From 5205d0830e4ed49027e9bb7a0c806ee46595f1b8 Mon Sep 17 00:00:00 2001
From: Yury Semikhatsky <yurys@chromium.org>
Date: Tue, 15 Sep 2026 09:48:28 -0700
Subject: [PATCH 1/4] devops: move docker publishing to Azure DevOps

The GitHub Actions workflow failed to log in to Azure for v1.63.0.
Port upstream's .azure-pipelines/publish-docker.yml (microsoft/playwright#41724).
---
 .azure-pipelines/publish-docker.yml           | 114 ++++++++++++++++++
 .azure-pipelines/settings.xml                 |   3 +-
 .../skills/playwright-java-release/SKILL.md   |   2 +-
 .dockerignore                                 |   3 +
 .github/workflows/publish_docker.yml          |  30 -----
 utils/docker/Dockerfile.jammy                 |  14 ++-
 utils/docker/Dockerfile.noble                 |  14 ++-
 utils/docker/Dockerfile.resolute              |  14 ++-
 utils/docker/build.sh                         |  15 ++-
 utils/docker/publish_docker.sh                |  75 ++++++------
 10 files changed, 208 insertions(+), 76 deletions(-)
 create mode 100644 .azure-pipelines/publish-docker.yml
 create mode 100644 .dockerignore
 delete mode 100644 .github/workflows/publish_docker.yml

diff --git a/.azure-pipelines/publish-docker.yml b/.azure-pipelines/publish-docker.yml
new file mode 100644
index 000000000..0848a3275
--- /dev/null
+++ b/.azure-pipelines/publish-docker.yml
@@ -0,0 +1,114 @@
+# Trigger: any `v*` release tag (e.g. v1.40.0).
+# Can also be queued manually from the ADO UI, e.g. on a release-1.X branch
+# whose Maven version has already been marked as 1.X.0.
+trigger:
+  tags:
+    include:
+      - v*
+    exclude:
+      - v*-*
+
+pr: none
+
+resources:
+  repositories:
+  - repository: 1esPipelines
+    type: git
+    name: 1ESPipelineTemplates/1ESPipelineTemplates
+    ref: refs/tags/release
+
+extends:
+  template: v1/1ES.Official.PipelineTemplate.yml@1esPipelines
+  parameters:
+    pool:
+      name: DevDivPlaywrightAzurePipelinesUbuntu2204
+      os: linux
+    sdl:
+      sourceAnalysisPool:
+        name: DevDivPlaywrightAzurePipelinesWindows2022
+        # The image must be windows-based due to restrictions of the SDL tools. See: https://aka.ms/AAo6v8e
+        os: windows
+      suppression:
+        suppressionFile: $(Build.SourcesDirectory)\.azure-pipelines\guardian\SDL\.gdnsuppress
+    stages:
+    - stage: Publish
+      jobs:
+      - job: PublishDocker
+        displayName: "Publish Docker images to ACR"
+        # arm64 images are cross-built under QEMU emulation, which is slow.
+        timeoutInMinutes: 360
+        steps:
+        - checkout: self
+          displayName: "Checkout code"
+
+        - task: UseNode@1
+          inputs:
+            version: '26.x'
+          displayName: "Install Node.js"
+
+        # Relocate the Docker data-root to the large /mnt volume: this job builds
+        # 6 images (jammy/noble/resolute x amd64/arm64) and `docker system prune`s
+        # between them, so the default disk fills up.
+        - task: Bash@3
+          displayName: "Setup docker"
+          inputs:
+            targetType: "inline"
+            script: |
+              set -x
+              sudo service docker stop
+              sudo mkdir -p /etc/docker
+              echo '{ "data-root": "/mnt/docker" }' | sudo tee /etc/docker/daemon.json
+              sudo service docker start
+
+        # Used by scripts/download_driver.sh on the host. The repository root is the
+        # Docker build context, so .dockerignore keeps this file out of the images.
+        - task: Bash@3
+          displayName: "setup .npmrc"
+          inputs:
+            targetType: "inline"
+            script: |
+              echo "registry=https://devdiv.pkgs.visualstudio.com/DevDiv/_packaging/DevDiv_PublicPackages/npm/registry/" >> .npmrc
+
+        - task: npmAuthenticate@0
+          displayName: "authenticate the private npm registry"
+          inputs:
+            workingFile: .npmrc
+
+        # Must run before MavenAuthenticate@0 so the credentials it injects into
+        # ~/.m2/settings.xml are not overwritten by the copy.
+        - bash: |
+            mkdir -p ~/.m2
+            cp .azure-pipelines/settings.xml ~/.m2/settings.xml
+          displayName: 'Copy settings.xml (mirror Maven Central to DevDiv_PublicPackages)'
+
+        - task: MavenAuthenticate@0
+          displayName: 'Authenticate to DevDiv_PublicPackages feed'
+          inputs:
+            artifactsFeeds: DevDiv_PublicPackages
+
+        - task: AzureCLI@2
+          displayName: "Login to ACR via OIDC"
+          inputs:
+            azureSubscription: "Playwright-CDN"
+            scriptType: "bash"
+            scriptLocation: "inlineScript"
+            inlineScript: "az acr login --name playwright"
+
+        - task: Bash@3
+          displayName: "Register QEMU (binfmt) for arm64 cross-build"
+          inputs:
+            targetType: "inline"
+            script: "docker run --rm --privileged ${ACR_CACHE_PREFIX}tonistiigi/binfmt --install arm64"
+          env:
+            ACR_CACHE_PREFIX: "playwright.azurecr.io/cached/"
+
+        - task: Bash@3
+          displayName: "Build & publish Docker images"
+          inputs:
+            targetType: "inline"
+            # The authenticated settings.xml is passed to `docker build` as a secret so
+            # that Maven inside the image also resolves from DevDiv_PublicPackages.
+            script: "MAVEN_SETTINGS_SECRET=\"$HOME/.m2/settings.xml\" ./utils/docker/publish_docker.sh stable"
+          env:
+            ACR_CACHE_PREFIX: "playwright.azurecr.io/cached/"
+            UBUNTU_MIRROR_PREFIX: "azure."
diff --git a/.azure-pipelines/settings.xml b/.azure-pipelines/settings.xml
index 34e9be56f..1617d36e9 100644
--- a/.azure-pipelines/settings.xml
+++ b/.azure-pipelines/settings.xml
@@ -1,6 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <!--
-  Maven settings used only by the Azure Pipelines release build (publish.yml).
+  Maven settings used only by the Azure Pipelines release builds (publish.yml and
+  publish-docker.yml).
 
