Attempting to run Puppeteer, a Node library to control a headless Chromium (in order to do things like create a PDF of a website), in Docker is a surprisingly fiddly thing.
The problem is that, from my understanding, to run as root, you need the option
--no-sandbox, which is rightly decried as being an insecure and bad solution. The problem is that the go-to alternatives seem to be just as bad:
Running the container with
CAP_ADD=SYS_ADMIN, which I think I needn't comment further, or
Running as non-root, but to run Puppeteer in a non-root sandbox, you need to enable the kernel option
unprivileged_userns_clone, which once I started researching found it was said to
"open[s] up severe vulnerabilities in the Linux kernel" (link)
as well as
"Unprivileged user namespaces are extremely dangerous" (link)
I am surprised that doing something as simple and comparatively low level as running a web browser seems to require such wide ranging permissions that apparently open up wide swathes of attack vectors. The kind of warnings I'm reading are what I would expect to read if I were to root a phone or compromise the operating systems security routines.
Am I misunderstanding the situation here, or is to run Chromium in a Docker container tantamount to opening up my server to half the internet ?