chrome/Dockerfile

# Run Chrome in a container
FROM ubuntu:xenial
MAINTAINER Andrey Arapov <andrey.arapov@nixaid.com>

# To avoid problems with Dialog and curses wizards
ENV DEBIAN_FRONTEND noninteractive

# Install GTK, pulseaudio and fonts
RUN apt-get update && \
    apt-get install -y libcanberra-gtk-module libexif12 pulseaudio paxctl \
                       fonts-opensymbol ttf-ubuntu-font-family \
                       fonts-tlwg-waree-ttf fonts-tlwg-umpush-ttf \
                       fonts-tlwg-typo-ttf fonts-tlwg-typist-ttf \
                       fonts-tlwg-typewriter-ttf fonts-tlwg-sawasdee-ttf \
                       fonts-tlwg-purisa-ttf fonts-tlwg-norasi-ttf \
                       fonts-tlwg-mono-ttf fonts-tlwg-loma-ttf \
                       fonts-tlwg-laksaman-ttf fonts-tlwg-kinnari-ttf \
                       fonts-tlwg-garuda-ttf fonts-tibetan-machine \
                       fonts-takao-pgothic fonts-symbola fonts-sil-padauk \
                       fonts-sil-abyssinica fonts-nanum fonts-lohit-guru \
                       fonts-lklug-sinhala fonts-liberation fonts-lao \
                       fonts-khmeros-core fonts-kacst fonts-kacst-one \
                       fonts-guru-extra fonts-freefont-ttf fonts-dejavu-core && \
    rm -rf -- /var/lib/apt/lists /tmp/*.deb

# Obtain Google Chrome
ADD https://dl.google.com/linux/direct/google-talkplugin_current_amd64.deb /tmp/google-talkplugin_current_amd64.deb
ADD https://dl.google.com/linux/direct/google-chrome-stable_current_amd64.deb /tmp/google-chrome-stable_current_amd64.deb

# Install Google Chrome and its dependencies
RUN sh -c 'dpkg -i /tmp/google-chrome-stable_current_amd64.deb \
           /tmp/google-talkplugin_current_amd64.deb 2>/dev/null; exit 0' && \
    apt-get update && \
    apt-get -fy install && \
    rm -rf -- /var/lib/apt/lists /tmp/*.deb


# Workaround: pulseaudio client library likes to remove /dev/shm/pulse-shm-*
#             files created by the host, causing sound to stop working.
#             To fix this, we either want to disable the shm or mount /dev/shm
#             in read-only mode when starting the container.
RUN echo "enable-shm = no" >> /etc/pulse/client.conf


# Make Google Chrome grsec friendly
# more info: https://en.wikibooks.org/wiki/Grsecurity/Application-specific_Settings#Google_Chrome_15.0.874.106
#
# To build the Docker image, I currently had to disable the following grsec protections:
# # grep -E "chroot_deny_chmod|chroot_deny_mknod|chroot_caps" /etc/sysctl.d/grsec.conf
# kernel.grsecurity.chroot_deny_chmod = 0
# kernel.grsecurity.chroot_deny_mknod = 0
# kernel.grsecurity.chroot_caps = 0 (relates to a systemd package)
#
# (runtime only, since xattrs are not preserved in Docker's final image)
# m: Disable MPROTECT // grsec: denied RWX mmap of <anonymous mapping>
# RUN setfattr -n user.pax.flags -v "m" /opt/google/chrome/chrome
#
# (permanent change, by converting the binary headers PT_GNU_STACK into PT_PAX_FLAGS)
# m: Disable MPROTECT // grsec: denied RWX mmap of <anonymous mapping>
RUN paxctl -c -v -m /opt/google/chrome/chrome


ENV USER user
ENV GROUPS video,audio
ENV UID 1000
ENV HOME /home/$USER

RUN useradd -u $UID -m -d $HOME -s /usr/sbin/nologin -G $GROUPS $USER && \
    su -s /bin/sh -l $USER -c 'mkdir -p $HOME/.pki/nssdb $HOME/.local'

USER $USER
WORKDIR $HOME

# Ephemeral volumes which will live as long as the container exists
VOLUME [ "$HOME/.pki/nssdb", \
         "$HOME/.local", \
         "/tmp", \
         "/data" ]
# If you wish to have persistent volumes, then specify them in the docker-compose.yml
# file at the `volumes:` section or with `-v` when using the `docker run` command

ENTRYPOINT [ "/usr/bin/google-chrome", "--user-data-dir=/data" ]
# "--no-sandbox"