devops(docker): route apt through the Azure Debian mirror (#1759)

## Summary
- The docker publish pipeline fails in `playwright-core install-deps
chromium`: the agents cannot reach `deb.debian.org` (it resolves to
`192.0.2.133`, TEST-NET-1), so apt gets no package lists and every
browser dependency is `Unable to locate package`.
- Add a `DEBIAN_MIRROR_HOST` build arg and set it to
`debian-archive.trafficmanager.net` in the pipeline. This mirrors what
playwright does with `UBUNTU_MIRROR_PREFIX: "azure."`; the Azure Debian
mirror is a different host rather than a prefix of `deb.debian.org`,
hence the different shape.
- apt is repointed only for the duration of `install-deps` and restored
right after, so the published image keeps `deb.debian.org` for anyone
running apt in a derived image.
- Default is `deb.debian.org`, so local and GitHub Actions builds are
unchanged.

Author: yury-s

.azure-pipelines/publish-docker.yml

@@ -119,4 +119,6 @@ extends:
             script: "./utils/docker/publish_docker.sh ${{ parameters.releaseChannel }}"
           env:
             ACR_CACHE_PREFIX: "playwright.azurecr.io/cached/"
+            # The agents cannot reach deb.debian.org, so apt goes through the Azure mirror.
+            DEBIAN_MIRROR_HOST: "debian-archive.trafficmanager.net"
             NPMRC_SECRET: "$(Build.SourcesDirectory)/.npmrc"

Dockerfile

@@ -1,6 +1,8 @@
 ARG PLAYWRIGHT_BROWSERS_PATH=/ms-playwright
 # Registry prefix for the base image, e.g. 'playwright.azurecr.io/cached/' in the publish pipeline.
 ARG ACR_CACHE_PREFIX
+# Debian archive host used by apt, e.g. 'debian-archive.trafficmanager.net' in the publish pipeline.
+ARG DEBIAN_MIRROR_HOST=deb.debian.org
 
 # ------------------------------
 # Base
@@ -11,6 +13,7 @@ FROM ${ACR_CACHE_PREFIX}node:22-bookworm-slim AS base
 
 ARG PLAYWRIGHT_BROWSERS_PATH
 ENV PLAYWRIGHT_BROWSERS_PATH=${PLAYWRIGHT_BROWSERS_PATH}
+ARG DEBIAN_MIRROR_HOST
 
 # Set the working directory
 WORKDIR /app
@@ -20,8 +23,11 @@ RUN --mount=type=cache,target=/root/.npm,sharing=locked,id=npm-cache \
     --mount=type=bind,source=package-lock.json,target=package-lock.json \
     --mount=type=secret,id=npmrc,target=/root/.npmrc,required=false \
   npm ci --omit=dev && \
-  # Install system dependencies for playwright
-  npx -y playwright-core install-deps chromium
+  # Install system dependencies for playwright. apt is pointed at the mirror only for
+  # the duration of the install, so the published image keeps the default archive host.
+  sed -i "s|deb.debian.org|${DEBIAN_MIRROR_HOST}|g" /etc/apt/sources.list.d/debian.sources && \
+  npx -y playwright-core install-deps chromium && \
+  sed -i "s|${DEBIAN_MIRROR_HOST}|deb.debian.org|g" /etc/apt/sources.list.d/debian.sources
 
 # ------------------------------
 # Builder

utils/docker/build.sh

@@ -11,8 +11,9 @@ if [[ ($1 == '--help') || ($1 == '-h') || ($1 == '') || ($2 == '') ]]; then
   echo "  docker run -i --rm --init playwright-mcp:localbuild"
   echo ""
   echo "Optional environment variables:"
-  echo "  ACR_CACHE_PREFIX  registry prefix for the base image, e.g. 'playwright.azurecr.io/cached/'"
-  echo "  NPMRC_SECRET      path to an .npmrc to use for 'npm ci' inside the image (BuildKit secret)"
+  echo "  ACR_CACHE_PREFIX     registry prefix for the base image, e.g. 'playwright.azurecr.io/cached/'"
+  echo "  DEBIAN_MIRROR_HOST   apt archive host, e.g. 'debian-archive.trafficmanager.net'"
+  echo "  NPMRC_SECRET         path to an .npmrc to use for 'npm ci' inside the image (BuildKit secret)"
   echo ""
   exit 0
 fi
@@ -38,6 +39,12 @@ if [[ -n "${NPMRC_SECRET:-}" ]]; then
   SECRET_ARGS+=(--secret "id=npmrc,src=${NPMRC_SECRET}")
 fi
 
+# Only override the Dockerfile's default archive host when a mirror is requested.
+MIRROR_ARGS=()
+if [[ -n "${DEBIAN_MIRROR_HOST:-}" ]]; then
+  MIRROR_ARGS+=(--build-arg "DEBIAN_MIRROR_HOST=${DEBIAN_MIRROR_HOST}")
+fi
+
 # Keep each arch image a plain single-platform manifest without the unknown/unknown platform entry.
 export BUILDX_NO_DEFAULT_ATTESTATIONS=1
 
@@ -54,6 +61,7 @@ fi
 for ((attempt = 1; attempt <= MAX_ATTEMPTS; attempt++)); do
   if docker build --platform "${PLATFORM}" \
       --build-arg ACR_CACHE_PREFIX="${ACR_CACHE_PREFIX:-}" \
+      "${MIRROR_ARGS[@]}" \
       "${SECRET_ARGS[@]}" \
       -t "$2" -f Dockerfile .; then
     exit 0