Chrome image sandboxing issue about dockerfiles HOT 7 CLOSED

I don't know if this one works on boot2docker :/

On Saturday, February 21, 2015, Kevin Suttle [email protected]
wrote:

Link https://code.google.com/p/chromium/wiki/LinuxSUIDSandboxDevelopment
I put export CHROME_DEVEL_SANDBOX=/usr/local/sbin/chrome-devel-sandbox in
my ~/.zshenv, to no avail.

❯ VBoxManage -v
4.3.22r98236

~/Code
❯ docker run -it --net host --cpuset 0 --memory 512mb -v /tmp/.X11-unix:/tmp/.X11-unix -e DISPLAY=unix$DISPLAY -v $HOME/Downloads:/root/Downloads -v $HOME/.config/google-chrome/:/data -v /dev/snd:/dev/snd --privileged --name chrome jess/chrome
zsh: correct '$HOME/Downloads:/root/Downloads' to '$HOME/Downloads/root/Downloads' [nyae]? n
Unable to find image 'jess/chrome:latest' locally
Pulling repository jess/chrome
afd0b9ff8436: Download complete
511136ea3c5a: Download complete
8771fbfe935c: Download complete
0e30e84e9513: Download complete
51234c8e1d7b: Download complete
717610759d79: Download complete
b93129b92962: Download complete
4596e961e5ab: Download complete
91ef00dbf657: Download complete
Status: Downloaded newer image for jess/chrome:latest
[1:1:0222/051636:ERROR:browser_main_loop.cc(164)] Running without the SUID sandbox! See https://code.google.com/p/chromium/wiki/LinuxSUIDSandboxDevelopment for more information on developing with the sandbox on.
[1:1:0222/051636:ERROR:browser_main_loop.cc(210)] Gtk: cannot open display: unix/private/tmp/com.apple.launchd.sxSz0Md9aE/org.macosforge.xquartz:0

~/Code 2m 55s
❯ VBoxManage -v
4.3.22r98236

~/Code
❯ boot2docker -v info
Boot2Docker-cli version: v1.5.0
Git commit: ccd9032
2015/02/21 23:17:02 executing: VBoxManage showvminfo boot2docker-vm --machinereadable
{
"Name": "boot2docker-vm",
"UUID": "64e423d4-1d60-4ae5-9997-bd13f7cd3b41",
"Iso": "/Users/kevinsuttle/.boot2docker/boot2docker.iso",
"State": "running",
"CPUs": 8,
"Memory": 2048,
"VRAM": 8,
"CfgFile": "/Users/kevinsuttle/VirtualBox VMs/boot2docker-vm/boot2docker-vm.vbox",
"BaseFolder": "/Users/kevinsuttle/VirtualBox VMs/boot2docker-vm",
"OSType": "",
"Flag": 0,
"BootOrder": null,
"DockerPort": 0,
"SSHPort": 2022,
"SerialFile": "/Users/kevinsuttle/.boot2docker/boot2docker-vm.sock"
}
~/Code
❯ docker info
Containers: 1
Images: 9
Storage Driver: aufs
Root Dir: /mnt/sda1/var/lib/docker/aufs
Backing Filesystem: extfs
Dirs: 11
Execution Driver: native-0.2
Kernel Version: 3.18.5-tinycore64
Operating System: Boot2Docker 1.5.0 (TCL 5.4); master : a66bce5 - Tue Feb 10 23:31:27 UTC 2015
CPUs: 8
Total Memory: 1.961 GiB
Name: boot2docker
ID: G3HM:KNYD:UUZS:CDQI:WOSQ:4GH5:IL66:YPOG:RCHY:IREC:LUZU:GHLZ
Debug mode (server): true
Debug mode (client): false
Fds: 10
Goroutines: 16
EventsListeners: 0
Init Path: /usr/local/bin/docker
Docker Root Dir: /mnt/sda1/var/lib/docker

OS X 10.10.2

—
Reply to this email directly or view it on GitHub
#2.

Jessie Frazelle
4096R / D4C4 DD60 0D66 F65A 8EFC 511E 18F3 685C 0022 BFF3
pgp.mit.edu http://pgp.mit.edu/pks/lookup?op=get&search=0x18F3685C0022BFF3

from dockerfiles.

Gah. Yeah. I'm noticing a few. I think the X11 GUI ones aren't compatible yet. Lynx works great.