   Routes all remote artifact and plugin resolution through the DevDiv_PublicPackages
   Azure Artifacts feed instead of Maven Central, as required by SFI-ES4.2.4.
diff --git a/.claude/skills/playwright-java-release/SKILL.md b/.claude/skills/playwright-java-release/SKILL.md
index e38b88689..93b6450fb 100644
--- a/.claude/skills/playwright-java-release/SKILL.md
+++ b/.claude/skills/playwright-java-release/SKILL.md
@@ -73,4 +73,4 @@ gh pr create --repo microsoft/playwright-java --head <user>:mark-v-1.X.0 --base
 
 ## 4. Publish
 
-The user publishes the draft release manually once the `mark-v-1.X.0` PR is merged. After publishing, CI pushes the artifacts to Maven Central and runs the Docker workflow automatically: https://github.com/microsoft/playwright-java/actions.
+The user publishes the draft release manually once the `mark-v-1.X.0` PR is merged. After publishing, the `v1.X.0` tag triggers the Azure DevOps pipelines that push the artifacts to Maven Central (`.azure-pipelines/publish.yml`) and the Docker images to ACR (`.azure-pipelines/publish-docker.yml`).
diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 000000000..58b22b6cf
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,3 @@
+# The repository root is the Docker build context (see utils/docker/build.sh).
+# Keep registry credentials written by the release pipeline out of the images.
+.npmrc
diff --git a/.github/workflows/publish_docker.yml b/.github/workflows/publish_docker.yml
deleted file mode 100644
index bf1fd3338..000000000
--- a/.github/workflows/publish_docker.yml
+++ /dev/null
@@ -1,30 +0,0 @@
-name: Publish Release Docker
-on:
-  release:
-    types: [published]
-  workflow_dispatch:
-jobs:
-  publish-canary-docker:
-    name: publish to DockerHub
-    runs-on: ubuntu-22.04
-    permissions:
-      id-token: write   # This is required for OIDC login (azure/login) to succeed
-      contents: read    # This is required for actions/checkout to succeed
-    environment: Docker
-    if: github.repository == 'microsoft/playwright-java'
-    steps:
-    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-    - name: Azure login
-      uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3.0.1
-      with:
-        client-id: ${{ secrets.AZURE_DOCKER_CLIENT_ID }}
-        tenant-id: ${{ secrets.AZURE_DOCKER_TENANT_ID }}
-        subscription-id: ${{ secrets.AZURE_DOCKER_SUBSCRIPTION_ID }}
-    - name: Login to ACR via OIDC
-      run: az acr login --name playwright
-    - name: Set up Docker QEMU for arm64 docker builds
-      uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
-      with:
-        platforms: arm64
-    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-    - run: ./utils/docker/publish_docker.sh stable
diff --git a/utils/docker/Dockerfile.jammy b/utils/docker/Dockerfile.jammy
index aa64ef493..8a66188fd 100644
--- a/utils/docker/Dockerfile.jammy
+++ b/utils/docker/Dockerfile.jammy
@@ -1,15 +1,19 @@
-FROM ubuntu:jammy
+ARG ACR_CACHE_PREFIX
+FROM ${ACR_CACHE_PREFIX}ubuntu:jammy
 
