chrome/Dockerfile

64 lines
2.6 KiB
Docker
Raw Normal View History

2016-03-23 20:46:30 +00:00
# Run Chrome in a container
2016-05-07 08:38:37 +00:00
FROM ubuntu:xenial
2016-03-23 20:46:30 +00:00
MAINTAINER Andrey Arapov <andrey.arapov@nixaid.com>
# To avoid problems with Dialog and curses wizards
ENV DEBIAN_FRONTEND noninteractive
ADD https://dl.google.com/linux/direct/google-talkplugin_current_amd64.deb /tmp/google-talkplugin_current_amd64.deb
ADD https://dl.google.com/linux/direct/google-chrome-stable_current_amd64.deb /tmp/google-chrome-stable_current_amd64.deb
RUN sh -c 'dpkg -i /tmp/google-chrome-stable_current_amd64.deb \
2016-05-07 08:38:37 +00:00
/tmp/google-talkplugin_current_amd64.deb 2>/dev/null; exit 0' && \
apt-get update && \
apt-get -fy install && \
2016-05-19 15:49:31 +00:00
apt-get install -y libcanberra-gtk-module libexif12 pulseaudio paxctl && \
2016-05-07 08:38:37 +00:00
rm -rf -- /var/lib/apt/lists /tmp/*.deb
# Workaround: pulseaudio client library likes to remove /dev/shm/pulse-shm-*
# files created by the host, causing sound to stop working.
# To fix this, we either want to disable the shm or mount /dev/shm
# in read-only mode when starting the container.
RUN echo "enable-shm = no" >> /etc/pulse/client.conf
2016-05-19 15:49:31 +00:00
# Make Google Chrome grsec friendly
# more info: https://en.wikibooks.org/wiki/Grsecurity/Application-specific_Settings#Google_Chrome_15.0.874.106
#
# To build the Docker image, I currently had to disable the following grsec protections:
# # grep -E "chroot_deny_chmod|chroot_deny_mknod|chroot_caps" /etc/sysctl.d/grsec.conf
# kernel.grsecurity.chroot_deny_chmod = 0
# kernel.grsecurity.chroot_deny_mknod = 0
# kernel.grsecurity.chroot_caps = 0 (relates to a systemd package)
#
# (runtime only, since xattrs are not preserved in Docker's final image)
# m: Disable MPROTECT // grsec: denied RWX mmap of <anonymous mapping>
# RUN setfattr -n user.pax.flags -v "m" /opt/google/chrome/chrome
#
# (permanent change, by converting the binary headers PT_GNU_STACK into PT_PAX_FLAGS)
# m: Disable MPROTECT // grsec: denied RWX mmap of <anonymous mapping>
RUN paxctl -c -v -m /opt/google/chrome/chrome
2016-05-07 08:38:37 +00:00
ENV USER user
ENV GROUPS video,audio
ENV UID 1000
ENV HOME /home/$USER
2016-03-23 20:46:30 +00:00
2016-05-07 08:38:37 +00:00
RUN useradd -u $UID -m -d $HOME -s /usr/sbin/nologin -G $GROUPS $USER && \
su -s /bin/sh -l $USER -c 'mkdir -p $HOME/.pki/nssdb $HOME/.local'
2016-03-23 20:46:30 +00:00
USER $USER
2016-05-07 08:38:37 +00:00
WORKDIR $HOME
# Ephemeral volumes which will live as long as the container exists
2016-03-23 20:46:30 +00:00
VOLUME [ "$HOME/.pki/nssdb", \
"$HOME/.local", \
2016-05-07 08:38:37 +00:00
"/tmp", \
"/data" ]
# If you wish to have persistent volumes, then specify them in the docker-compose.yml
# file at the `volumes:` section or with `-v` when using the `docker run` command
ENTRYPOINT [ "/usr/bin/google-chrome", "--user-data-dir=/data" ]
# "--no-sandbox"