Here was my attempt at tor-browser:

❯ docker run -it -v /tmp/.X11-unix:/tmp/.X11-unix -e DISPLAY=unix$DISPLAY -v /dev/snd:/dev/snd --privileged --name tor-browser \
>     jess/tor-browser
Unable to find image 'jess/tor-browser:latest' locally
Pulling repository jess/tor-browser
e8509ca91149: Download complete
511136ea3c5a: Download complete
8771fbfe935c: Download complete
0e30e84e9513: Download complete
32a5d771910b: Download complete
0b2fc3b64aa1: Download complete
924e94b0da22: Download complete
35fc4e0d3fce: Download complete
73dde486a1ef: Download complete
f8d98d7b4fbb: Download complete
7fb00246cdbb: Download complete
abf773e1a3f4: Download complete
bb070d6fee03: Download complete
29ec926be854: Download complete
Status: Downloaded newer image for jess/tor-browser:latest
/usr/local/bin/start-tor-browser: line 211: file: command not found
/usr/local/bin/start-tor-browser: line 213: [: 64: unary operator expected
Launching Tor Browser for Linux in /usr/local/bin/Browser...

(process:21): GLib-CRITICAL **: g_slice_set_config: assertion 'sys_page_size == 0' failed
Error: cannot open display: unix/private/tmp/com.apple.launchd.sxSz0Md9aE/org.macosforge.xquartz:0
Tor Browser exited abnormally.  Exit code: 1

~/Code  58s
❯ docker run -it -v /tmp/.X11-unix:/tmp/.X11-unix -e DISPLAY=unix$DISPLAY -v /dev/snd:/dev/snd --privileged --name tor-browser jess/tor-browser
FATA[0000] Error response from daemon: Conflict. The name "tor-browser" is already in use by container 2c01603b0df5. You have to delete (or rename) that container to be able to reuse that name.

~/Code
❯ boot2docker delete tor-browser

~/Code
❯ docker run -it -v /tmp/.X11-unix:/tmp/.X11-unix -e DISPLAY=unix$DISPLAY -v /dev/snd:/dev/snd --privileged --name tor-browser jess/tor-browser
FATA[0032] An error occurred trying to connect: Post https://192.168.59.103:2376/v1.17/containers/create?name=tor-browser: dial tcp 192.168.59.103:2376: i/o timeout

from dockerfiles.

Some X11 ones work one of my images was used in
moby/moby#8710 (comment) that I
linked to in my post

On Saturday, February 21, 2015, Kevin Suttle [email protected]
wrote:

Gah. Yeah. I'm noticing a few. I think the X11 GUI ones aren't compatible
yet. Lynx works great.

Here was my attempt at tor-browser:

❯ docker run -it -v /tmp/.X11-unix:/tmp/.X11-unix -e DISPLAY=unix$DISPLAY -v /dev/snd:/dev/snd --privileged --name tor-browser \

jess/tor-browser

Unable to find image 'jess/tor-browser:latest' locally
Pulling repository jess/tor-browser
e8509ca91149: Download complete
511136ea3c5a: Download complete
8771fbfe935c: Download complete
0e30e84e9513: Download complete
32a5d771910b: Download complete
0b2fc3b64aa1: Download complete
924e94b0da22: Download complete
35fc4e0d3fce: Download complete
73dde486a1ef: Download complete
f8d98d7b4fbb: Download complete
7fb00246cdbb: Download complete
abf773e1a3f4: Download complete
bb070d6fee03: Download complete
29ec926be854: Download complete
Status: Downloaded newer image for jess/tor-browser:latest
/usr/local/bin/start-tor-browser: line 211: file: command not found
/usr/local/bin/start-tor-browser: line 213: [: 64: unary operator expected
Launching Tor Browser for Linux in /usr/local/bin/Browser...

(process:21): GLib-CRITICAL **: g_slice_set_config: assertion 'sys_page_size == 0' failed
Error: cannot open display: unix/private/tmp/com.apple.launchd.sxSz0Md9aE/org.macosforge.xquartz:0
Tor Browser exited abnormally. Exit code: 1

~/Code 58s
❯ docker run -it -v /tmp/.X11-unix:/tmp/.X11-unix -e DISPLAY=unix$DISPLAY -v /dev/snd:/dev/snd --privileged --name tor-browser jess/tor-browser
FATA[0000] Error response from daemon: Conflict. The name "tor-browser" is already in use by container 2c01603b0df5. You have to delete (or rename) that container to be able to reuse that name.

~/Code
❯ boot2docker delete tor-browser

~/Code
❯ docker run -it -v /tmp/.X11-unix:/tmp/.X11-unix -e DISPLAY=unix$DISPLAY -v /dev/snd:/dev/snd --privileged --name tor-browser jess/tor-browser
FATA[0032] An error occurred trying to connect: Post https://192.168.59.103:2376/v1.17/containers/create?name=tor-browser: dial tcp 192.168.59.103:2376: i/o timeout

—
Reply to this email directly or view it on GitHub
#2 (comment).

