tiered rate limit jwt e2e tests

.github/data/matrix-smoke-plus.json

@@ -64,19 +64,26 @@
       "platforms": "linux/arm64, linux/amd64"
     },
     {
-      "label": "policies 1/2",
+      "label": "policies 1/3",
       "image": "ubi-9-plus",
       "type": "plus",
-      "marker": "'policies and not policies_ac and not policies_jwt and not policies_mtls'",
+      "marker": "'policies and not policies_ac and not policies_jwt and not policies_mtls and not policies_rl'",
       "platforms": "linux/arm64, linux/amd64, linux/s390x"
     },
     {
-      "label": "policies 2/2",
+      "label": "policies 2/3",
       "image": "ubi-9-plus",
       "type": "plus",
       "marker": "'policies_ac or policies_jwt or policies_mtls'",
       "platforms": "linux/arm64, linux/amd64, linux/s390x"
     },
+    {
+      "label": "policies 3/3",
+      "image": "ubi-9-plus",
+      "type": "plus",
+      "marker": "policies_rl",
+      "platforms": "linux/arm64, linux/amd64, linux/s390x"
+    },
     {
       "label": "OIDC-UI 1/1",
       "image": "debian-plus",

examples/custom-resources/rate-limit-tiered-jwt-claim/basic-token.jwt

@@ -1 +1 @@
-eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyX2RldGFpbHMiOnsibGV2ZWwiOiJCYXNpYyJ9LCJzdWIiOiJjbGllbnQyIiwibmFtZSI6IkphbmUgRG9lIn0.WeylllL0g70FQqtuz9HQh8oI7-1y9Qlx1_LVCZxAGLE
+eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6IjAwMDEifQ.eyJ1c2VyX2RldGFpbHMiOnsibGV2ZWwiOiJCYXNpYyJ9LCJzdWIiOiJjbGllbnQyIiwibmFtZSI6IkphbmUgRG9lIn0.Iy187N0_DQF-uQwGzsnn4fOwADNAYotNWB8nSMQaD2M

examples/custom-resources/rate-limit-tiered-jwt-claim/default-token.jwt

@@ -1 +1 @@
-eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJjbGllbnQzIiwibmFtZSI6IkJpbGx5IEJsb2dncyJ9.ARozS58-7UN5enKlH1AXt_QC_tuRoLC1I-lTc0UrJFo
+eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6IjAwMDEifQ.eyJzdWIiOiJjbGllbnQzIiwibmFtZSI6IkJpbGx5IEJsb2dncyJ9.i0CScSOYEaMCkrIA8HpvElfjrdDr4pp2HEkpgnc8UVc

examples/custom-resources/rate-limit-tiered-jwt-claim/premium-token.jwt

@@ -1 +1 @@
-eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyX2RldGFpbHMiOnsibGV2ZWwiOiJQcmVtaXVtIn0sInN1YiI6ImNsaWVudDUiLCJuYW1lIjoiSm9obiBEb2UiLCJpYXQiOjE1MTYyMzkwMjJ9.LxYflVUa01jsoxo4TbC4h5pnqypBamV1XUqKdAGt968
+eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6IjAwMDEifQ.eyJ1c2VyX2RldGFpbHMiOnsibGV2ZWwiOiJQcmVtaXVtIn0sInN1YiI6ImNsaWVudDUiLCJuYW1lIjoiSm9obiBEb2UiLCJpYXQiOjE1MTYyMzkwMjJ9.v2s74eW_jIkR0VKKv0JmQZ6WwQSdDDDtUTWFjAwg82c

internal/configs/virtualserver.go

@@ -1048,7 +1048,7 @@ func (p *policiesCfg) addRateLimitConfig(
 ) *validationResults {
 	res := newValidationResults()
 
-	rlZoneName := fmt.Sprintf("pol_rl_%v_%v_%v_%v", polNamespace, polName, ownerDetails.vsNamespace, ownerDetails.vsName)
+	rlZoneName := rfc1123ToSnake(fmt.Sprintf("pol_rl_%v_%v_%v_%v", polNamespace, polName, ownerDetails.vsNamespace, ownerDetails.vsName))
 	if rateLimit.Condition != nil && rateLimit.Condition.JWT.Claim != "" && rateLimit.Condition.JWT.Match != "" {
 		lrz := generateGroupedLimitReqZone(rlZoneName, rateLimit, podReplicas, ownerDetails)
 		p.RateLimit.PolicyGroupMaps = append(p.RateLimit.PolicyGroupMaps, *generateLRZPolicyGroupMap(lrz))
@@ -1778,16 +1778,16 @@ func generateGroupedLimitReqZone(zoneName string,
 			strings.ToLower(rateLimitPol.Condition.JWT.Match),
 		)
 
