|
|
|
|
@ -7,7 +7,7 @@ ENV DEBIAN_FRONTEND noninteractive
|
|
|
|
|
|
|
|
|
|
# Install GTK, pulseaudio and fonts
|
|
|
|
|
RUN apt-get update && \
|
|
|
|
|
apt-get install -y libcanberra-gtk-module libexif12 pulseaudio paxctl \
|
|
|
|
|
apt-get install -y libcanberra-gtk-module libexif12 pulseaudio attr \
|
|
|
|
|
fonts-dejavu-core fonts-freefont-ttf fonts-guru-extra \
|
|
|
|
|
fonts-kacst fonts-kacst-one fonts-khmeros-core fonts-lao \
|
|
|
|
|
fonts-liberation fonts-lklug-sinhala fonts-lohit-guru \
|
|
|
|
|
@ -44,25 +44,6 @@ RUN sh -c 'dpkg -i /tmp/google-chrome-stable_current_amd64.deb \
|
|
|
|
|
# in read-only mode when starting the container.
|
|
|
|
|
RUN echo "enable-shm = no" >> /etc/pulse/client.conf
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
# Make Google Chrome grsec friendly
|
|
|
|
|
# more info: https://en.wikibooks.org/wiki/Grsecurity/Application-specific_Settings#Google_Chrome_15.0.874.106
|
|
|
|
|
#
|
|
|
|
|
# To build the Docker image, I currently had to disable the following grsec protections:
|
|
|
|
|
# # grep -E "chroot_deny_chmod|chroot_deny_mknod|chroot_caps" /etc/sysctl.d/grsec.conf
|
|
|
|
|
# kernel.grsecurity.chroot_deny_chmod = 0
|
|
|
|
|
# kernel.grsecurity.chroot_deny_mknod = 0
|
|
|
|
|
# kernel.grsecurity.chroot_caps = 0 (relates to a systemd package)
|
|
|
|
|
#
|
|
|
|
|
# (runtime only, since xattrs are not preserved in Docker's final image)
|
|
|
|
|
# m: Disable MPROTECT // grsec: denied RWX mmap of <anonymous mapping>
|
|
|
|
|
# RUN setfattr -n user.pax.flags -v "m" /opt/google/chrome/chrome
|
|
|
|
|
#
|
|
|
|
|
# (permanent change, by converting the binary headers PT_GNU_STACK into PT_PAX_FLAGS)
|
|
|
|
|
# m: Disable MPROTECT // grsec: denied RWX mmap of <anonymous mapping>
|
|
|
|
|
RUN paxctl -c -v -m /opt/google/chrome/chrome
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
ENV USER user
|
|
|
|
|
ENV GROUPS video,audio
|
|
|
|
|
ENV UID 1000
|
|
|
|
|
@ -71,16 +52,7 @@ ENV HOME /home/$USER
|
|
|
|
|
RUN useradd -u $UID -m -d $HOME -s /usr/sbin/nologin -G $GROUPS $USER && \
|
|
|
|
|
su -s /bin/sh -l $USER -c 'mkdir -p $HOME/.pki/nssdb $HOME/.local'
|
|
|
|
|
|
|
|
|
|
USER $USER
|
|
|
|
|
WORKDIR $HOME
|
|
|
|
|
|
|
|
|
|
# Ephemeral volumes which will live as long as the container exists
|
|
|
|
|
VOLUME [ "$HOME/.pki/nssdb", \
|
|
|
|
|
"$HOME/.local", \
|
|
|
|
|
"/tmp", \
|
|
|
|
|
"/data" ]
|
|
|
|
|
# If you wish to have persistent volumes, then specify them in the docker-compose.yml
|
|
|
|
|
# file at the `volumes:` section or with `-v` when using the `docker run` command
|
|
|
|
|
|
|
|
|
|
ENTRYPOINT [ "/usr/bin/google-chrome", "--user-data-dir=/data" ]
|
|
|
|
|
# "--no-sandbox"
|
|
|
|
|
COPY launch /launch
|
|
|
|
|
ENTRYPOINT [ "sh", "/launch" ]
|
|
|
|
|
|
