From c4d2506821624c9d8d45cd77b8a39727e3fb4361 Mon Sep 17 00:00:00 2001
From: bluesky <379865549@qq.com>
Date: Fri, 6 Sep 2024 09:31:09 +0800
Subject: [PATCH] feat: add deepin-webtop

---
 .github/workflows/build-webtop.yml            |  11 +-
 deepin-webtop/beige/Dockerfile                | 573 ++++++++++++++++++
 deepin-webtop/beige/docker-compose.yml        |  60 ++
 deepin-webtop/beige/root/defaults/startwm.sh  |  21 +
 .../beige/root/usr/local/bin/wrapped-chromium |  15 +
 5 files changed, 677 insertions(+), 3 deletions(-)
 create mode 100644 deepin-webtop/beige/Dockerfile
 create mode 100644 deepin-webtop/beige/docker-compose.yml
 create mode 100755 deepin-webtop/beige/root/defaults/startwm.sh
 create mode 100755 deepin-webtop/beige/root/usr/local/bin/wrapped-chromium

diff --git a/.github/workflows/build-webtop.yml b/.github/workflows/build-webtop.yml
index 8b82c39..647e6aa 100644
--- a/.github/workflows/build-webtop.yml
+++ b/.github/workflows/build-webtop.yml
@@ -35,8 +35,12 @@ jobs:
           # docker buildx build --load --platform linux/amd64 -t ${{ env.owner }}/baseimage-kasmvnc:deepinapricot .
           # popd
 
-          pushd webtop/deepin/dde20
-          docker buildx build --load --platform linux/amd64 -t ${{ env.owner }}/webtop:deepin-dde20 .
+          # pushd webtop/deepin/dde20
+          # docker buildx build --load --platform linux/amd64 -t ${{ env.owner }}/webtop:deepin-dde20 .
+          # popd
+
+          pushd deepin-webtop/beige
+          docker buildx build --load --platform linux/amd64 -t ${{ env.owner }}/deepin-webtop .
           popd
 
       - name: Login to Docker Hub
@@ -49,4 +53,5 @@ jobs:
         run: |
           # docker push ${{ env.owner }}/webtop:debian-gxde
           # docker push ${{ env.owner }}/baseimage-kasmvnc:deepinapricot
-          docker push ${{ env.owner }}/webtop:deepin-dde20
+          # docker push ${{ env.owner }}/webtop:deepin-dde20
+          docker push ${{ env.owner }}/deepin-webtop
diff --git a/deepin-webtop/beige/Dockerfile b/deepin-webtop/beige/Dockerfile
new file mode 100644
index 0000000..5a7b4c6
--- /dev/null
+++ b/deepin-webtop/beige/Dockerfile
@@ -0,0 +1,573 @@
+FROM node:12-buster AS wwwstage
+
+ARG KASMWEB_RELEASE="5ba4695e6526a27b8e38ec8d55dc33b39143e68a"
+
+RUN \
+  echo "**** build clientside ****" && \
+  export QT_QPA_PLATFORM=offscreen && \
+  export QT_QPA_FONTDIR=/usr/share/fonts && \
+  mkdir /src && \
+  cd /src && \
+  wget https://github.com/kasmtech/noVNC/tarball/${KASMWEB_RELEASE} -O - \
+    | tar  --strip-components=1 -xz && \
+  npm install && \
+  npm run-script build
+
+RUN \
+  echo "**** organize output ****" && \
+  mkdir /build-out && \
+  cd /src && \
+  rm -rf node_modules/ && \
+  cp -R ./* /build-out/ && \
+  cd /build-out && \
+  rm *.md && \
+  rm AUTHORS && \
+  cp index.html vnc.html && \
+  mkdir Downloads
+
+
+FROM linuxdeepin/deepin AS buildstage
+
