Attempting to run Puppeteer, a Node library to control a headless Chromium (in order to do things like create a PDF of a website), in Docker is a surprisingly fiddly thing.

The problem is that, from my understanding, to run as root, you need the option --no-sandbox, which is rightly decried as being an insecure and bad solution. The problem is that the go-to alternatives seem to be just as bad:

  • Running the container with CAP_ADD=SYS_ADMIN, which I think I needn't comment further, or

  • Running as non-root, but to run Puppeteer in a non-root sandbox, you need to enable the kernel option unprivileged_userns_clone, which once I started researching found it was said to

"open[s] up severe vulnerabilities in the Linux kernel" (link)

as well as

"Unprivileged user namespaces are extremely dangerous" (link)

I am surprised that doing something as simple and comparatively low level as running a web browser seems to require such wide ranging permissions that apparently open up wide swathes of attack vectors. The kind of warnings I'm reading are what I would expect to read if I were to root a phone or compromise the operating systems security routines.

Am I misunderstanding the situation here, or is to run Chromium in a Docker container tantamount to opening up my server to half the internet ?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.