Fix Docker-in-Docker and add Playwright to workspace image (#24)

Two changes:

1. Add /var/lib/docker volume mount to workspace containers
   - Without this, nested Docker tries to use overlay-on-overlay which fails
   - This matches the original subroutinecom/workspace behavior
   - Creates workspace-{name}-docker volume alongside workspace-{name} volume
   - Volume is cleaned up on workspace deletion

2. Pre-install Playwright Chromium in workspace image
   - Enables running Playwright tests inside workspaces
   - Only dependency that was missing for full Perry development

With these changes, the full Perry validation loop (bun run validate)
works inside a workspace, enabling Perry-in-Perry development.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

Author: gricha

perry/Dockerfile

@@ -180,6 +180,8 @@ RUN curl -fsSL https://claude.ai/install.sh | bash
 
 RUN curl -fsSL https://opencode.ai/install | bash
 
+RUN bunx playwright install chromium --with-deps
+
 USER root
 
 ENV PATH="/home/workspace/.opencode/bin:${PATH}"

src/workspace/manager.ts

@@ -539,14 +539,22 @@ export class WorkspaceManager {
         containerEnv.WORKSPACE_REPO_URL = clone;
       }
 
+      const dockerVolumeName = `${VOLUME_PREFIX}${name}-docker`;
+      if (!(await docker.volumeExists(dockerVolumeName))) {
+        await docker.createVolume(dockerVolumeName);
+      }
+
       const containerId = await docker.createContainer({
         name: containerName,
         image: workspaceImage,
         hostname: name,
         privileged: true,
         restartPolicy: 'unless-stopped',
         env: containerEnv,
-        volumes: [{ source: volumeName, target: '/home/workspace', readonly: false }],
+        volumes: [
+          { source: volumeName, target: '/home/workspace', readonly: false },
+          { source: dockerVolumeName, target: '/var/lib/docker', readonly: false },
+        ],
         ports: [{ hostPort: sshPort, containerPort: 22, protocol: 'tcp' }],
         labels: {
           'workspace.name': name,
@@ -620,14 +628,22 @@ export class WorkspaceManager {
           containerEnv.WORKSPACE_REPO_URL = workspace.repo;
         }
 
+        const dockerVolumeName = `${VOLUME_PREFIX}${name}-docker`;
+        if (!(await docker.volumeExists(dockerVolumeName))) {
+          await docker.createVolume(dockerVolumeName);
+        }
+
         const containerId = await docker.createContainer({
           name: containerName,
           image: workspaceImage,
           hostname: name,
           privileged: true,
           restartPolicy: 'unless-stopped',
           env: containerEnv,
-          volumes: [{ source: volumeName, target: '/home/workspace', readonly: false }],
+          volumes: [
+            { source: volumeName, target: '/home/workspace', readonly: false },
+            { source: dockerVolumeName, target: '/var/lib/docker', readonly: false },
+          ],
           ports: [{ hostPort: sshPort, containerPort: 22, protocol: 'tcp' }],
           labels: {
             'workspace.name': name,
@@ -695,6 +711,7 @@ export class WorkspaceManager {
 
     const containerName = getContainerName(name);
     const volumeName = `${VOLUME_PREFIX}${name}`;
+    const dockerVolumeName = `${VOLUME_PREFIX}${name}-docker`;
 
     if (await docker.containerExists(containerName)) {
       await docker.removeContainer(containerName, true);
@@ -704,6 +721,10 @@ export class WorkspaceManager {
       await docker.removeVolume(volumeName, true);
     }
 
+    if (await docker.volumeExists(dockerVolumeName)) {
+      await docker.removeVolume(dockerVolumeName, true);
+    }
+
     await this.state.deleteWorkspace(name);
   }