+ARG KASMVNC_RELEASE="511e2ae542e95f5447a0a145bb54ced968e6cfec"
+
+COPY --from=wwwstage /build-out /www
+
+RUN \
+  echo "**** add all sources ****" && \
+  echo "deb https://community-packages.deepin.com/beige/ beige main commercial community" > /etc/apt/sources.list && \
+  echo "deb-src https://community-packages.deepin.com/beige/ beige main commercial community" >> /etc/apt/sources.list && \
+  echo "**** install build deps ****" && \
+  apt-get update && \
+  curl -o console-data.deb -L http://deb.debian.org/debian/pool/main/c/console-data/console-data_1.12-9_all.deb && \
+  curl -o tightvncserver.deb -L http://deb.debian.org/debian/pool/main/t/tightvnc/tightvncserver_1.3.10-7_amd64.deb && \
+  curl -o tightvncpasswd.deb -L http://deb.debian.org/debian/pool/main/t/tightvnc/tightvncpasswd_1.3.10-7_amd64.deb && \
+  apt-get install -y ./console-data.deb ./tightvncpasswd.deb ./tightvncserver.deb && \
+  apt-get build-dep -y \
+    libxfont-dev \
+    xorg-server && \
+  apt-get install -y \
+    autoconf \
+    automake \
+    cmake \
+    console-data \
+    git \
+    grep \
+    kbd \
+    libavcodec-dev \
+    libdrm-dev \
+    libepoxy-dev \
+    libgbm-dev \
+    libgif-dev \
+    libgnutls28-dev \
+    libgnutls28-dev \
+    libjpeg-dev \
+    libpciaccess-dev \
+    libpng-dev \
+    libssl-dev \
+    libtiff-dev \
+    libtool \
+    libwebp-dev \
+    libx11-dev \
+    libxau-dev \
+    libxcursor-dev \
+    libxcursor-dev \
+    libxdmcp-dev \
+    libxext-dev \
+    libxkbfile-dev \
+    libxrandr-dev \
+    libxrandr-dev \
+    libxshmfence-dev \
+    libxtst-dev \
+    meson \
+    nettle-dev \
+    tar \
+    tightvncserver \
+    wget \
+    wayland-protocols \
+    x11-apps \
+    x11-common \
+    x11-utils \
+    x11-xkb-utils \
+    x11-xserver-utils \
+    xauth \
+    xdg-utils \
+    xfonts-base \
+    xinit \
+    xkb-data \
+    xserver-xorg-dev
+
+RUN \
+  echo "**** build libjpeg-turbo ****" && \
+  mkdir /jpeg-turbo && \
+  JPEG_TURBO_RELEASE=$(curl -sX GET "https://api.github.com/repos/libjpeg-turbo/libjpeg-turbo/releases/latest" \
+  | awk '/tag_name/{print $4;exit}' FS='[""]'); \
+  curl -o \
+  /tmp/jpeg-turbo.tar.gz -L \
+    "https://github.com/libjpeg-turbo/libjpeg-turbo/archive/${JPEG_TURBO_RELEASE}.tar.gz" && \
+  tar xf \
+  /tmp/jpeg-turbo.tar.gz -C \
+    /jpeg-turbo/ --strip-components=1 && \
+  cd /jpeg-turbo && \
+  MAKEFLAGS=-j`nproc` \
+  CFLAGS="-fpic" \
+  cmake -DCMAKE_INSTALL_PREFIX=/usr/local -G"Unix Makefiles" && \
+  make && \
+  make install
+
+RUN \
+  echo "**** build kasmvnc ****" && \
+  git clone https://github.com/kasmtech/KasmVNC.git src && \
+  cd /src && \
+  git checkout -f ${KASMVNC_release} && \
+  sed -i \
+    -e '/find_package(FLTK/s@^@#@' \
+    -e '/add_subdirectory(tests/s@^@#@' \
+    CMakeLists.txt && \
+  cmake \
+    -DCMAKE_BUILD_TYPE=RelWithDebInfo \
+    -DBUILD_VIEWER:BOOL=OFF \
