Docker/Selenium/Headless Chrome: Configure SUID sandbox correctly

Question

I want to run selenium and headless chrome in my docker container for testing purpose.

I have tried to run selenium in headless chrome (outside my docker container) with the following in my .js file. This worked:

const client = webdriverio.remote({
   desiredCapabilities: {
   browserName: 'chrome',
   chromeOptions: {
     args: ['--headless', '--disable-gpu']
   },
   binary: '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'
   },
 baseUrl: CONFIG.host,
 logLevel: 'verbose',
 waitForTimeout: 3000
 })

But I can't get this to work in my docker container. In my docker container I use "FROM selenium/standalone-chrome". There does not seem to be any problem with my dockerfile. The problem occurs when I try to run my selenium tests. I changed the binary_path in my .js file to /opt/google/chrome/google-chrome. But the tests fails and client can not even be initiated.

So I tried to just run /opt/google/chrome/google-chrome in order to see if chrome works, but then I get this error:

[0711/005304.226472:ERROR:nacl_helper_linux.cc(311)] NaCl helper 
process running without a sandbox!
Most likely you need to configure your SUID sandbox correctly

I am pretty new to this (and stack overflow) so there might be some basic things I have missed.

score 2 · Answer 1 · answered Jul 11 '17 at 11:53

2

Try to include --no-sandbox

chromeOptions: {
  args: ['--headless', '--disable-gpu', '--no-sandbox']
},

As I'm doing at docker-selenium

answered Jul 11 '17 at 11:53

Leo Gallucci

16,355
12
77
110

1

i'm getting the same error on a VPS SSH that is running CentOS 7 64-bit when i try to launch Chrome with the `--no-sandbox` parameter (while troubleshooting why my scripts for scraping aren't working online) :/ Not sure what to do. – oldboy Jun 23 '18 at 02:15
@Anthony did you find a solution? I'm exactly in the same place – JCarlosR Mar 31 '19 at 18:34
@JCarlos i believe i did find a solution, but i cant remember what it was now. sorry :( – oldboy Apr 01 '19 at 02:43
weird, now getting "Failed to connect to the bus: Failed to connect to socket /var/run/dbus/system_bus_socket: No such file or directory" – Robert Sinclair Apr 20 '21 at 05:35

score 0 · Answer 2 · answered Mar 05 '20 at 14:57

This error message...

[1003/144118.702053:ERROR:nacl_helper_linux.cc(310)] NaCl helper process running without a sandbox!
Most likely you need to configure your SUID sandbox correctly

...implies that you have no setuid sandbox in your system, hence the program was unable to initiate/spawn a new Browsing Context i.e. Chrome Browser session.

Solution

The easiest (not so clean) solution is, if you want to run Chrome and only use the namespace sandbox, you can set the flag:

--disable-setuid-sandbox

This flag will disable the setuid sandbox (Linux only). But if you do so on a host without appropriate kernel support for the namespace sandbox, Chrome will not spin up. As an alternative you can also use the flag:

--no-sandbox

This flag will disable the sandbox for all process types that are normally sandboxed.

Example:

chromeOptions: {
      args: ['--disable-setuid-sandbox', '--no-sandbox']
},

You can find a detailed discussion in Security Considerations - ChromeDriver - Webdriver for Chrome

Deep dive

As per the documentation in Linux SUID Sandbox Development google-chrome needs a SUID helper binary to turn on the sandbox on Linux. In majority of the cases you can install the proper sandbox for you using the command:

build/update-linux-sandbox.sh

This program will install the proper sandbox for you in /usr/local/sbin and tell you to update your .bashrc if required.

However, there can be some exceptions as an example, if your setuid binary is out of date, you will get messages such as:

NaCl helper process running without a sandbox!
Most likely you need to configure your SUID sandbox correctly

Or

Running without the SUID sandbox!

In these cases, you need to:

Build chrome_sandbox whenever you build chrome (ninja -C xxx chrome chrome_sandbox instead of ninja -C xxx chrome)

After building, execute update-linux-sandbox.sh.

# needed if you build on NFS!
sudo cp out/Debug/chrome_sandbox /usr/local/sbin/chrome-devel-sandbox
sudo chown root:root /usr/local/sbin/chrome-devel-sandbox
sudo chmod 4755 /usr/local/sbin/chrome-devel-sandbox

Finally, you have to include the following line in your ~/.bashrc (or .zshenv):

export CHROME_DEVEL_SANDBOX=/usr/local/sbin/chrome-devel-sandbox

Docker/Selenium/Headless Chrome: Configure SUID sandbox correctly

2 Answers2

Solution

Deep dive