromium && \
-    echo "=== Playwright Chromium installed ===" && \
-    ls -la /home/automaker/.cache/ms-playwright/ || echo "Playwright browsers installed" && \
-    rm -rf /home/automaker/.npm/_npx
 USER root
 
 # Add PATH to profile so it's available in all interactive shells (for login shells)
@@ -155,6 +148,15 @@ COPY --from=server-builder /app/apps/server/package*.json ./apps/server/
 # Copy node_modules (includes symlinks to libs)
 COPY --from=server-builder /app/node_modules ./node_modules
 
+# Install Playwright Chromium browser for AI agent verification tests
+# This adds ~300MB to the image but enables automated testing mode out of the box
+# Using the locally installed playwright ensures we use the pinned version from package-lock.json
+USER automaker
+RUN ./node_modules/.bin/playwright install chromium && \
+    echo "=== Playwright Chromium installed ===" && \
+    ls -la /home/automaker/.cache/ms-playwright/ || echo "Playwright browsers installed"
+USER root
+
 # Create data and projects directories
 RUN mkdir -p /data /projects && chown automaker:automaker /data /projects
 

README.md

@@ -344,7 +344,7 @@ The Docker image includes **Playwright Chromium pre-installed** for AI agent ver
 
 **No additional setup required** - Playwright verification works out of the box.
 
-**Optional: Persist browsers for manual updates**
+#### Optional: Persist browsers for manual updates
 
 By default, Playwright Chromium is pre-installed in the Docker image. If you need to manually update browsers or want to persist browser installations across container restarts (not image rebuilds), you can mount a volume.
 
@@ -352,7 +352,7 @@ By default, Playwright Chromium is pre-installed in the Docker image. If you nee
 
 ```bash
 # After adding the volume mount for the first time
-docker exec automaker-server npx playwright install chromium
+docker exec --user automaker -w /app automaker-server npx playwright install chromium
 ```
 
 Add this to your `docker-compose.override.yml`:
@@ -371,7 +371,7 @@ volumes:
 **Updating browsers manually:**
 
 ```bash
-docker exec automaker-server npx playwright install chromium
+docker exec --user automaker -w /app automaker-server npx playwright install chromium
 ```
 
 ### Testing

docker-compose.override.yml.example

@@ -27,7 +27,7 @@ services:
       # - playwright-cache:/home/automaker/.cache/ms-playwright
       #
       # To update Playwright browsers manually:
-      #   docker exec automaker-server npx playwright install chromium
+      #   docker exec --user automaker -w /app automaker-server npx playwright install chromium
     environment:
       # Set root directory for all projects and file operations
       # Users can only create/open projects within this directory