+    -DENABLE_GNUTLS:BOOL=OFF \
+    . && \
+  make -j4 && \
+  echo "**** build xorg ****" && \
+  XORG_VER="1.20.14" && \
+  XORG_PATCH=$(echo "$XORG_VER" | grep -Po '^\d.\d+' | sed 's#\.##') && \
+  wget --no-check-certificate \
+    -O /tmp/xorg-server-${XORG_VER}.tar.gz \
+    "https://www.x.org/archive/individual/xserver/xorg-server-${XORG_VER}.tar.gz" && \
+  tar --strip-components=1 \
+    -C unix/xserver \
+    -xf /tmp/xorg-server-${XORG_VER}.tar.gz && \
+  cd unix/xserver && \
+  patch -Np1 -i ../xserver${XORG_PATCH}.patch && \
+  patch -s -p0 < ../CVE-2022-2320-v1.20.patch && \
+  autoreconf -i && \
+  ./configure --prefix=/opt/kasmweb \
+    --with-xkb-path=/usr/share/X11/xkb \
+    --with-xkb-output=/var/lib/xkb \
+    --with-xkb-bin-directory=/usr/bin \
+    --with-default-font-path="/usr/share/fonts/X11/misc,/usr/share/fonts/X11/cyrillic,/usr/share/fonts/X11/100dpi/:unscaled,/usr/share/fonts/X11/75dpi/:unscaled,/usr/share/fonts/X11/Type1,/usr/share/fonts/X11/100dpi,/usr/share/fonts/X11/75dpi,built-ins" \
+    --with-sha1=libcrypto \
+    --without-dtrace --disable-dri \
+    --disable-static \
+    --disable-xinerama \
+    --disable-xvfb \
+    --disable-xnest \
+    --disable-xorg \
+    --disable-dmx \
+    --disable-xwin \
+    --disable-xephyr \
+    --disable-kdrive \
+    --disable-config-hal \
+    --disable-config-udev \
+    --disable-dri2 \
+    --enable-glx \
+    --disable-xwayland \
+    --enable-dri3 && \
+  find . -name "Makefile" -exec sed -i 's/-Werror=array-bounds//g' {} \; && \
+  make -j4
+
+RUN \
+  echo "**** generate final output ****" && \
+  cd /src && \
+  mkdir -p xorg.build/bin && \
+  cd xorg.build/bin/ && \
+  ln -s /src/unix/xserver/hw/vnc/Xvnc Xvnc && \
+  cd .. && \
+  mkdir -p man/man1 && \
+  touch man/man1/Xserver.1 && \
+  cp /src/unix/xserver/hw/vnc/Xvnc.man man/man1/Xvnc.1 && \
+  mkdir lib && \
+  cd lib && \
+  ln -s /usr/lib/x86_64-linux-gnu/dri dri && \
+  cd /src && \
+  mkdir -p builder/www && \
+  cp -ax /www/* builder/www/ && \
+  cp builder/www/index.html builder/www/vnc.html && \
+  make servertarball && \
+  mkdir /build-out && \
+  tar xzf \
+    kasmvnc-Linux*.tar.gz \
+    -C /build-out/ && \
+  rm -Rf /build-out/usr/local/man
+
+# nodejs builder
+FROM linuxdeepin/deepin AS nodebuilder
+ARG KCLIENT_RELEASE
+
+RUN \
+  echo "**** install build deps ****" && \
+  apt-get update && \
+  apt-get install -y \
+    gnupg && \
+  curl -fsSL https://deb.nodesource.com/setup_18.x | bash - && \
+  apt-get update && \
+  apt-get install -y \
+    g++ \
+    gcc \
+    libpam0g-dev \
+    libpulse-dev \
+    make \
+    nodejs
+
+RUN \
+  echo "**** grab source ****" && \
+  mkdir -p /kclient && \
+  if [ -z ${KCLIENT_RELEASE+x} ]; then \
+    KCLIENT_RELEASE=$(curl -sX GET "https://api.github.com/repos/linuxserver/kclient/releases/latest" \
+    | awk '/tag_name/{print $4;exit}' FS='[""]'); \
+  fi && \
+  curl -o \
