Add devbox image Dockerfiles and build scripts, split from homelab-komodo

devbox/flutter-vnc/Dockerfile

@@ -0,0 +1,38 @@
+FROM coder-devbox-flutter:latest AS base-default
+
+USER root
+
+# Same XFCE4 + TigerVNC + noVNC stack as devbox/vnc, layered on top of the
+# already-built Flutter image instead of base-config directly — reuses the
+# Flutter/fvm layer's build cache entirely rather than reinstalling it.
+RUN DEBIAN_FRONTEND=noninteractive apt-get update -qq \
+    && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
+       xfce4 xfce4-terminal dbus-x11 \
+       tigervnc-standalone-server tigervnc-common \
+       novnc websockify \
+       fonts-dejavu-core \
+       x11vnc \
+    && apt-get clean \
+    && rm -rf /var/lib/apt/lists/*
+# x11vnc is installed only for its `storepasswd` tool — see devbox/vnc's
+# Dockerfile for why (no vncpasswd equivalent in this Ubuntu package split).
+# x11vnc itself is never run.
+
+# Flutter's own Linux desktop build requirements (per Flutter's official
+# docs) — needed so `flutter run -d linux` / `flutter build linux` actually
+# work inside this workspace, with the VNC desktop providing a real display
+# for the resulting GUI app to run against instead of Xvfb-style headless
+# testing.
+RUN DEBIAN_FRONTEND=noninteractive apt-get update -qq \
+    && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
+       clang cmake ninja-build pkg-config libgtk-3-dev liblzma-dev libstdc++-12-dev \
+    && apt-get clean \
+    && rm -rf /var/lib/apt/lists/*
+
+# Lives outside /home/coder — see vnc-startup.sh header comment.
+COPY ./vnc-startup.sh /usr/local/bin/vnc-startup.sh
+RUN chmod +x /usr/local/bin/vnc-startup.sh
+
+USER coder
+
+RUN flutter config --enable-linux-desktop

devbox/flutter-vnc/vnc-startup.sh

@@ -0,0 +1,47 @@
+#!/bin/bash
+# Starts an XFCE4 desktop under TigerVNC and bridges it to a browser-reachable
+# noVNC endpoint. Lives outside /home/coder (the per-workspace persistent
+# volume) so it always reflects the current image, not whatever was baked in
+# on that volume's first-ever creation — same reasoning as acp-bridge-listen.sh.
+set -e
+
+mkdir -p ~/.vnc ~/.local/log ~/.local/run
+
+VNC_PASSWD_FILE=~/.vnc/passwd
+# Regenerated and printed on every start, not just first-ever — a one-time
+# "shown once" value was too easy to lose (see devenv README's VNC section:
+# recovering a stale one meant killing the running session anyway). Fine
+# since VNC access is already gated by secure-admin's own auth in front of
+# this. tigervnc-standalone-server/tigervnc-common ship no vncpasswd
+# equivalent on this Ubuntu package split — x11vnc's storepasswd generates a
+# file in the same standard VNC password format that Xtigervnc/tigervncserver
+# reads; x11vnc itself is never actually run.
+VNC_PASSWORD="${VNC_PASSWORD:-$(openssl rand -hex 8)}"
+x11vnc -storepasswd "$VNC_PASSWORD" "$VNC_PASSWD_FILE" > /dev/null
+chmod 600 "$VNC_PASSWD_FILE"
+echo "[ VNC password: $VNC_PASSWORD ]"
+
+cat > ~/.vnc/xstartup <<'XSTARTUP_EOF'
+#!/bin/bash
+unset SESSION_MANAGER
+unset DBUS_SESSION_BUS_ADDRESS
+exec startxfce4
+XSTARTUP_EOF
+chmod +x ~/.vnc/xstartup
+
+# Idempotent: kill any stale server/proxy from a prior start before relaunching
+vncserver -kill :1 > /dev/null 2>&1 || true
+pkill -f "websockify.*6080" > /dev/null 2>&1 || true
+
+vncserver :1 -geometry 1280x800 -depth 24 -SecurityTypes VncAuth -PasswordFile "$VNC_PASSWD_FILE" > ~/.local/log/vncserver.log 2>&1
+
+setsid nohup websockify --web=/usr/share/novnc/ 6080 localhost:5901 > ~/.local/log/novnc.log 2>&1 < /dev/null &
+echo $! > ~/.local/run/novnc.pid
+
+for i in $(seq 1 15); do
+  if curl -sf http://localhost:6080/vnc.html > /dev/null 2>&1; then
+    echo "[ noVNC ready on :6080 after ~${i}s ]"
+    break
+  fi
+  sleep 1
+done