1

I am trying to set up a Docker image (my Dockerfile is available here, sorry for the french README: https://framagit.org/Gwendal/firefox-icedtea-docker) with an old version of Firefox and an old version of Java to run an old Java applet to start a VPN. My image does work and successfully allows me to start the Java applet in Firefox.

Unfortunately, the said applet then tries to run the following command in the container (I've simply removed the --config part from the command as it does not matter here):

INFO: launching '/usr/bin/pkexec sh -c /usr/sbin/openvpn --config ...'

Then the applet exits silently with an error. While investigating, I've tried running a command with pkexec with the same Docker image, and it gives me this result:

$ sudo docker-compose run firefox pkexec /firefox/firefox-sdk/bin/firefox-bin -new-instance
**
ERROR:pkexec.c:719:main: assertion failed: (polkit_unix_process_get_start_time (POLKIT_UNIX_PROCESS (subject)) > 0)

But I don't know polkit at all and cannot understand this error.

EDIT: A more minimal way to reproduce the problem is with this Dockerfile:

FROM ubuntu:16.04

RUN apt-get update \
    && apt-get install -y policykit-1

And then run:

$ sudo docker build -t pkexec-test .
$ sudo docker run pkexec-test pkexec echo Hello

Which leads here again to:

ERROR:pkexec.c:719:main: assertion failed: (polkit_unix_process_get_start_time (POLKIT_UNIX_PROCESS (subject)) > 0)

Should I conclude that pkexec cannot work in a docker container? Or is there any way to make this command work?

Sidenote: I have no control whatsoever on the Java applet that I try to run, it is a horrible and very dated proprietary black box that I am supposed to use at work, for which I have no access to the source code, and that I must use as is.

Gwendal
  • 490
  • 3
  • 13

1 Answers1

2

I have solved my own problem by replacing pkexec by sudo in the docker image, and by allowing passwordless sudo.

Given an ubuntu docker image where a user called developer was created and configured with a USER statement, add these lines:

# Install sudo and make 'developer' a passwordless sudoer
RUN apt-get install sudo
ADD ./developersudo /etc/sudoers.d/developersudo

# Replacing pkexec by sudo
RUN rm /usr/bin/pkexec
RUN ln -s /usr/bin/sudo /usr/bin/pkexec

with the file developersudo containing:

developer ALL=(ALL) NOPASSWD:ALL

This replaces any call to pkexec made in a process running in the container, by a call to sudo without any password prompt, which works nicely.

Gwendal
  • 490
  • 3
  • 13