+  /tmp/kclient.tar.gz -L \
+    "https://github.com/linuxserver/kclient/archive/${KCLIENT_RELEASE}.tar.gz" && \
+  tar xf \
+  /tmp/kclient.tar.gz -C \
+    /kclient/ --strip-components=1
+
+RUN \
+  echo "**** install node modules ****" && \
+  cd /kclient && \
+  npm install && \
+  rm -f package-lock.json
+
+FROM linuxdeepin/deepin:beige
+
+# set version label
+ARG BUILD_DATE
+ARG VERSION
+ARG KASMBINS_RELEASE="1.15.0"
+LABEL build_version="Linuxserver.io version:- ${VERSION} Build-date:- ${BUILD_DATE}"
+LABEL maintainer="thelamer"
+LABEL "com.kasmweb.image"="true"
+
+# env
+ENV DISPLAY=:1 \
+    PERL5LIB=/usr/local/bin \
+    OMP_WAIT_POLICY=PASSIVE \
+    GOMP_SPINCOUNT=0 \
+    HOME=/config \
+    START_DOCKER=true \
+    PULSE_RUNTIME_PATH=/defaults \
+    NVIDIA_DRIVER_CAPABILITIES=all
+
+# Using systemd in docker: https://systemd.io/CONTAINER_INTERFACE/
+# Make sure cgroupv2 is enabled. To check this: cat /sys/fs/cgroup/cgroup.controllers
+ENV container docker
+
+STOPSIGNAL SIGRTMIN+3
+VOLUME [ "/tmp", "/run", "/run/lock" ]
+
+# copy over build output
+COPY --from=nodebuilder /kclient /kclient
+COPY --from=buildstage /build-out/ /
+
+RUN \
+  echo "**** Ripped from deepin Docker Logic ****" && \
+  echo '#!/bin/sh' \
+    > /usr/sbin/policy-rc.d && \
+  echo 'exit 101' \
+    >> /usr/sbin/policy-rc.d && \
+  chmod +x \
+    /usr/sbin/policy-rc.d && \
+  dpkg-divert --local --rename --add /sbin/initctl && \
+  cp -a \
+    /usr/sbin/policy-rc.d \
+    /sbin/initctl && \
+  sed -i \
+    's/^exit.*/exit 0/' \
+    /sbin/initctl && \
+  echo 'force-unsafe-io' \
+    > /etc/dpkg/dpkg.cfg.d/docker-apt-speedup && \
+  echo 'DPkg::Post-Invoke { "rm -f /var/cache/apt/archives/*.deb /var/cache/apt/archives/partial/*.deb /var/cache/apt/*.bin || true"; };' \
+    > /etc/apt/apt.conf.d/docker-clean && \
+  echo 'APT::Update::Post-Invoke { "rm -f /var/cache/apt/archives/*.deb /var/cache/apt/archives/partial/*.deb /var/cache/apt/*.bin || true"; };' \
+    >> /etc/apt/apt.conf.d/docker-clean && \
+  echo 'Dir::Cache::pkgcache ""; Dir::Cache::srcpkgcache "";' \
+    >> /etc/apt/apt.conf.d/docker-clean && \
+  echo 'Acquire::Languages "none";' \
+    > /etc/apt/apt.conf.d/docker-no-languages && \
+  echo 'Acquire::GzipIndexes "true"; Acquire::CompressionTypes::Order:: "gz";' \
+    > /etc/apt/apt.conf.d/docker-gzip-indexes && \
+  echo 'Apt::AutoRemove::SuggestsImportant "false";' \
+    > /etc/apt/apt.conf.d/docker-autoremove-suggests && \
+  mkdir -p /run/systemd && \
+  echo 'docker' \
+    > /run/systemd/container && \
+  echo "**** install apt-utils and locales ****" && \
+  apt-get update && \
+  apt-get upgrade -y && \
+  apt-get install -y \
+    apt-utils \
+    locales && \
+  echo "**** install packages ****" && \
+  curl -o catatonit.deb -L http://deb.debian.org/debian/pool/main/c/catatonit/catatonit_0.1.7-1%2bb1_amd64.deb && \
+  apt install ./catatonit.deb && \