-		lrz.GroupVariable = fmt.Sprintf("$rl_%s_%s_group_%s",
+		lrz.GroupVariable = rfc1123ToSnake(fmt.Sprintf("$rl_%s_%s_group_%s",
 			ownerDetails.vsNamespace,
 			ownerDetails.vsName,
 			strings.ToLower(
 				strings.Join(
 					strings.Split(rateLimitPol.Condition.JWT.Claim, "."), "_",
 				),
 			),
-		)
-		lrz.Key = fmt.Sprintf("$%s", strings.Replace(zoneName, "-", "_", -1))
+		))
+		lrz.Key = rfc1123ToSnake(fmt.Sprintf("$%s", zoneName))
 		lrz.PolicyResult = rateLimitPol.Key
 		lrz.GroupDefault = rateLimitPol.Condition.Default
 		lrz.GroupSource = generateAuthJwtClaimSetVariable(rateLimitPol.Condition.JWT.Claim, ownerDetails.vsNamespace, ownerDetails.vsName)
@@ -1858,7 +1858,7 @@ func generateAuthJwtClaimSet(jwtCondition conf_v1.JWTCondition, owner policyOwne
 }
 
 func generateAuthJwtClaimSetVariable(claim string, vsNamespace string, vsName string) string {
-	return fmt.Sprintf("$jwt_%v_%v_%v", vsNamespace, vsName, strings.Join(strings.Split(claim, "."), "_"))
+	return strings.ReplaceAll(fmt.Sprintf("$jwt_%v_%v_%v", vsNamespace, vsName, strings.Join(strings.Split(claim, "."), "_")), "-", "_")
 }
 