 ARG DEBIAN_FRONTEND=noninteractive
 ARG TZ=America/Los_Angeles
 ARG DOCKER_IMAGE_NAME_TEMPLATE="mcr.microsoft.com/playwright/java:v%version%-jammy"
+ARG UBUNTU_MIRROR_PREFIX
 
 ENV LANG=C.UTF-8
 ENV LC_ALL=C.UTF-8
 
 # === INSTALL JDK and Maven ===
 
-RUN apt-get update && \
+RUN find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \) \
+      -exec sed -i "s|http://archive.ubuntu.com|http://${UBUNTU_MIRROR_PREFIX}archive.ubuntu.com|g; s|http://ports.ubuntu.com|http://${UBUNTU_MIRROR_PREFIX}ports.ubuntu.com|g" {} + && \
+    apt-get update && \
     apt-get install -y --no-install-recommends openjdk-25-jdk \
     # Install utilities required for downloading browsers
     wget \
@@ -47,7 +51,11 @@ RUN mkdir /ms-playwright && \
 
 COPY . /tmp/pw-java
 
-RUN cd /tmp/pw-java && \
+# The optional Maven settings secret routes dependency resolution through a mirror
+# (see .azure-pipelines/publish-docker.yml). Secrets are not persisted in the image.
+RUN --mount=type=secret,id=mavensettings,required=false \
+    if [ -f /run/secrets/mavensettings ]; then export MAVEN_ARGS="--settings /run/secrets/mavensettings"; fi && \
+    cd /tmp/pw-java && \
     mvn install -D skipTests --no-transfer-progress && \
     mvn exec:java -e -D exec.mainClass=com.microsoft.playwright.CLI \
                      -D exec.args="install-driver" -f playwright/pom.xml --no-transfer-progress && \
diff --git a/utils/docker/Dockerfile.noble b/utils/docker/Dockerfile.noble
index eafb59ba4..2d19f2047 100644
--- a/utils/docker/Dockerfile.noble
+++ b/utils/docker/Dockerfile.noble
@@ -1,15 +1,19 @@
-FROM ubuntu:noble
+ARG ACR_CACHE_PREFIX
+FROM ${ACR_CACHE_PREFIX}ubuntu:noble
 
 ARG DEBIAN_FRONTEND=noninteractive
 ARG TZ=America/Los_Angeles
 ARG DOCKER_IMAGE_NAME_TEMPLATE="mcr.microsoft.com/playwright/java:v%version%-noble"
+ARG UBUNTU_MIRROR_PREFIX
 
 ENV LANG=C.UTF-8
 ENV LC_ALL=C.UTF-8
 
 # === INSTALL JDK and Maven ===
 
-RUN apt-get update && \
+RUN find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \) \
+      -exec sed -i "s|http://archive.ubuntu.com|http://${UBUNTU_MIRROR_PREFIX}archive.ubuntu.com|g; s|http://ports.ubuntu.com|http://${UBUNTU_MIRROR_PREFIX}ports.ubuntu.com|g" {} + && \
+    apt-get update && \
     apt-get install -y --no-install-recommends openjdk-25-jdk \
     # Install utilities required for downloading browsers
     wget \
@@ -47,7 +51,11 @@ RUN mkdir /ms-playwright && \
 