+  rm catatonit.deb && \
+  apt-get install -y \
+    cron \
+    curl \
+    gnupg \
+    jq \
+    netcat-traditional \
+    tzdata && \
+  echo "**** create abc user and make our folders ****" && \
+  useradd -u 911 -U -d /config -s /bin/false deepin && \
+  usermod -G users deepin && \
+  mkdir -p \
+    /app \
+    /config \
+    /defaults \
+    /lsiopy && \
+  echo "**** cleanup ****" && \
+  apt-get autoclean && \
+  rm -rf \
+    /var/lib/apt/lists/* \
+    /var/tmp/* \
+    /tmp/*
+
+RUN \
+  echo "**** install deps ****" && \
+  curl -fsSL https://download.docker.com/linux/debian/gpg | tee /usr/share/keyrings/docker.asc >/dev/null && \
+  echo "deb [arch=amd64 signed-by=/usr/share/keyrings/docker.asc] https://download.docker.com/linux/debian bookworm stable" > /etc/apt/sources.list.d/docker.list && \
+  curl -fsSL https://deb.nodesource.com/setup_18.x | bash - && \
+  apt-get update && \
+  curl -o xserver-xorg-video-qxl.deb -L http://deb.debian.org/debian/pool/main/x/xserver-xorg-video-qxl/xserver-xorg-video-qxl_0.1.5%2bgit20200331-3_amd64.deb && \
+  curl -o console-data.deb -L http://deb.debian.org/debian/pool/main/c/console-data/console-data_1.12-9_all.deb && \
+  curl -o dunst.deb -L http://deb.debian.org/debian/pool/main/d/dunst/dunst_1.9.0-0.1_amd64.deb && \
+  curl -o libhash-merge-simple-perl.deb -L http://deb.debian.org/debian/pool/main/libh/libhash-merge-simple-perl/libhash-merge-simple-perl_0.051-3_all.deb && \
+  apt-get install -y ./xserver-xorg-video-qxl.deb ./console-data.deb ./dunst.deb ./libhash-merge-simple-perl.deb && \
+  rm ./*.deb && \
+  DEBIAN_FRONTEND=noninteractive apt-get install --no-install-recommends -y \
+    ca-certificates \
+    containerd.io \
+    cups \
+    cups-client \
+    cups-pdf \
+    docker-ce \
+    docker-ce-cli \
+    docker-buildx-plugin \
+    docker-compose-plugin \
+    dbus-x11 \
+    dunst \
+    ffmpeg \
+    file \
+    fonts-noto-color-emoji \
+    fonts-noto-core \
+    fuse-overlayfs \
+    intel-media-va-driver \
+    kbd \
+    libdatetime-perl \
+    libfontenc1 \
+    libfreetype6 \
+    libgbm1 \
+    libgcrypt20 \
+    libgl1-mesa-dri \
+    libglu1-mesa \
+    libgnutls30 \
+    libgomp1 \
+    libhash-merge-simple-perl \
+    liblist-moreutils-perl \
+    libnotify-bin \
+    libp11-kit0 \
+    libpam0g \
+    libpixman-1-0 \
+    libscalar-list-utils-perl \
+    libswitch-perl \
+    libtasn1-6 \
+    libtry-tiny-perl \
+    libvulkan1 \
+    libwebp7 \
+    libx11-6 \
+    libxau6 \
+    libxcb1 \
+    libxcursor1 \
+    libxdmcp6 \
+    libxext6 \
+    libxfixes3 \
+    libxfont2 \
+    libxinerama1 \
+    libxshmfence1 \
+    libxtst6 \
+    libyaml-tiny-perl \
+    locales-all \
+    mesa-va-drivers \
+    mesa-vulkan-drivers \
+    nginx \
+    nodejs \
+    openbox \
+    openssh-client \
+    openssl \
+    pciutils \
+    perl \
+    procps \
+    pulseaudio \
+    pulseaudio-utils \