 func generateAuthJwtClaimSetClaim(claim string) string {

internal/configs/virtualserver_test.go

@@ -6570,7 +6570,7 @@ func TestGenerateVirtualServerConfigRateLimitGroups(t *testing.T) {
 				LimitReqZones: []version2.LimitReqZone{
 					{
 						Key:           "$pol_rl_default_premium_rate_limit_policy_default_cafe",
-						ZoneName:      "pol_rl_default_premium-rate-limit-policy_default_cafe",
+						ZoneName:      "pol_rl_default_premium_rate_limit_policy_default_cafe",
 						ZoneSize:      "10M",
 						Rate:          "10r/s",
 						PolicyResult:  "$jwt_claim_sub",
@@ -6581,7 +6581,7 @@ func TestGenerateVirtualServerConfigRateLimitGroups(t *testing.T) {
 					},
 					{
 						Key:           "$pol_rl_default_basic_rate_limit_policy_default_cafe",
-						ZoneName:      "pol_rl_default_basic-rate-limit-policy_default_cafe",
+						ZoneName:      "pol_rl_default_basic_rate_limit_policy_default_cafe",
 						ZoneSize:      "20M",
 						Rate:          "20r/s",
 						PolicyResult:  "$jwt_claim_sub",
@@ -6598,8 +6598,8 @@ func TestGenerateVirtualServerConfigRateLimitGroups(t *testing.T) {
 					VSNamespace:  "default",
 					VSName:       "cafe",
 					LimitReqs: []version2.LimitReq{
-						{ZoneName: "pol_rl_default_premium-rate-limit-policy_default_cafe", Burst: 0, NoDelay: false, Delay: 0},
-						{ZoneName: "pol_rl_default_basic-rate-limit-policy_default_cafe", Burst: 0, NoDelay: false, Delay: 0},
+						{ZoneName: "pol_rl_default_premium_rate_limit_policy_default_cafe", Burst: 0, NoDelay: false, Delay: 0},
+						{ZoneName: "pol_rl_default_basic_rate_limit_policy_default_cafe", Burst: 0, NoDelay: false, Delay: 0},
 					},
 					LimitReqOptions: version2.LimitReqOptions{
 						DryRun:     false,
@@ -6805,7 +6805,7 @@ func TestGenerateVirtualServerConfigRateLimitGroups(t *testing.T) {
 				LimitReqZones: []version2.LimitReqZone{
 					{
 						Key:           "$pol_rl_default_premium_rate_limit_policy_default_cafe",
-						ZoneName:      "pol_rl_default_premium-rate-limit-policy_default_cafe",
+						ZoneName:      "pol_rl_default_premium_rate_limit_policy_default_cafe",
 						ZoneSize:      "10M",
 						Rate:          "10r/s",
 						PolicyResult:  "$jwt_claim_sub",
@@ -6816,7 +6816,7 @@ func TestGenerateVirtualServerConfigRateLimitGroups(t *testing.T) {
 					},
 					{
 						Key:           "$pol_rl_default_basic_rate_limit_policy_default_cafe",
-						ZoneName:      "pol_rl_default_basic-rate-limit-policy_default_cafe",
+						ZoneName:      "pol_rl_default_basic_rate_limit_policy_default_cafe",
 						ZoneSize:      "20M",
 						Rate:          "20r/s",
 						PolicyResult:  "$jwt_claim_sub",
@@ -6834,8 +6834,8 @@ func TestGenerateVirtualServerConfigRateLimitGroups(t *testing.T) {
 					VSNamespace:  "default",
 					VSName:       "cafe",
 					LimitReqs: []version2.LimitReq{
-						{ZoneName: "pol_rl_default_premium-rate-limit-policy_default_cafe", Burst: 0, NoDelay: false, Delay: 0},
-						{ZoneName: "pol_rl_default_basic-rate-limit-policy_default_cafe", Burst: 0, NoDelay: false, Delay: 0},
+						{ZoneName: "pol_rl_default_premium_rate_limit_policy_default_cafe", Burst: 0, NoDelay: false, Delay: 0},
+						{ZoneName: "pol_rl_default_basic_rate_limit_policy_default_cafe", Burst: 0, NoDelay: false, Delay: 0},
 					},
 					LimitReqOptions: version2.LimitReqOptions{
 						DryRun:     false,
@@ -7041,7 +7041,7 @@ func TestGenerateVirtualServerConfigRateLimitGroups(t *testing.T) {
 				LimitReqZones: []version2.LimitReqZone{
 					{
 						Key:           "$pol_rl_default_premium_rate_limit_policy_default_cafe",
-						ZoneName:      "pol_rl_default_premium-rate-limit-policy_default_cafe",
+						ZoneName:      "pol_rl_default_premium_rate_limit_policy_default_cafe",
 						ZoneSize:      "10M",
 						Rate:          "10r/s",
 						PolicyResult:  "$jwt_claim_sub",
@@ -7052,7 +7052,7 @@ func TestGenerateVirtualServerConfigRateLimitGroups(t *testing.T) {
 					},
 					{
 						Key:           "$pol_rl_default_basic_rate_limit_policy_default_cafe",
-						ZoneName:      "pol_rl_default_basic-rate-limit-policy_default_cafe",
+						ZoneName:      "pol_rl_default_basic_rate_limit_policy_default_cafe",
 						ZoneSize:      "20M",
 						Rate:          "20r/s",
 						PolicyResult:  "$jwt_claim_sub",
@@ -7081,8 +7081,8 @@ func TestGenerateVirtualServerConfigRateLimitGroups(t *testing.T) {
 							ProxySetHeaders:          []version2.Header{{Name: "Host", Value: "$host"}},
 							ServiceName:              "tea-svc",
