[dcruzeneil2]

Summary

Removes fonts-droid-fallback from the headful image's font install list.

The package installs DroidSansFallbackFull.ttf and a fontconfig rule (65-droid-sans-fallback.conf) that puts Droid Sans Fallback ahead of Noto CJK for sans-serif. With the rule active, Chromium draws Chinese and Japanese text with Droid instead of Noto, which changes how that text measures and renders. Latin, emoji, Thai, Arabic and Devanagari text are unaffected.

That rendering difference is enough for at least one bot-detection vendor to block headful sessions. A site's login POST was rejected with a 403 at the edge from headful browsers, while headless browsers with the same IP, proxy and stealth settings were accepted.

How the cause was isolated

All tests ran in live browser VMs with the same session and IP. Each row is a fake login attempt on the affected site.

Change	Result
Headful, as shipped	blocked (every attempt)
Headful, only 65-droid-sans-fallback.conf disabled	accepted (3/3)
Headful, rule re-enabled	blocked (2/2)
Headless with headful's font files plus only this rule	blocked (2/2)
Headless with headful's font files and other font rules, but not this one	accepted

Ruled out: screen size, hover/pointer media features, keyboard layout, Chromium launch flags, and how the form was filled.

fonts-noto-cjk is still installed, so CJK text keeps rendering, now with Noto, which matches the headless image. The rest of the font set added in #165 is unchanged.

Notes

• --no-install-recommends is used, and an apt-get install -s simulation of the final stage's packages on ubuntu:22.04 shows nothing else pulls in fonts-droid-fallback, so this removes both the font file and the rule.
• The GPU headful image builds on this image and picks up the change.
• The image built from this branch has not been tested yet. The tests above disabled the rule in running VMs with the font file still installed; removing the package also removes the file. The plan is to validate the built image on staging, with a before/after login check on the affected site and the bot-detection bench, before release.

---

Note

Low Risk
Single-package removal from a font install list with documented bot-detection motivation; CJK coverage remains via Noto, pending staging validation on the built image.

Overview
Stops installing fonts-droid-fallback in the chromium-headful image so Droid Sans Fallback and its fontconfig rule (65-droid-sans-fallback.conf) are no longer present. That rule had been prioritizing Droid over Noto CJK for sans-serif, which changed how Chinese/Japanese text measures in Chromium and was enough for at least one bot-detection vendor to block headful logins while headless stayed accepted.

fonts-noto-cjk and the rest of the desktop font set are unchanged; CJK should render via Noto, closer to headless. GPU headful images that extend this Dockerfile inherit the change.

^{Reviewed by Cursor Bugbot for commit 14fa042. Bugbot is set up for automated code reviews on this repo. Configure here.}