+    python3 \
+    software-properties-common \
+    ssl-cert \
+    sudo \
+    tar \
+    util-linux \
+    vulkan-tools \
+    x11-apps \
+    x11-common \
+    x11-utils \
+    x11-xkb-utils \
+    x11-xserver-utils \
+    xauth \
+    xdg-utils \
+    xfonts-base \
+    xkb-data \
+    xserver-common \
+    xserver-xorg-core \
+    xserver-xorg-video-amdgpu \
+    xserver-xorg-video-ati \
+    xserver-xorg-video-intel \
+    xserver-xorg-video-nouveau \
+    xserver-xorg-video-qxl \
+    xterm \
+    xutils \
+    zlib1g \
+    systemd && \
+  echo "**** printer config ****" && \
+  sed -i -r \
+    -e "s:^(Out\s).*:\1/home/kasm-user/PDF:" \
+    /etc/cups/cups-pdf.conf && \
+  echo "**** filesystem setup ****" && \
+  ln -s /usr/local/share/kasmvnc /usr/share/kasmvnc && \
+  ln -s /usr/local/etc/kasmvnc /etc/kasmvnc && \
+  ln -s /usr/local/lib/kasmvnc /usr/lib/kasmvncserver && \
+  echo "**** openbox tweaks ****" && \
+  sed -i \
+    -e 's/NLIMC/NLMC/g' \
+    -e '/debian-menu/d' \
+    -e 's|</applications>|  <application class="*"><maximized>yes</maximized></application>\n</applications>|' \
+    -e 's|</keyboard>|  <keybind key="C-S-d"><action name="ToggleDecorations"/></keybind>\n</keyboard>|' \
+    /etc/xdg/openbox/rc.xml && \
+  echo "**** user perms ****" && \
+  sed -e 's/%sudo	ALL=(ALL:ALL) ALL/%sudo ALL=(ALL:ALL) NOPASSWD: ALL/g' \
+    -i /etc/sudoers && \
+  echo "deepin:deepin" | chpasswd && \
+  usermod -s /bin/bash deepin && \
+  usermod -aG sudo deepin && \
+  echo "**** proot-apps ****" && \
+  mkdir /proot-apps/ && \
+  PAPPS_RELEASE=$(curl -sX GET "https://api.github.com/repos/linuxserver/proot-apps/releases/latest" \
+    | awk '/tag_name/{print $4;exit}' FS='[""]') && \
+  curl -L https://github.com/linuxserver/proot-apps/releases/download/${PAPPS_RELEASE}/proot-apps-x86_64.tar.gz \
+    | tar -xzf - -C /proot-apps/ && \
+  echo "${PAPPS_RELEASE}" > /proot-apps/pversion && \
+  echo "**** kasm support ****" && \
+  useradd \
+    -u 1000 -U \
+    -d /home/kasm-user \
+    -s /bin/bash kasm-user && \
+  echo "kasm-user:kasm" | chpasswd && \
+  usermod -aG sudo kasm-user && \
+  mkdir -p /home/kasm-user && \
+  chown 1000:1000 /home/kasm-user && \
+  mkdir -p /var/run/pulse && \
+  chown 1000:root /var/run/pulse && \
+  mkdir -p /kasmbins && \
+  curl -s https://kasm-ci.s3.amazonaws.com/kasmbins-amd64-${KASMBINS_RELEASE}.tar.gz \
+    | tar xzvf - -C /kasmbins/ && \
+  chmod +x /kasmbins/* && \
+  chown -R 1000:1000 /kasmbins && \
+  chown 1000:1000 /usr/share/kasmvnc/www/Downloads && \
+  mkdir -p /dockerstartup && \
+  echo "**** dind support ****" && \
+  useradd -U dockremap && \
+  usermod -G dockremap dockremap && \
+  echo 'dockremap:165536:65536' >> /etc/subuid && \
+  echo 'dockremap:165536:65536' >> /etc/subgid && \
+  curl -o \
+  /usr/local/bin/dind -L \
+    https://raw.githubusercontent.com/moby/moby/master/hack/dind && \