 							LimitReqs: []version2.LimitReq{
-								{ZoneName: "pol_rl_default_premium-rate-limit-policy_default_cafe", Burst: 0, NoDelay: false, Delay: 0},
-								{ZoneName: "pol_rl_default_basic-rate-limit-policy_default_cafe", Burst: 0, NoDelay: false, Delay: 0},
+								{ZoneName: "pol_rl_default_premium_rate_limit_policy_default_cafe", Burst: 0, NoDelay: false, Delay: 0},
+								{ZoneName: "pol_rl_default_basic_rate_limit_policy_default_cafe", Burst: 0, NoDelay: false, Delay: 0},
 							},
 							LimitReqOptions: version2.LimitReqOptions{
 								DryRun:     false,
@@ -7296,7 +7296,7 @@ func TestGenerateVirtualServerConfigRateLimitGroups(t *testing.T) {
 				LimitReqZones: []version2.LimitReqZone{
 					{
 						Key:           "$pol_rl_default_premium_rate_limit_policy_default_cafe",
-						ZoneName:      "pol_rl_default_premium-rate-limit-policy_default_cafe",
+						ZoneName:      "pol_rl_default_premium_rate_limit_policy_default_cafe",
 						ZoneSize:      "10M",
 						Rate:          "10r/s",
 						PolicyResult:  "$jwt_claim_sub",
@@ -7307,7 +7307,7 @@ func TestGenerateVirtualServerConfigRateLimitGroups(t *testing.T) {
 					},
 					{
 						Key:           "$pol_rl_default_basic_rate_limit_policy_default_cafe",
-						ZoneName:      "pol_rl_default_basic-rate-limit-policy_default_cafe",
+						ZoneName:      "pol_rl_default_basic_rate_limit_policy_default_cafe",
 						ZoneSize:      "20M",
 						Rate:          "20r/s",
 						PolicyResult:  "$jwt_claim_sub",
@@ -7350,8 +7350,8 @@ func TestGenerateVirtualServerConfigRateLimitGroups(t *testing.T) {
 							VSRName:                  "tea",
 							VSRNamespace:             "default",
 							LimitReqs: []version2.LimitReq{
-								{ZoneName: "pol_rl_default_premium-rate-limit-policy_default_cafe", Burst: 0, NoDelay: false, Delay: 0},
-								{ZoneName: "pol_rl_default_basic-rate-limit-policy_default_cafe", Burst: 0, NoDelay: false, Delay: 0},
+								{ZoneName: "pol_rl_default_premium_rate_limit_policy_default_cafe", Burst: 0, NoDelay: false, Delay: 0},
+								{ZoneName: "pol_rl_default_basic_rate_limit_policy_default_cafe", Burst: 0, NoDelay: false, Delay: 0},
 							},
 							LimitReqOptions: version2.LimitReqOptions{
 								DryRun:     false,
@@ -7562,7 +7562,7 @@ func TestGenerateVirtualServerConfigRateLimitGroups(t *testing.T) {
 				LimitReqZones: []version2.LimitReqZone{
 					{
 						Key:           "$pol_rl_default_premium_rate_limit_policy_default_cafe",
-						ZoneName:      "pol_rl_default_premium-rate-limit-policy_default_cafe",
+						ZoneName:      "pol_rl_default_premium_rate_limit_policy_default_cafe",
 						ZoneSize:      "10M",
 						Rate:          "10r/s",
 						PolicyResult:  "$jwt_claim_sub",
@@ -7573,7 +7573,7 @@ func TestGenerateVirtualServerConfigRateLimitGroups(t *testing.T) {
 					},
 					{
 						Key:           "$pol_rl_default_basic_rate_limit_policy_default_cafe",
-						ZoneName:      "pol_rl_default_basic-rate-limit-policy_default_cafe",
+						ZoneName:      "pol_rl_default_basic_rate_limit_policy_default_cafe",
 						ZoneSize:      "20M",
 						Rate:          "20r/s",
 						PolicyResult:  "$jwt_claim_sub",
@@ -7591,8 +7591,8 @@ func TestGenerateVirtualServerConfigRateLimitGroups(t *testing.T) {
 					VSNamespace:  "default",
 					VSName:       "cafe",
 					LimitReqs: []version2.LimitReq{
-						{ZoneName: "pol_rl_default_premium-rate-limit-policy_default_cafe", Burst: 0, NoDelay: false, Delay: 0},
-						{ZoneName: "pol_rl_default_basic-rate-limit-policy_default_cafe", Burst: 0, NoDelay: false, Delay: 0},
+						{ZoneName: "pol_rl_default_premium_rate_limit_policy_default_cafe", Burst: 0, NoDelay: false, Delay: 0},
+						{ZoneName: "pol_rl_default_basic_rate_limit_policy_default_cafe", Burst: 0, NoDelay: false, Delay: 0},
 					},
 					LimitReqOptions: version2.LimitReqOptions{
 						DryRun:     false,
@@ -7625,8 +7625,8 @@ func TestGenerateVirtualServerConfigRateLimitGroups(t *testing.T) {
 							VSRName:                  "tea",
 							VSRNamespace:             "default",
 							LimitReqs: []version2.LimitReq{
-								{ZoneName: "pol_rl_default_premium-rate-limit-policy_default_cafe", Burst: 0, NoDelay: false, Delay: 0},
-								{ZoneName: "pol_rl_default_basic-rate-limit-policy_default_cafe", Burst: 0, NoDelay: false, Delay: 0},
+								{ZoneName: "pol_rl_default_premium_rate_limit_policy_default_cafe", Burst: 0, NoDelay: false, Delay: 0},
+								{ZoneName: "pol_rl_default_basic_rate_limit_policy_default_cafe", Burst: 0, NoDelay: false, Delay: 0},
