fix(render-service): make parallel capture effective (#1042)

* fix(render-service): make parallel capture effective

* fix(render-service): preserve adaptive workers and beginframe

* fix(render-service): restore adaptive compose sizing

Author: cosarah

docker-compose.yml

@@ -15,7 +15,7 @@ services:
         - NEXT_PUBLIC_VIDEO_EXPORT_CTA_DESTINATION=${NEXT_PUBLIC_VIDEO_EXPORT_CTA_DESTINATION:-}
         - NEXT_PUBLIC_ENABLE_PPTX_IMPORT=${NEXT_PUBLIC_ENABLE_PPTX_IMPORT:-}
     ports:
-      - "3000:3000"
+      - '3000:3000'
     env_file:
       - .env.local
     environment:
@@ -49,7 +49,7 @@ services:
       # before using the stack outside a local trusted environment.
       - POSTGRES_PASSWORD=${PERSISTENCE_POSTGRES_PASSWORD:-openmaic-dev}
     healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U openmaic -d openmaic"]
+      test: ['CMD-SHELL', 'pg_isready -U openmaic -d openmaic']
       interval: 5s
       timeout: 5s
       retries: 10
@@ -76,26 +76,35 @@ services:
     profiles:
       - video-export
     expose:
-      - "9000"
+      - '9000'
     # Required for the entrypoint's iptables egress lockdown. Without it the
     # service still boots, but logs a warning and does NOT block Chromium egress.
     cap_add:
       - NET_ADMIN
     environment:
       - PORT=9000
-      # Use Chromium's HeadlessExperimental.beginFrame capture path instead of
-      # the CPU-bound Page.captureScreenshot fallback. The default "software" GPU
-      # mode (SwiftShader) silently force-enables screenshot capture, which pegs
-      # all cores on CPU rasterization and caps throughput at ~10 fps. Selecting
-      # "hardware" keeps beginFrame active — measured ~2x capture throughput
-      # (~10 -> ~19 fps, 900-frame clip 100s -> 62s), roughly half the CPU, and
-      # pixel-identical static frames (animation frames differ only in sub-pixel
-      # edge antialiasing). No real GPU is required: the win is the faster capture
-      # API, not hardware rasterization — beginFrame falls back gracefully if the
-      # host lacks a GPU.
+      # Keep the beginFrame-capable browser path available when producer decides
+      # the cgroup has enough memory. Under this service's 4 GiB limit producer's
+      # automatic low-memory profile safely selects screenshot capture + one
+      # worker instead of multiplying Chromium for unvalidated 1080p/4K renders.
       - PRODUCER_BROWSER_GPU_MODE=hardware
-      # Tune for the host; each concurrent render drives a full Chromium + FFmpeg.
-      - RENDER_MAX_CONCURRENCY=2
+      - PRODUCER_HEADLESS_SHELL_PATH=/usr/bin/chromium-headless-shell
+      - RENDER_MAX_CONCURRENCY=1
+      - RENDER_MAX_CONCURRENT_EXTRACTIONS=1
+      # Producer's browser pool shares a Chromium compositor across capture
+      # sessions. Keep it disabled so an operator who raises memory and opts into
+      # parallel capture gets independent browsers; the 4 GiB default resolves to
+      # one worker, so this does not multiply memory by itself.
+      - PRODUCER_ENABLE_BROWSER_POOL=false
+      # Leave producer workers unset: producer 0.7.60 applies its cgroup memory,
+      # CPU, small-job, low-memory, and capture-cost guards. Operators may opt
+      # into the measured 720p latency profile documented in the service README.
+      # Long compositions still need CDP headroom even with one adaptive worker.
+      - PRODUCER_PUPPETEER_PROTOCOL_TIMEOUT_MS=900000
+      # OpenMAIC's long slide exports currently exhaust producer's 15s static
+      # verification budget and disable dedup anyway. Skip that guaranteed-lost
+      # startup cost until the verifier can share/scale its plan across workers.
+      - HF_STATIC_DEDUP=false
       # In this default topology the app is exposed directly and does NOT set
       # TRUST_PROXY_HEADERS, so every caller collapses to one identity. A
       # per-identity limit would then throttle the whole deployment to a single
@@ -107,6 +116,9 @@ services:
     # heavy, and extraction is capped separately (RENDER_MAX_CONCURRENT_EXTRACTIONS).
     # Raise for higher RENDER_MAX_CONCURRENCY / larger classrooms.
     mem_limit: 4g
+    # Chromium media/frame work can exceed Docker's 64 MiB default shared-memory
+    # mount. This is a ceiling inside the same 4 GiB cgroup, not eager allocation.
+    shm_size: 2gb
     networks:
       - render
     restart: unless-stopped