+  chmod +x /usr/local/bin/dind && \
+  echo 'hosts: files dns' > /etc/nsswitch.conf && \
+  usermod -aG docker deepin && \
+  echo "**** locales ****" && \
+  for LOCALE in $(curl -sL https://raw.githubusercontent.com/thelamer/lang-stash/master/langs); do \
+    localedef -i $LOCALE -f UTF-8 $LOCALE.UTF-8; \
+  done && \
+  echo "**** theme ****" && \
+  curl -s https://raw.githubusercontent.com/thelamer/lang-stash/master/theme.tar.gz \
+    | tar xzvf - -C /usr/share/themes/Clearlooks/openbox-3/ && \
+  echo "**** cleanup ****" && \
+  apt-get autoclean && \
+  rm -rf \
+    /var/lib/apt/lists/* \
+    /var/tmp/* \
+    /tmp/*
+
+ARG BUILD_DATE
+ARG VERSION
+LABEL build_version="Linuxserver.io version:- ${VERSION} Build-date:- ${BUILD_DATE}"
+LABEL maintainer="thelamer"
+ENV TITLE="deepin dde23"
+
+RUN \
+  echo "**** add icon ****" && \
+  curl -o \
+    /kclient/public/icon.png \
+    https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/webtop-logo.png && \
+  echo "**** install packages ****" && \
+  apt-get update && \
+  DEBIAN_FRONTEND=noninteractive \
+  apt-get install -y --no-install-recommends \
+      udisks2 || rm -v /var/lib/dpkg/info/udisks2.postinst && \
+  dpkg --configure udisks2 && \
+  DEBIAN_FRONTEND=noninteractive \
+  apt-get install -y --no-install-recommends \
+    chromium \
+    chromium-l10n \
+    libqt5core5a \
+    dde-control-center \
+    dde-clipboard \
+    dde-desktop \
+    dde-dock \
+    dde-file-manager \
+    dde-kwin \
+    dde-launcher \
+    dde-qt5integration \
+    deepin-artwork \
+    deepin-default-settings \
+    deepin-desktop-base \
+    deepin-wallpapers \
+    fonts-noto \
+    startdde \
+    dde-calendar \
+    deepin-album \
+    deepin-calculator \
+    deepin-draw \
+    deepin-editor \
+    deepin-image-viewer \
+    deepin-movie \
+    deepin-music \
+    deepin-system-monitor \
+    deepin-screen-recorder \
+    deepin-terminal \
+    deepin-voice-note && \
+  echo "**** application tweaks ****" && \
+  sed -i \
+    's#^Exec=.*#Exec=/usr/local/bin/wrapped-chromium#g' \
+    /usr/share/applications/chromium.desktop && \
+  sed -i -E 's/#[[:space:]]?(zh_CN.UTF-8[[:space:]]+UTF-8)/\1/g' /etc/locale.gen && \
+  locale-gen && \
+  DEBIAN_FRONTEND=noninteractive dpkg-reconfigure locales && \
+  echo "**** cleanup ****" && \
+  apt-get autoclean && \
+  rm -rf \
+    /config/.cache \
+    /var/lib/apt/lists/* \
+    /var/tmp/* \
+    /tmp/*
+
+# add local files
+COPY /root /
+
+# ports and volumes
+EXPOSE 3000 3001
+VOLUME /config
+
+CMD [ "/usr/lib/systemd/systemd", "log-level=info", "unit=sysinit.target" ]
diff --git a/deepin-webtop/beige/docker-compose.yml b/deepin-webtop/beige/docker-compose.yml
new file mode 100644
index 0000000..5110ec0
--- /dev/null
+++ b/deepin-webtop/beige/docker-compose.yml
@@ -0,0 +1,60 @@
+version: '3.8'
+
+services:
+  systemd_test:
+    build:
+      context: .