 							},
 							LimitReqOptions: version2.LimitReqOptions{
 								DryRun:     false,
@@ -7857,7 +7857,7 @@ func TestGenerateVirtualServerConfigWithRateLimitGroupsWarning(t *testing.T) {
 			},
 			{
 				Key:           "$pol_rl_default_basic_rate_limit_policy_default_cafe",
-				ZoneName:      "pol_rl_default_basic-rate-limit-policy_default_cafe",
+				ZoneName:      "pol_rl_default_basic_rate_limit_policy_default_cafe",
 				ZoneSize:      "20M",
 				Rate:          "20r/s",
 				PolicyResult:  "$jwt_claim_sub",
@@ -7874,8 +7874,8 @@ func TestGenerateVirtualServerConfigWithRateLimitGroupsWarning(t *testing.T) {
 			VSNamespace:  "default",
 			VSName:       "cafe",
 			LimitReqs: []version2.LimitReq{
-				{ZoneName: "pol_rl_default_premium-rate-limit-policy_default_cafe", Burst: 0, NoDelay: false, Delay: 0},
-				{ZoneName: "pol_rl_default_basic-rate-limit-policy_default_cafe", Burst: 0, NoDelay: false, Delay: 0},
+				{ZoneName: "pol_rl_default_premium_rate_limit_policy_default_cafe", Burst: 0, NoDelay: false, Delay: 0},
+				{ZoneName: "pol_rl_default_basic_rate_limit_policy_default_cafe", Burst: 0, NoDelay: false, Delay: 0},
 			},
 			LimitReqOptions: version2.LimitReqOptions{
 				DryRun:     false,
@@ -8131,15 +8131,15 @@ func TestGeneratePolicies(t *testing.T) {
 				RateLimit: rateLimit{
 					Reqs: []version2.LimitReq{
 						{
-							ZoneName: "pol_rl_default_rateLimit-policy_default_test",
+							ZoneName: "pol_rl_default_rateLimit_policy_default_test",
 						},
 					},
 					Zones: []version2.LimitReqZone{
 						{
 							Key:      "test",
 							ZoneSize: "10M",
 							Rate:     "10r/s",
-							ZoneName: "pol_rl_default_rateLimit-policy_default_test",
+							ZoneName: "pol_rl_default_rateLimit_policy_default_test",
 						},
 					},
 					Options: version2.LimitReqOptions{
@@ -8188,13 +8188,13 @@ func TestGeneratePolicies(t *testing.T) {
 							Key:      "test",
 							ZoneSize: "10M",
 							Rate:     "10r/s",
-							ZoneName: "pol_rl_default_rateLimit-policy_default_test",
+							ZoneName: "pol_rl_default_rateLimit_policy_default_test",
 						},
 						{
 							Key:      "test2",
 							ZoneSize: "20M",
 							Rate:     "20r/s",
-							ZoneName: "pol_rl_default_rateLimit-policy2_default_test",
+							ZoneName: "pol_rl_default_rateLimit_policy2_default_test",
 						},
 					},
 					Options: version2.LimitReqOptions{
@@ -8203,10 +8203,10 @@ func TestGeneratePolicies(t *testing.T) {
 					},
 					Reqs: []version2.LimitReq{
 						{
-							ZoneName: "pol_rl_default_rateLimit-policy_default_test",
+							ZoneName: "pol_rl_default_rateLimit_policy_default_test",
 						},
 						{
-							ZoneName: "pol_rl_default_rateLimit-policy2_default_test",
+							ZoneName: "pol_rl_default_rateLimit_policy2_default_test",
 						},
 					},
 				},
@@ -8240,7 +8240,7 @@ func TestGeneratePolicies(t *testing.T) {
 							Key:      "test",
 							ZoneSize: "10M",
 							Rate:     "5r/s",
-							ZoneName: "pol_rl_default_rateLimitScale-policy_default_test",
+							ZoneName: "pol_rl_default_rateLimitScale_policy_default_test",
 						},
 					},
 					Options: version2.LimitReqOptions{
@@ -8249,7 +8249,7 @@ func TestGeneratePolicies(t *testing.T) {
 					},
 					Reqs: []version2.LimitReq{
 						{
-							ZoneName: "pol_rl_default_rateLimitScale-policy_default_test",
+							ZoneName: "pol_rl_default_rateLimitScale_policy_default_test",
 						},
 					},
 				},
@@ -8962,13 +8962,13 @@ func TestGeneratePoliciesFails(t *testing.T) {
 							Key:      "test",
 							ZoneSize: "10M",
 							Rate:     "10r/s",
-							ZoneName: "pol_rl_default_rateLimit-policy_default_test",
+							ZoneName: "pol_rl_default_rateLimit_policy_default_test",
 						},
 						{
 							Key:      "test2",
 							ZoneSize: "20M",
 							Rate:     "20r/s",
-							ZoneName: "pol_rl_default_rateLimit-policy2_default_test",
+							ZoneName: "pol_rl_default_rateLimit_policy2_default_test",
 						},
 					},
 					Options: version2.LimitReqOptions{
@@ -8977,10 +8977,10 @@ func TestGeneratePoliciesFails(t *testing.T) {
 					},
 					Reqs: []version2.LimitReq{
 						{
-							ZoneName: "pol_rl_default_rateLimit-policy_default_test",
+							ZoneName: "pol_rl_default_rateLimit_policy_default_test",
 						},
 						{
-							ZoneName: "pol_rl_default_rateLimit-policy2_default_test",
+							ZoneName: "pol_rl_default_rateLimit_policy2_default_test",
 						},
 					},
 				},