 COPY . /tmp/pw-java
 
-RUN cd /tmp/pw-java && \
+# The optional Maven settings secret routes dependency resolution through a mirror
+# (see .azure-pipelines/publish-docker.yml). Secrets are not persisted in the image.
+RUN --mount=type=secret,id=mavensettings,required=false \
+    if [ -f /run/secrets/mavensettings ]; then export MAVEN_ARGS="--settings /run/secrets/mavensettings"; fi && \
+    cd /tmp/pw-java && \
     mvn install -D skipTests --no-transfer-progress && \
     mvn exec:java -e -D exec.mainClass=com.microsoft.playwright.CLI \
                      -D exec.args="install-driver" -f playwright/pom.xml --no-transfer-progress && \
diff --git a/utils/docker/Dockerfile.resolute b/utils/docker/Dockerfile.resolute
index 64a68de4a..a497a7010 100644
--- a/utils/docker/Dockerfile.resolute
+++ b/utils/docker/Dockerfile.resolute
@@ -1,15 +1,19 @@
-FROM ubuntu:resolute
+ARG ACR_CACHE_PREFIX
+FROM ${ACR_CACHE_PREFIX}ubuntu:resolute
 
 ARG DEBIAN_FRONTEND=noninteractive
 ARG TZ=America/Los_Angeles
 ARG DOCKER_IMAGE_NAME_TEMPLATE="mcr.microsoft.com/playwright/java:v%version%-resolute"
+ARG UBUNTU_MIRROR_PREFIX
 
 ENV LANG=C.UTF-8
 ENV LC_ALL=C.UTF-8
 
 # === INSTALL JDK and Maven ===
 
-RUN apt-get update && \
+RUN find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \) \
+      -exec sed -i "s|http://archive.ubuntu.com|http://${UBUNTU_MIRROR_PREFIX}archive.ubuntu.com|g; s|http://ports.ubuntu.com|http://${UBUNTU_MIRROR_PREFIX}ports.ubuntu.com|g" {} + && \
+    apt-get update && \
     apt-get install -y --no-install-recommends openjdk-25-jdk \
     # Install utilities required for downloading browsers
     wget \
@@ -47,7 +51,11 @@ RUN mkdir /ms-playwright && \
 
 COPY . /tmp/pw-java
 
-RUN cd /tmp/pw-java && \
+# The optional Maven settings secret routes dependency resolution through a mirror
+# (see .azure-pipelines/publish-docker.yml). Secrets are not persisted in the image.
+RUN --mount=type=secret,id=mavensettings,required=false \
+    if [ -f /run/secrets/mavensettings ]; then export MAVEN_ARGS="--settings /run/secrets/mavensettings"; fi && \
+    cd /tmp/pw-java && \
     mvn install -D skipTests --no-transfer-progress && \
     mvn exec:java -e -D exec.mainClass=com.microsoft.playwright.CLI \
                      -D exec.args="install-driver" -f playwright/pom.xml --no-transfer-progress && \
diff --git a/utils/docker/build.sh b/utils/docker/build.sh
index 649922f07..10064902a 100755
--- a/utils/docker/build.sh
+++ b/utils/docker/build.sh
@@ -38,4 +38,17 @@ PW_TARGET_ARCH=$(echo $1 | cut -c3-)
 # it up via `COPY . /tmp/pw-java`.
 ../../scripts/download_driver.sh
 
-docker build --platform "${PLATFORM}" --build-arg "PW_TARGET_ARCH=${PW_TARGET_ARCH}" -t "$3" -f "Dockerfile.$2" ../../
+SECRET_ARGS=()
+if [[ -n "${MAVEN_SETTINGS_SECRET:-}" ]]; then
+  SECRET_ARGS+=(--secret "id=mavensettings,src=${MAVEN_SETTINGS_SECRET}")
+fi
+
+# Keep each arch image a plain single-platform manifest without the unknown/unknown platform entry.
+export BUILDX_NO_DEFAULT_ATTESTATIONS=1
+
+docker build --platform "${PLATFORM}" \
+  --build-arg "PW_TARGET_ARCH=${PW_TARGET_ARCH}" \
+  --build-arg ACR_CACHE_PREFIX="${ACR_CACHE_PREFIX}" \
+  --build-arg UBUNTU_MIRROR_PREFIX="${UBUNTU_MIRROR_PREFIX}" \
+  "${SECRET_ARGS[@]}" \
+  -t "$3" -f "Dockerfile.$2" ../../
diff --git a/utils/docker/publish_docker.sh b/utils/docker/publish_docker.sh
index fb5ea2bb8..82d0ae3be 100755
--- a/utils/docker/publish_docker.sh
+++ b/utils/docker/publish_docker.sh
@@ -43,6 +43,20 @@ RESOLUTE_TAGS=(
   "v${PW_VERSION}-resolute"
 )
 
