google-chrome Failed to move to new namespace

linux docker google-chrome kubernetes-helm google-chrome-headless
novak100 picture novak100 · Nov 28, 2019 · Viewed 7.2k times · Source

Im trying to run google-chrome --headless inside a docker container as a non-root user to execute some tests. Everytime Im trying to start it, it throws following error:

google-chrome --headless

Failed to move to new namespace: PID namespaces supported, Network namespace supported, but failed: errno = Operation not permitted Failed to generate minidump.Illegal instruction

Its a docker container running in k8s cluster. Operating system is Ubuntu 16.04.

Namespaces are enabled, user is non-root

I do not want to use --no-sandbox option as this is a security issue.

I cannot use docker run --security-opt=syscomp:unconfined as its being deployed using helm.

Is there a system permission missing that I need to setup for chrome within the container itself?

Answer

novak100 picture novak100 · Dec 3, 2019

After researching extensively internet I think I found the answer:

Sandboxing  For security reasons, Google Chrome is unable to provide sandboxing when it is running in the container-based environment. To use Chrome in the container-based environment, pass the --no-sandbox flag to the chrome executable

So it looks like there is no better solution than --no-sandbox for me, even though its not being very secure, there are people on the internet claiming that it is still safe to use "--no-sandbox" as its running within container which is extra protected any way.

Related questions

Docker can't connect to docker daemon

After I update my Docker version to 0.8.0, I get an error message while entering sudo docker version: Client version: 0.8.0 Go version (client): go1.2 Git commit (client): cc3a8c8 2014/02/19 12:54:16 Can't connect to docker daemon. Is 'docker -d' running on this …

Read More
Exploring Docker container's file system

I've noticed with docker that I need to understand what's happening inside a container or what files exist in there. One example is downloading images from the docker index - you don't have a clue what the image contains so …

Read More
Cannot connect to the Docker daemon at unix:/var/run/docker.sock. Is the docker daemon running?

I have applied every solution available on internet but still I cannot run Docker. I want to use Scrapy Splash on my server. Here is history of commands I ran. docker run -p 8050:8050 scrapinghub/splash sudo docker run -p 8050:8050 scrapinghub/…

Read More