Web Sessions in Docker 0.8.0 do not start with error message

[PureOxygen-Dev]

Hi Dave

Passed the Kiosk Mode warning but unfortunately a new one for you

{"error":"browser spawn failed: Chromium spawn failed: Chromium exited immediately (signal: 6 (SIGABRT) (core dumped)). stderr: Failed to move to new namespace: PID namespaces supported, Network namespace supported, but failed: errno = Operation not permitted\n[69:69:0313/023200.136570:FATAL:content/browser/zygote_host/zygote_host_impl_linux.cc:207] Check failed: . : Operation not permitted (1)\n[0313/023200.143353:ERROR:third_party/crashpad/crashpad/util/file/file_io_posix.cc:145] open /sys/devices/system/cpu/cpu0/cpufreq/scaling_cur_freq: No such file or directory (2)\n[0313/023200.144112:ERROR:third_party/crashpad/crashpad/util/file/file_io_posix.cc:145] open /sys/devices/system/cpu/cpu0/cpufreq/scaling_max_freq: No such file or directory (2)\n"}

[davekempe]

The error is Chromium's namespace sandbox failing inside the Docker container — Docker's default seccomp profile blocks the clone() syscalls that Chromium uses to create PID/network namespaces for sandboxing.

v0.8.0 includes the chromium-sandbox SUID package in the Docker image, which provides the sandbox helper binary. However, Docker needs to allow the namespace operations for it to work.

Could you try running the container with one of these options?

Option A (recommended — allows namespace creation):

docker run --cap-add SYS_ADMIN ...

Option B (more permissive — disables seccomp entirely):

docker run --security-opt seccomp=unconfined ...

Either should let Chromium's sandbox work without needing --no-sandbox. Let us know if one of those resolves it — if so we'll add it to the Docker documentation.

[davekempe]

Hey @PureOxygen-Dev — just checking in on this one. Have you had a chance to try either of the Docker flags mentioned above?

docker run --cap-add SYS_ADMIN ...
# or
docker run --security-opt seccomp=unconfined ...

v0.8.1 is out now with security fixes and dependency updates if you'd like to test with the latest image. Let us know how you go — happy to help troubleshoot if needed!

[PureOxygen-Dev]

Hi Dave,

Sorry for the delay in this. We have as a R&D team for now parked further investigation in rustguac.

This is no reflection on the product but our own priorities on where we need to invest resources. We will continue to monitor the great work you're doing and personally I will be firing up rustguac in my home lab when I get some spare time.

Regards

Simon