+tags_for_flavor() {
+  local FLAVOR="$1"
+  if [[ "$FLAVOR" == "jammy" ]]; then
+    echo "${JAMMY_TAGS[@]}"
+  elif [[ "$FLAVOR" == "noble" ]]; then
+    echo "${NOBLE_TAGS[@]}"
+  elif [[ "$FLAVOR" == "resolute" ]]; then
+    echo "${RESOLUTE_TAGS[@]}"
+  else
+    echo "ERROR: unknown flavor - $FLAVOR. Must be either 'jammy', 'noble', or 'resolute'" >&2
+    exit 1
+  fi
+}
+
 tag_and_push() {
   local source="$1"
   local target="$2"
@@ -66,25 +80,19 @@ install_oras_if_needed() {
     return
   fi
   local version="1.1.0"
-  curl -sLO "https://github.com/oras-project/oras/releases/download/v${version}/oras_${version}_linux_amd64.tar.gz"
+  local arch="amd64"
+  if [[ "$(uname -m)" == "aarch64" || "$(uname -m)" == "arm64" ]]; then
+    arch="arm64"
+  fi
+  curl -sLO "https://github.com/oras-project/oras/releases/download/v${version}/oras_${version}_linux_${arch}.tar.gz"
   mkdir -p oras
-  tar -zxf oras_${version}_linux_amd64.tar.gz -C oras
-  rm oras_${version}_linux_amd64.tar.gz
+  tar -zxf oras_${version}_linux_${arch}.tar.gz -C oras
+  rm oras_${version}_linux_${arch}.tar.gz
 }
 
 publish_docker_images_with_arch_suffix() {
   local FLAVOR="$1"
-  local TAGS=()
-  if [[ "$FLAVOR" == "jammy" ]]; then
-    TAGS=("${JAMMY_TAGS[@]}")
-  elif [[ "$FLAVOR" == "noble" ]]; then
-    TAGS=("${NOBLE_TAGS[@]}")
-  elif [[ "$FLAVOR" == "resolute" ]]; then
-    TAGS=("${RESOLUTE_TAGS[@]}")
-  else
-    echo "ERROR: unknown flavor - $FLAVOR. Must be either 'jammy', 'noble', or 'resolute'"
-    exit 1
-  fi
+  local TAGS=($(tags_for_flavor "$FLAVOR"))
   local ARCH="$2"
   if [[ "$ARCH" != "amd64" && "$ARCH" != "arm64" ]]; then
     echo "ERROR: unknown arch - $ARCH. Must be either 'amd64' or 'arm64'"
@@ -102,17 +110,7 @@ publish_docker_images_with_arch_suffix() {
 
 publish_docker_manifest () {
   local FLAVOR="$1"
-  local TAGS=()
-  if [[ "$FLAVOR" == "jammy" ]]; then
-    TAGS=("${JAMMY_TAGS[@]}")
-  elif [[ "$FLAVOR" == "noble" ]]; then
-    TAGS=("${NOBLE_TAGS[@]}")
-  elif [[ "$FLAVOR" == "resolute" ]]; then
-    TAGS=("${RESOLUTE_TAGS[@]}")
-  else
-    echo "ERROR: unknown flavor - $FLAVOR. Must be either 'jammy', 'noble', or 'resolute'"
-    exit 1
-  fi
+  local TAGS=($(tags_for_flavor "$FLAVOR"))
 
   for ((i = 0; i < ${#TAGS[@]}; i++)) do
     local TAG="${TAGS[$i]}"
@@ -129,14 +127,23 @@ publish_docker_manifest () {
   done
 }
 
-publish_docker_images_with_arch_suffix jammy amd64
-publish_docker_images_with_arch_suffix jammy arm64
-publish_docker_manifest jammy amd64 arm64
+build_and_push_arch() {
+  local ARCH="$1"
+  publish_docker_images_with_arch_suffix jammy "${ARCH}"     # Ubuntu 22.04
+  publish_docker_images_with_arch_suffix noble "${ARCH}"     # Ubuntu 24.04
+  publish_docker_images_with_arch_suffix resolute "${ARCH}"  # Ubuntu 26.04
+}
 
-publish_docker_images_with_arch_suffix noble amd64
-publish_docker_images_with_arch_suffix noble arm64
-publish_docker_manifest noble amd64 arm64
+publish_manifests() {
+  publish_docker_manifest jammy amd64 arm64     # Ubuntu 22.04
+  publish_docker_manifest noble amd64 arm64     # Ubuntu 24.04
+  publish_docker_manifest resolute amd64 arm64  # Ubuntu 26.04
+}
 
