Fix Chromium runtime compatibility

.gitattributes

@@ -0,0 +1,4 @@
+*.sh text eol=lf
+*.md text eol=lf
+*.yml text eol=lf
+*.yaml text eol=lf

.github/workflows/shell-tests.yml

@@ -0,0 +1,18 @@
+name: Shell tests
+
+on:
+  push:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  shell-tests:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v7
+      - run: |
+          bash -n browser.sh tests/browser_test.sh
+          bash tests/browser_test.sh

README.md

@@ -12,28 +12,32 @@ It keeps an interactive menu for installing, uninstalling, checking status, and
 
 - Interactive Bash menu for install, uninstall, status, and exit.
 - Chromium and Firefox containers from linuxserver.io.
-- Chromium HTTP on `3000` and HTTPS on `3001`.
-- Firefox HTTP on `4000` and HTTPS on `4001`.
+- Chromium HTTPS on `3001`; HTTP on `3000` is for a reverse proxy only.
+- Firefox HTTPS on `4001`; HTTP on `4000` is for a reverse proxy only.
 - Persistent config in `/opt/instant-linux-browser/<browser>/config`.
 - Username/password prompts, with `ILB_USERNAME` and `ILB_PASSWORD` overrides.
 - Supports amd64/x86_64 and arm64/aarch64 Linux servers when the upstream image supports them.
-- Works when downloaded first or when run through `curl | sudo bash`.
+- Keeps the one-command interactive installer and direct actions for automation.
 
 ## Install
 
 Use only `raw.githubusercontent.com` URLs for curl commands. Do not use normal GitHub page URLs such as `github.com/.../blob/...`, because those return an HTML page, not the raw Bash script.
 
-### Interactive
+### One-command interactive installer
 
 ```bash
-curl -fsSLO https://raw.githubusercontent.com/Mammad3861/Instant-Linux-Browser/main/browser.sh
-sudo bash browser.sh
+curl -fsSL https://raw.githubusercontent.com/Mammad3861/Instant-Linux-Browser/main/browser.sh | sudo bash
 ```
 
-### One-line interactive
+The script reads menu choices and credentials from your controlling terminal, so this remains interactive even though the script is streamed through standard input.
+
+Use the HTTPS browser URL shown after installation. The HTTP URL is for a reverse proxy only.
+
+### Download first
 
 ```bash
-curl -fsSL https://raw.githubusercontent.com/Mammad3861/Instant-Linux-Browser/main/browser.sh | sudo bash
+curl -fsSLO https://raw.githubusercontent.com/Mammad3861/Instant-Linux-Browser/main/browser.sh
+sudo bash browser.sh
 ```
 
 ### Non-interactive Chromium
@@ -61,14 +65,14 @@ sudo bash browser.sh install-chromium
 sudo bash browser.sh install-firefox
 sudo bash browser.sh uninstall-chromium
 sudo bash browser.sh uninstall-firefox
-sudo bash browser.sh status
+sudo bash browser.sh diagnostics
 ```
 
 Environment action form:
 
 ```bash
 sudo ILB_ACTION=install-chromium bash browser.sh
-sudo ILB_ACTION=status bash browser.sh
+sudo ILB_ACTION=diagnostics bash browser.sh
 ```
 
 ## Menu Options
@@ -77,18 +81,20 @@ sudo ILB_ACTION=status bash browser.sh
 - `2` - Uninstall Chromium
 - `3` - Install Firefox
 - `4` - Uninstall Firefox
-- `5` - Show status/diagnostics
+- `5` - Diagnostics
 - `6` - Exit
 
-## Chromium Startup Flags
+## Chromium Compatibility
 
 Chromium is launched with these flags by default:
 
 ```text
---no-sandbox --disable-gpu --disable-software-rasterizer --disable-dev-shm-usage --disable-setuid-sandbox
+--no-sandbox --disable-gpu --disable-dev-shm-usage --disable-setuid-sandbox
 ```
 
-The script passes them to the linuxserver/chromium container through both `CHROME_CLI` and `CHROME_FLAGS`.
+The script passes these flags through `CHROME_CLI` and retains `CHROME_FLAGS` for older setups. It also sets `PIXELFLUX_WAYLAND=false` to use the compatible X11 path on headless VPS servers.
+
+Chromium startup waits briefly for both the container and Chromium process. If either fails, the installer prints recent logs and focused Docker commands for diagnosis.
 
 To override them:
 
@@ -107,7 +113,9 @@ Before starting a browser, the script:
 - pulls the selected Docker image;
 - creates the persistent config directory;
 - starts the container;
-- verifies that the container is still running.
+- verifies that the container is running and, for Chromium, that its process exists.
+
+`diagnostics` is read-only: it reports Docker state when available and never installs Docker or starts its daemon.
 
 If startup fails, check logs:
 
@@ -132,9 +140,10 @@ Delete those directories manually only if you no longer need the browser profile
 If exposing the browser to the public internet:
 
 - use a strong password;
-- restrict access with a firewall, VPN, or IP allow-list;
-- consider putting it behind Nginx, Traefik, or another HTTPS reverse proxy;
-- avoid exposing ports `3000`, `3001`, `4000`, or `4001` publicly unless needed.
+- do not expose HTTP port `3000` directly; use it behind a reverse proxy;
+- treat `CUSTOM_USER` and `PASSWORD` as basic protection for a trusted local network, not sufficient public Internet protection;
+- use HTTPS and a reverse proxy with robust authentication for public exposure;
+- restrict access with a firewall, VPN, or IP allow-list.
 
 Empty passwords are allowed, but the script warns when one is selected.