Jessie Frazelle
4096R / D4C4 DD60 0D66 F65A 8EFC 511E 18F3 685C 0022 BFF3
pgp.mit.edu http://pgp.mit.edu/pks/lookup?op=get&search=0x18F3685C0022BFF3

from dockerfiles.

It doesn't look like you are following the socat instructions and running
the bind mount directly on a Mac which won't work ;)

On Saturday, February 21, 2015, Jessica Frazelle [email protected] wrote:

Some X11 ones work one of my images was used in
moby/moby#8710 (comment) that I
linked to in my post

On Saturday, February 21, 2015, Kevin Suttle <[email protected]
javascript:_e(%7B%7D,'cvml','[email protected]');> wrote:

Gah. Yeah. I'm noticing a few. I think the X11 GUI ones aren't compatible
yet. Lynx works great.

Here was my attempt at tor-browser:

❯ docker run -it -v /tmp/.X11-unix:/tmp/.X11-unix -e DISPLAY=unix$DISPLAY -v /dev/snd:/dev/snd --privileged --name tor-browser \

jess/tor-browser

Unable to find image 'jess/tor-browser:latest' locally
Pulling repository jess/tor-browser
e8509ca91149: Download complete
511136ea3c5a: Download complete
8771fbfe935c: Download complete
0e30e84e9513: Download complete
32a5d771910b: Download complete
0b2fc3b64aa1: Download complete
924e94b0da22: Download complete
35fc4e0d3fce: Download complete
73dde486a1ef: Download complete
f8d98d7b4fbb: Download complete
7fb00246cdbb: Download complete
abf773e1a3f4: Download complete
bb070d6fee03: Download complete
29ec926be854: Download complete
Status: Downloaded newer image for jess/tor-browser:latest
/usr/local/bin/start-tor-browser: line 211: file: command not found
/usr/local/bin/start-tor-browser: line 213: [: 64: unary operator expected
Launching Tor Browser for Linux in /usr/local/bin/Browser...

(process:21): GLib-CRITICAL **: g_slice_set_config: assertion 'sys_page_size == 0' failed
Error: cannot open display: unix/private/tmp/com.apple.launchd.sxSz0Md9aE/org.macosforge.xquartz:0
Tor Browser exited abnormally. Exit code: 1

~/Code 58s
❯ docker run -it -v /tmp/.X11-unix:/tmp/.X11-unix -e DISPLAY=unix$DISPLAY -v /dev/snd:/dev/snd --privileged --name tor-browser jess/tor-browser
FATA[0000] Error response from daemon: Conflict. The name "tor-browser" is already in use by container 2c01603b0df5. You have to delete (or rename) that container to be able to reuse that name.

~/Code
❯ boot2docker delete tor-browser

~/Code
❯ docker run -it -v /tmp/.X11-unix:/tmp/.X11-unix -e DISPLAY=unix$DISPLAY -v /dev/snd:/dev/snd --privileged --name tor-browser jess/tor-browser
FATA[0032] An error occurred trying to connect: Post https://192.168.59.103:2376/v1.17/containers/create?name=tor-browser: dial tcp 192.168.59.103:2376: i/o timeout

—
Reply to this email directly or view it on GitHub
#2 (comment)
.

Jessie Frazelle
4096R / D4C4 DD60 0D66 F65A 8EFC 511E 18F3 685C 0022 BFF3
pgp.mit.edu
http://pgp.mit.edu/pks/lookup?op=get&search=0x18F3685C0022BFF3

Jessie Frazelle
4096R / D4C4 DD60 0D66 F65A 8EFC 511E 18F3 685C 0022 BFF3
pgp.mit.edu http://pgp.mit.edu/pks/lookup?op=get&search=0x18F3685C0022BFF3

from dockerfiles.

Indeed. I'm not. Total noob. :) Thanks @jfrazelle. Amazing stuff.

from dockerfiles.

No worries the socat hack is extra cool ;)

On Saturday, February 21, 2015, Kevin Suttle [email protected]
wrote:

Indeed. I'm not. Total noob. :) Thanks @jfrazelle
https://github.com/jfrazelle. Amazing stuff.

—
Reply to this email directly or view it on GitHub
#2 (comment).

Jessie Frazelle
4096R / D4C4 DD60 0D66 F65A 8EFC 511E 18F3 685C 0022 BFF3
pgp.mit.edu http://pgp.mit.edu/pks/lookup?op=get&search=0x18F3685C0022BFF3

from dockerfiles.

Whoa. That worked. Way to go @slobo!

from dockerfiles.