-publish_docker_images_with_arch_suffix resolute amd64
-publish_docker_images_with_arch_suffix resolute arm64
-publish_docker_manifest resolute amd64 arm64
+# arm64 first: its QEMU-emulated builds must run while the host is fresh. Running
+# them after the native amd64 builds have churned the host triggers a qemu
+# segfault in aarch64 ldconfig during libc-bin setup. amd64 is a native build and
+# is unaffected by preceding work, so it goes second.
+build_and_push_arch arm64
+build_and_push_arch amd64
+publish_manifests

From 1087f786f58738d536002063137a69043fd8d539 Mon Sep 17 00:00:00 2001
From: Yury Semikhatsky <yurys@chromium.org>
Date: Tue, 15 Sep 2026 09:52:56 -0700
Subject: [PATCH 2/4] chore(docker): mount maven settings secret at its default
 path

---
 .azure-pipelines/publish-docker.yml | 2 +-
 .dockerignore                       | 4 +++-
 utils/docker/Dockerfile.jammy       | 5 ++---
 utils/docker/Dockerfile.noble       | 5 ++---
 utils/docker/Dockerfile.resolute    | 5 ++---
 5 files changed, 10 insertions(+), 11 deletions(-)

diff --git a/.azure-pipelines/publish-docker.yml b/.azure-pipelines/publish-docker.yml
index 0848a3275..fbc712444 100644
--- a/.azure-pipelines/publish-docker.yml
+++ b/.azure-pipelines/publish-docker.yml
@@ -108,7 +108,7 @@ extends:
             targetType: "inline"
             # The authenticated settings.xml is passed to `docker build` as a secret so
             # that Maven inside the image also resolves from DevDiv_PublicPackages.
-            script: "MAVEN_SETTINGS_SECRET=\"$HOME/.m2/settings.xml\" ./utils/docker/publish_docker.sh stable"
+            script: MAVEN_SETTINGS_SECRET="$HOME/.m2/settings.xml" ./utils/docker/publish_docker.sh stable
           env:
             ACR_CACHE_PREFIX: "playwright.azurecr.io/cached/"
             UBUNTU_MIRROR_PREFIX: "azure."
diff --git a/.dockerignore b/.dockerignore
index 58b22b6cf..f609d7b5c 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -1,3 +1,5 @@
 # The repository root is the Docker build context (see utils/docker/build.sh).
 # Keep registry credentials written by the release pipeline out of the images.
-.npmrc
+**/.npmrc
+# Downloaded by publish_docker.sh after the first push.
+utils/docker/oras
diff --git a/utils/docker/Dockerfile.jammy b/utils/docker/Dockerfile.jammy
index 8a66188fd..f049bb896 100644
--- a/utils/docker/Dockerfile.jammy
+++ b/utils/docker/Dockerfile.jammy
@@ -52,9 +52,8 @@ RUN mkdir /ms-playwright && \
 COPY . /tmp/pw-java
 
 # The optional Maven settings secret routes dependency resolution through a mirror
-# (see .azure-pipelines/publish-docker.yml). Secrets are not persisted in the image.
-RUN --mount=type=secret,id=mavensettings,required=false \
-    if [ -f /run/secrets/mavensettings ]; then export MAVEN_ARGS="--settings /run/secrets/mavensettings"; fi && \
+# (see .azure-pipelines/publish-docker.yml).
+RUN --mount=type=secret,id=mavensettings,target=/root/.m2/settings.xml,required=false \
     cd /tmp/pw-java && \
     mvn install -D skipTests --no-transfer-progress && \
     mvn exec:java -e -D exec.mainClass=com.microsoft.playwright.CLI \
diff --git a/utils/docker/Dockerfile.noble b/utils/docker/Dockerfile.noble
index 2d19f2047..59c01754e 100644
--- a/utils/docker/Dockerfile.noble
+++ b/utils/docker/Dockerfile.noble
@@ -52,9 +52,8 @@ RUN mkdir /ms-playwright && \
 COPY . /tmp/pw-java
 
 # The optional Maven settings secret routes dependency resolution through a mirror
-# (see .azure-pipelines/publish-docker.yml). Secrets are not persisted in the image.
-RUN --mount=type=secret,id=mavensettings,required=false \
-    if [ -f /run/secrets/mavensettings ]; then export MAVEN_ARGS="--settings /run/secrets/mavensettings"; fi && \
+# (see .azure-pipelines/publish-docker.yml).
+RUN --mount=type=secret,id=mavensettings,target=/root/.m2/settings.xml,required=false \
     cd /tmp/pw-java && \
     mvn install -D skipTests --no-transfer-progress && \
     mvn exec:java -e -D exec.mainClass=com.microsoft.playwright.CLI \
diff --git a/utils/docker/Dockerfile.resolute b/utils/docker/Dockerfile.resolute
index a497a7010..fb9b72c7f 100644
--- a/utils/docker/Dockerfile.resolute
+++ b/utils/docker/Dockerfile.resolute
@@ -52,9 +52,8 @@ RUN mkdir /ms-playwright && \
 COPY . /tmp/pw-java
 