tests/Dockerfile

@@ -1,4 +1,4 @@
-# syntax=docker/dockerfile:1.5
+# syntax=docker/dockerfile:1.11
 # this is here so we can grab the latest version of kind and have dependabot keep it up to date
 FROM kindest/node:v1.32.2@sha256:f226345927d7e348497136874b6d207e0b32cc52154ad8323129352923a3142f
 
@@ -8,27 +8,23 @@ FROM quay.io/skopeo/stable:v1.17.0
 FROM python:3.13@sha256:08471c63c5fdf2644adc142a7fa8d0290eb405cda14c473fbe5b4cd0933af601
 
 RUN apt-get update \
-	&& apt-get install -y curl git \
+	&& apt-get install -y curl git apache2-utils \
 	&& rm -rf /var/lib/apt/lists/*
 
 WORKDIR /workspace/tests
 
-COPY --link tests/requirements.txt /workspace/tests/
-RUN pip install --require-hashes -r requirements.txt --no-deps
-RUN playwright install --with-deps chromium
 
+COPY --link tests/requirements.txt /workspace/tests/
 COPY --link deployments /workspace/deployments
 COPY --link config /workspace/config
+COPY --link tests /workspace/tests
+COPY --link pyproject.toml /workspace/pyproject.toml
 
 RUN curl -LO https://storage.googleapis.com/kubernetes-release/release/$(curl -s https://storage.googleapis.com/kubernetes-release/release/stable.txt)/bin/linux/amd64/kubectl \
 	&& install -o root -g root -m 0755 kubectl /usr/local/bin/kubectl \
-	&& apt-get update && apt-get install -y apache2-utils
+    && curl https://get.docker.com/builds/Linux/x86_64/docker-latest.tgz | tar xvz -C /tmp/ && mv /tmp/docker/docker /usr/bin/docker
 
-RUN apt update -y \
-	&& curl https://get.docker.com/builds/Linux/x86_64/docker-latest.tgz | tar xvz -C /tmp/ && mv /tmp/docker/docker /usr/bin/docker
-
-COPY --link tests /workspace/tests
-
-COPY --link pyproject.toml /workspace/
+RUN pip install --require-hashes -r requirements.txt --no-deps
+RUN playwright install --with-deps chromium
 
 ENTRYPOINT ["python3", "-m", "pytest"]