render-service/Dockerfile

@@ -1,22 +1,23 @@
-# Isolated render service: Node 22 + system Chromium + FFmpeg.
+# Isolated render service: Node 22 + Chromium headless shell + FFmpeg.
 #
 # Debian (bookworm-slim), NOT Alpine: @hyperframes/producer drives Chromium via
 # puppeteer, and Chromium + its shared libraries are far simpler to provision on
-# glibc/Debian than on musl/Alpine. We install the distro Chromium and point
-# puppeteer at it (PUPPETEER_EXECUTABLE_PATH) so no second browser is downloaded.
+# glibc/Debian than on musl/Alpine. Producer's beginFrame capture requires the
+# old headless shell binary; regular Chromium exposes the resolver path but then
+# rejects HeadlessExperimental.beginFrame and silently falls back to screenshots.
 FROM node:22-bookworm-slim AS base
 
 ENV PUPPETEER_SKIP_DOWNLOAD=true \
-    PUPPETEER_EXECUTABLE_PATH=/usr/bin/chromium \
+    PUPPETEER_EXECUTABLE_PATH=/usr/bin/chromium-headless-shell \
     NODE_ENV=production
 
-# chromium + ffmpeg + the fonts/libs a headless Chrome needs to render text and
-# composite frames. iptables lets the entrypoint lock down egress (block the
-# untrusted Chromium from reaching the app); ca-certificates covers TLS for any
-# asset the composition might still reference before lockdown.
+# chromium-headless-shell + ffmpeg + the fonts/libs a headless Chrome needs to
+# render text and composite frames. iptables lets the entrypoint lock down egress
+# (block the untrusted Chromium from reaching the app); ca-certificates covers
+# TLS for any asset the composition might still reference before lockdown.
 RUN apt-get update \
   && apt-get install -y --no-install-recommends \
-     chromium \
+     chromium-headless-shell \
      ffmpeg \
      iptables \
      ca-certificates \
@@ -39,7 +40,7 @@ FROM base AS runner
 # Non-root: Chromium must run with --no-sandbox in a container, so drop privileges.
 RUN groupadd --system --gid 1001 render \
   && useradd --system --uid 1001 --gid render --home-dir /app render \
-  && mkdir -p /tmp/openmaic-renders \
+  && mkdir -p /tmp/openmaic-renders /app/.cache \
   && chown -R render:render /app /tmp/openmaic-renders
 
 COPY --from=deps /app/node_modules ./node_modules
@@ -55,7 +56,12 @@ RUN sed -i 's/\r$//' /usr/local/bin/docker-entrypoint.sh \
     && chmod +x /usr/local/bin/docker-entrypoint.sh
 
 ENV PORT=9000 \
-    PRODUCER_TMP_PROJECT_DIR=/tmp/openmaic-renders
+    PRODUCER_TMP_PROJECT_DIR=/tmp/openmaic-renders \
+    HOME=/app \
+    XDG_CACHE_HOME=/app/.cache \
+    PRODUCER_BROWSER_GPU_MODE=hardware \
+    PRODUCER_HEADLESS_SHELL_PATH=/usr/bin/chromium-headless-shell \
+    RENDER_REQUIRE_BEGINFRAME=false
 
 # NOTE: we intentionally do NOT set `USER render` here. The container starts as
 # root so the entrypoint can install the iptables egress lockdown (needs