 # The optional Maven settings secret routes dependency resolution through a mirror
-# (see .azure-pipelines/publish-docker.yml). Secrets are not persisted in the image.
-RUN --mount=type=secret,id=mavensettings,required=false \
-    if [ -f /run/secrets/mavensettings ]; then export MAVEN_ARGS="--settings /run/secrets/mavensettings"; fi && \
+# (see .azure-pipelines/publish-docker.yml).
+RUN --mount=type=secret,id=mavensettings,target=/root/.m2/settings.xml,required=false \
     cd /tmp/pw-java && \
     mvn install -D skipTests --no-transfer-progress && \
     mvn exec:java -e -D exec.mainClass=com.microsoft.playwright.CLI \

From 17e1239cb2912950252d27382c6e1665ebc3a4b5 Mon Sep 17 00:00:00 2001
From: Yury Semikhatsky <yurys@chromium.org>
Date: Tue, 15 Sep 2026 09:54:19 -0700
Subject: [PATCH 3/4] devops(docker): add canary release channel for manual
 pipeline runs

---
 .azure-pipelines/publish-docker.yml | 14 +++++++++---
 utils/docker/publish_docker.sh      | 34 +++++++++++++++++------------
 2 files changed, 31 insertions(+), 17 deletions(-)

diff --git a/.azure-pipelines/publish-docker.yml b/.azure-pipelines/publish-docker.yml
index fbc712444..48ef7f9a6 100644
--- a/.azure-pipelines/publish-docker.yml
+++ b/.azure-pipelines/publish-docker.yml
@@ -1,6 +1,5 @@
 # Trigger: any `v*` release tag (e.g. v1.40.0).
-# Can also be queued manually from the ADO UI, e.g. on a release-1.X branch
-# whose Maven version has already been marked as 1.X.0.
+# Can also be queued manually from the ADO UI.
 trigger:
   tags:
     include:
@@ -10,6 +9,15 @@ trigger:
 
 pr: none
 
+parameters:
+- name: releaseChannel
+  displayName: "IMPORTANT: set this to 'canary' when triggering manually"
+  type: string
+  default: stable
+  values:
+  - stable
+  - canary
+
 resources:
   repositories:
   - repository: 1esPipelines
@@ -108,7 +116,7 @@ extends:
             targetType: "inline"
             # The authenticated settings.xml is passed to `docker build` as a secret so
             # that Maven inside the image also resolves from DevDiv_PublicPackages.
-            script: MAVEN_SETTINGS_SECRET="$HOME/.m2/settings.xml" ./utils/docker/publish_docker.sh stable
+            script: MAVEN_SETTINGS_SECRET="$HOME/.m2/settings.xml" ./utils/docker/publish_docker.sh ${{ parameters.releaseChannel }}
           env:
             ACR_CACHE_PREFIX: "playwright.azurecr.io/cached/"
             UBUNTU_MIRROR_PREFIX: "azure."
diff --git a/utils/docker/publish_docker.sh b/utils/docker/publish_docker.sh
index 82d0ae3be..2e50745d4 100755
--- a/utils/docker/publish_docker.sh
+++ b/utils/docker/publish_docker.sh
@@ -8,39 +8,45 @@ cd "$(dirname "$0")"
 
 MCR_IMAGE_NAME="playwright/java"
 