+      dockerfile: Dockerfile
+    container_name: systemd_test
+    privileged: true
+    cap_add:
+      - SYS_ADMIN
+    security_opt:
+      - seccomp:unconfined
+    tmpfs:
+      - /tmp
+      - /run
+      - /run/lock
+    ports:
+      - 3002:3000
+    environment:
+      - PUID=1000
+      - PGID=1000
+      - TZ=Asia/Shanghai
+      - SUBFOLDER=/ #optional
+      - TITLE=Webtop #optional
+      - https_proxy=http://10.20.42.187:7890
+      - DOCKER_MODS=linuxserver/mods:universal-package-install 
+      - INSTALL_PACKAGES=fonts-noto-cjk
+      - LC_ALL=zh_CN.UTF-8
+    volumes:
+      - ./data:/config
+      - /var/run/docker.sock:/var/run/docker.sock #optional
+    devices:
+      - /dev/dri:/dev/dri #optional
+    shm_size: "1gb" #optional
+    cgroup_parent: docker.slice
+    restart: unless-stopped
+
+    environment:
+      - PUID=1000
+      - PGID=1000
+      - TZ=Asia/Shanghai
+      - SUBFOLDER=/ #optional
+      - TITLE=Webtop #optional
+      - https_proxy=http://10.20.42.187:7890
+      - DOCKER_MODS=linuxserver/mods:universal-package-install 
+      - INSTALL_PACKAGES=fonts-noto-cjk
+      - LC_ALL=zh_CN.UTF-8
+      - XDG_SESSION_TYPE=x11
+      - XDG_SESSION_DESKTOP=dde-x11
+      - XDG_CURRENT_DESKTOP=DDE
+    volumes:
+      - ./data:/config
+      - ./startwm.sh:/defaults/startwm.sh
+      - /var/run/docker.sock:/var/run/docker.sock #optional
+    ports:
+      - 3002:3000
+    devices:
+      - /dev/dri:/dev/dri #optional
+    shm_size: "1gb" #optional
\ No newline at end of file
diff --git a/deepin-webtop/beige/root/defaults/startwm.sh b/deepin-webtop/beige/root/defaults/startwm.sh
new file mode 100755
index 0000000..d282d0c
--- /dev/null
+++ b/deepin-webtop/beige/root/defaults/startwm.sh
@@ -0,0 +1,21 @@
+#!/bin/bash
+
+# Enable Nvidia GPU support if detected
+if which nvidia-smi; then
+  export LIBGL_KOPPER_DRI2=1
+  export MESA_LOADER_DRIVER_OVERRIDE=zink
+  export GALLIUM_DRIVER=zink
+fi
+
+# Disable compositing and screen lock
+# if [ ! -f $HOME/.config/kwinrc ]; then
+#   kwriteconfig5 --file $HOME/.config/kwinrc --group Compositing --key Enabled false
+# fi
+# if [ ! -f $HOME/.config/kscreenlockerrc ]; then
+#   kwriteconfig5 --file $HOME/.config/kscreenlockerrc --group Daemon --key Autolock false
+# fi
+setterm blank 0
+setterm powerdown 0
+
+# Launch DE
+/usr/bin/dde-session > /dev/null 2>&1
diff --git a/deepin-webtop/beige/root/usr/local/bin/wrapped-chromium b/deepin-webtop/beige/root/usr/local/bin/wrapped-chromium
new file mode 100755
index 0000000..bfad4da
--- /dev/null
+++ b/deepin-webtop/beige/root/usr/local/bin/wrapped-chromium
@@ -0,0 +1,15 @@
+#! /bin/bash
+
+BIN=/usr/bin/chromium
+
+# Cleanup
+if ! pgrep chromium > /dev/null;then
+  rm -f $HOME/.config/chromium/Singleton*
+fi
+
+# Run normally on privved containers or modified un non priv
+if grep -q 'Seccomp:.0' /proc/1/status; then
+  ${BIN} --password-store=basic "$@"
+else
+  ${BIN} --password-store=basic --no-sandbox --test-type "$@"
+fi