chrome/docker-compose.yml

version: '3.7'

services:
  chrome:
    init: true
    build: .
    network_mode: bridge
    devices:
      - /dev/dri
      # - /dev/video0
    volumes:
      - /tmp/.X11-unix:/tmp/.X11-unix:ro
      - $XDG_RUNTIME_DIR/pulse:/run/user/1000/pulse
      - ./data:/home/user
      - $HOME/Downloads:/home/user/Downloads
      - /var/run/cups:/var/run/cups:ro
      - /tmp/krb5cc_1000:/tmp/krb5cc_1000:ro
      - /etc/localtime:/etc/localtime:ro
      - /etc/machine-id:/etc/machine-id:ro
    environment:
      - DISPLAY=unix$DISPLAY
      - PULSE_SERVER=unix:$XDG_RUNTIME_DIR/pulse/native
    # SYS_ADMIN is NOT required if you run chrome with `--no-sandbox` flag
    # more on CAP_SYS_ADMIN https://lwn.net/Articles/486306/
    cap_add:
      - SYS_ADMIN
      - IPC_LOCK # lock memory to prevent sensitive values from being swapped to disk.
    shm_size: 4G
    # mem_limit: 4G
    # security_opt:
      # - apparmor:docker-ptrace
      # - apparmor:unconfined
updates 2018-12-25 18:06:31 +00:00			`version: '3.7'`
v2 2016-05-07 08:38:37 +00:00
first commit 2016-03-23 20:46:30 +00:00			`services:`
			`chrome:`
updates 2018-12-25 18:06:31 +00:00			`init: true`
updates 2017-06-22 22:52:52 +00:00			`build: .`
v2 2016-05-07 08:38:37 +00:00			`network_mode: bridge`
first commit 2016-03-23 20:46:30 +00:00			`devices:`
			`- /dev/dri`
v2 2016-05-07 08:38:37 +00:00			`# - /dev/video0`
first commit 2016-03-23 20:46:30 +00:00			`volumes:`
v2 2016-05-07 08:38:37 +00:00			`- /tmp/.X11-unix:/tmp/.X11-unix:ro`
			`- $XDG_RUNTIME_DIR/pulse:/run/user/1000/pulse`
updates 2018-12-25 18:06:31 +00:00			`- ./data:/home/user`
v2 2016-05-07 08:38:37 +00:00			`- $HOME/Downloads:/home/user/Downloads`
first commit 2016-03-23 20:46:30 +00:00			`- /var/run/cups:/var/run/cups:ro`
make chrome grsec friendly 2016-05-19 15:49:31 +00:00			`- /tmp/krb5cc_1000:/tmp/krb5cc_1000:ro`
updates 2018-12-25 18:06:31 +00:00			`- /etc/localtime:/etc/localtime:ro`
			`- /etc/machine-id:/etc/machine-id:ro`
first commit 2016-03-23 20:46:30 +00:00			`environment:`
v2 2016-05-07 08:38:37 +00:00			`- DISPLAY=unix$DISPLAY`
			`- PULSE_SERVER=unix:$XDG_RUNTIME_DIR/pulse/native`
make chrome grsec friendly 2016-05-19 15:49:31 +00:00			# SYS_ADMIN is NOT required if you run chrome with `--no-sandbox` flag
			`# more on CAP_SYS_ADMIN https://lwn.net/Articles/486306/`
			`cap_add:`
			`- SYS_ADMIN`
updates 2017-06-22 22:52:52 +00:00			`- IPC_LOCK # lock memory to prevent sensitive values from being swapped to disk.`
set shm_size back to avoid a chrome crash (bus error) Example crash log: (google-chrome:13): LIBDBUSMENU-GLIB-WARNING **: Unable to get session bus: Failed to execute child process ?dbus-launch? (No such file or directory) Bus error (core dumped) 2017-06-23 10:51:55 +00:00			`shm_size: 4G`
updates 2017-06-22 22:52:52 +00:00			`# mem_limit: 4G`
v2 2016-05-07 08:38:37 +00:00			`# security_opt:`
			`# - apparmor:docker-ptrace`
			`# - apparmor:unconfined`