+RELEASE_CHANNEL="$1"
+if [[ "${RELEASE_CHANNEL}" != "stable" && "${RELEASE_CHANNEL}" != "canary" ]]; then
+  echo "ERROR: unknown release channel - '${RELEASE_CHANNEL}'"
+  echo "Must be either 'stable' or 'canary'"
+  exit 1
+fi
+
 POM_FILE=../../pom.xml
 if [[ ! -f ${POM_FILE} ]]; then
   echo "ERROR: pom.xml not found at ${POM_FILE}"
   exit 1;
 fi
 PW_VERSION=$(mvn exec:exec -Dexec.executable='echo' -Dexec.args='${project.version}' -f ${POM_FILE} --non-recursive -q 2>/dev/null)
-
-RELEASE_CHANNEL="$1"
-if [[ "${RELEASE_CHANNEL}" == "stable" ]]; then
-  if [[ ! "${PW_VERSION}" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
-    echo "ERROR: cannot publish stable docker with Playwright version '${PW_VERSION}'"
-    exit 1
-  fi
-else
-  echo "ERROR: unknown release channel - ${RELEASE_CHANNEL}"
-  echo "Must be either 'stable' or 'canary'"
+if [[ "${RELEASE_CHANNEL}" == "stable" && ! "${PW_VERSION}" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+  echo "ERROR: cannot publish stable docker with Playwright version '${PW_VERSION}'"
   exit 1
 fi
+VERSION_TAG="v${PW_VERSION}"
+if [[ "${RELEASE_CHANNEL}" == "canary" ]]; then
+  VERSION_TAG="v${PW_VERSION}-canary-$(date -u +'%Y%m%d%H%M%S')"
+  echo "== CANARY build: publishing to ${VERSION_TAG}-* tags =="
+fi
 
 # Ubuntu 22.04
 JAMMY_TAGS=(
-  "v${PW_VERSION}-jammy"
+  "${VERSION_TAG}-jammy"
 )
 
 # Ubuntu 24.04
 NOBLE_TAGS=(
-  "v${PW_VERSION}"
-  "v${PW_VERSION}-noble"
+  "${VERSION_TAG}-noble"
 )
+if [[ "${RELEASE_CHANNEL}" == "stable" ]]; then
+  NOBLE_TAGS+=("${VERSION_TAG}")
+fi
 
 # Ubuntu 26.04
 RESOLUTE_TAGS=(
-  "v${PW_VERSION}-resolute"
+  "${VERSION_TAG}-resolute"
 )
 
 tags_for_flavor() {

From 4dbbfd12ff399576555de9697797940d391b31f2 Mon Sep 17 00:00:00 2001
From: Yury Semikhatsky <yurys@chromium.org>
Date: Tue, 15 Sep 2026 12:26:18 -0700
Subject: [PATCH 4/4] devops(docker): retry arm64 image builds under QEMU

---
 utils/docker/build.sh | 31 +++++++++++++++++++++++++------
 1 file changed, 25 insertions(+), 6 deletions(-)

diff --git a/utils/docker/build.sh b/utils/docker/build.sh
index 10064902a..efd5e6670 100755
--- a/utils/docker/build.sh
+++ b/utils/docker/build.sh
@@ -46,9 +46,28 @@ fi
 # Keep each arch image a plain single-platform manifest without the unknown/unknown platform entry.
 export BUILDX_NO_DEFAULT_ATTESTATIONS=1
 
-docker build --platform "${PLATFORM}" \
-  --build-arg "PW_TARGET_ARCH=${PW_TARGET_ARCH}" \
-  --build-arg ACR_CACHE_PREFIX="${ACR_CACHE_PREFIX}" \
-  --build-arg UBUNTU_MIRROR_PREFIX="${UBUNTU_MIRROR_PREFIX}" \
-  "${SECRET_ARGS[@]}" \
-  -t "$3" -f "Dockerfile.$2" ../../
+# arm64 images are cross-built under QEMU user-mode emulation, where Ubuntu 22.04's
+# ldconfig segfaults intermittently at startup (tonistiigi/binfmt#298, every binfmt
+# build since QEMU 8.1.4). apt's libc-bin trigger runs ldconfig, so a crash fails the
+# whole `docker build`. Retry: BuildKit keeps the layers that already succeeded, so a
+# retry re-runs only the failed RUN step.
+MAX_ATTEMPTS=1
+if [[ "${PLATFORM}" == "linux/arm64" ]]; then
+  MAX_ATTEMPTS=3
+fi
+
+for ((attempt = 1; attempt <= MAX_ATTEMPTS; attempt++)); do
+  if docker build --platform "${PLATFORM}" \
+      --build-arg "PW_TARGET_ARCH=${PW_TARGET_ARCH}" \
+      --build-arg ACR_CACHE_PREFIX="${ACR_CACHE_PREFIX}" \
+      --build-arg UBUNTU_MIRROR_PREFIX="${UBUNTU_MIRROR_PREFIX}" \
+      "${SECRET_ARGS[@]}" \
+      -t "$3" -f "Dockerfile.$2" ../../; then
+    exit 0
+  fi
+  if (( attempt < MAX_ATTEMPTS )); then
+    echo "docker build failed (attempt ${attempt}/${MAX_ATTEMPTS}), retrying..." >&2
+  fi
+done
+echo "ERROR: docker build failed after ${MAX_ATTEMPTS} attempt(s)" >&2
+exit 1