From 12ba047dbd2ff0764404131cef36c185f6e73546 Mon Sep 17 00:00:00 2001 From: Rafael Garcia Date: Mon, 14 Jul 2025 14:49:14 -0700 Subject: [PATCH 01/25] set up / run as unpriviliged 'kernel' user; fix dbus --- images/chromium-headful/Dockerfile | 3 ++ images/chromium-headful/wrapper.sh | 44 ++++++++++++++++++++++++++++-- 2 files changed, 45 insertions(+), 2 deletions(-) diff --git a/images/chromium-headful/Dockerfile b/images/chromium-headful/Dockerfile index 2417149d..4500a78f 100644 --- a/images/chromium-headful/Dockerfile +++ b/images/chromium-headful/Dockerfile @@ -156,5 +156,8 @@ COPY ./wrapper.sh /wrapper.sh COPY bin/kernel-images-api /usr/local/bin/kernel-images-api ENV WITH_KERNEL_IMAGES_API=false +RUN useradd -m -s /bin/bash kernel +RUN cp -r ./user-data /home/kernel/user-data + ENTRYPOINT [ "/wrapper.sh" ] diff --git a/images/chromium-headful/wrapper.sh b/images/chromium-headful/wrapper.sh index d8964c82..ea31e886 100755 --- a/images/chromium-headful/wrapper.sh +++ b/images/chromium-headful/wrapper.sh @@ -22,6 +22,46 @@ if [[ "${ENABLE_WEBRTC:-}" != "true" ]]; then ./x11vnc_startup.sh fi +# ----------------------------------------------------------------------------- +# House-keeping for the unprivileged "kernel" user -------------------------------- +# Some Chromium subsystems want to create files under $HOME (NSS cert DB, dconf +# cache). If those directories are missing or owned by root Chromium emits +# noisy error messages such as: +# [ERROR:crypto/nss_util.cc:48] Failed to create /home/kernel/.pki/nssdb ... +# dconf-CRITICAL **: unable to create directory '/home/kernel/.cache/dconf' +# Pre-create them and hand ownership to the user so the messages disappear. + +for dir in /home/kernel/.pki/nssdb /home/kernel/.cache/dconf; do + if [ ! -d "$dir" ]; then + mkdir -p "$dir" + fi +done +# Ensure correct ownership (ignore errors if already correct) +chown -R kernel:kernel /home/kernel/.pki /home/kernel/.cache /home/kernel/user-data 2>/dev/null || true + +# ----------------------------------------------------------------------------- +# System-bus setup -------------------------------------------------------------- +# ----------------------------------------------------------------------------- +# Start a lightweight system D-Bus daemon if one is not already running. We +# will later use this very same bus as the *session* bus as well, avoiding the +# autolaunch fallback that produced many "Connection refused" errors. +# Start a lightweight system D-Bus daemon if one is not already running (Chromium complains otherwise) +if [ ! -S /run/dbus/system_bus_socket ]; then + echo "Starting system D-Bus daemon" + mkdir -p /run/dbus + # Ensure a machine-id exists (required by dbus-daemon) + dbus-uuidgen --ensure + # Launch dbus-daemon in the background and remember its PID for cleanup + dbus-daemon --system \ + --address=unix:path=/run/dbus/system_bus_socket \ + --nopidfile --nosyslog --nofork >/dev/null 2>&1 & + dbus_pid=$! +fi + +# We will point DBUS_SESSION_BUS_ADDRESS at the system bus socket to suppress +# autolaunch attempts that failed and spammed logs. +export DBUS_SESSION_BUS_ADDRESS="unix:path=/run/dbus/system_bus_socket" + # Start Chromium with display :1 and remote debugging, loading our recorder extension. # Use ncat to listen on 0.0.0.0:9222 since chromium does not let you listen on 0.0.0.0 anymore: https://github.com/pyppeteer/pyppeteer/pull/379#issuecomment-217029626 cleanup () { @@ -40,9 +80,9 @@ pid3= INTERNAL_PORT=9223 CHROME_PORT=9222 # External port mapped to host echo "Starting Chromium on internal port $INTERNAL_PORT" -chromium \ +runuser -u kernel -- env DISPLAY=:1 DBUS_SESSION_BUS_ADDRESS="$DBUS_SESSION_BUS_ADDRESS" chromium \ --remote-debugging-port=$INTERNAL_PORT \ - ${CHROMIUM_FLAGS:-} >&2 & + ${CHROMIUM_FLAGS:-} >&2 & pid=$! echo "Setting up ncat proxy on port $CHROME_PORT" ncat \ --sh-exec "ncat 0.0.0.0 $INTERNAL_PORT" \ From 601ce91e9fb7c8d358cc0791ab509b03e83407cb Mon Sep 17 00:00:00 2001 From: Rafael Garcia Date: Mon, 14 Jul 2025 14:49:41 -0700 Subject: [PATCH 02/25] get rid of no-sandbox warning, run on 8080 in the foreground --- images/chromium-headful/run-docker.sh | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/images/chromium-headful/run-docker.sh b/images/chromium-headful/run-docker.sh index b9962299..b86777f7 100755 --- a/images/chromium-headful/run-docker.sh +++ b/images/chromium-headful/run-docker.sh @@ -23,7 +23,7 @@ RUN_ARGS=( -e DISPLAY_NUM=1 \ -e HEIGHT=768 \ -e WIDTH=1024 \ - -e CHROMIUM_FLAGS="--no-sandbox --disable-dev-shm-usage --disable-gpu --start-maximized --disable-software-rasterizer --remote-allow-origins=* --no-zygote" + -e CHROMIUM_FLAGS="--user-data-dir=/home/kernel/user-data --disable-dev-shm-usage --disable-gpu --start-maximized --disable-software-rasterizer --remote-allow-origins=*" ) if [[ "${WITH_KERNEL_IMAGES_API:-}" == "true" ]]; then @@ -34,7 +34,7 @@ fi # noVNC vs WebRTC port mapping if [[ "${ENABLE_WEBRTC:-}" == "true" ]]; then echo "Running container with WebRTC" - RUN_ARGS+=( -p 443:8080 ) + RUN_ARGS+=( -p 8080:8080 ) RUN_ARGS+=( -e ENABLE_WEBRTC=true ) if [[ -n "${NEKO_ICESERVERS:-}" ]]; then RUN_ARGS+=( -e NEKO_ICESERVERS="$NEKO_ICESERVERS" ) @@ -49,4 +49,4 @@ else fi docker rm -f "$NAME" 2>/dev/null || true -docker run -d "${RUN_ARGS[@]}" "$IMAGE" +docker run -it "${RUN_ARGS[@]}" "$IMAGE" From 5dbd4a51846305f65b9f935915ce555cec50de4c Mon Sep 17 00:00:00 2001 From: Rafael Garcia Date: Mon, 14 Jul 2025 14:50:13 -0700 Subject: [PATCH 03/25] disable sound --- images/chromium-headful/client/src/store/chat.ts | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/images/chromium-headful/client/src/store/chat.ts b/images/chromium-headful/client/src/store/chat.ts index 1b52f7f9..2a1d5067 100644 --- a/images/chromium-headful/client/src/store/chat.ts +++ b/images/chromium-headful/client/src/store/chat.ts @@ -75,7 +75,8 @@ export const actions = actionTree( newMessage(store, message: Message) { if (accessor.settings.chat_sound) { - new Audio('chat.mp3').play().catch(console.error) + // KERNEL: disable sound + // new Audio('chat.mp3').play().catch(console.error) } accessor.chat.addMessage(message) }, From f4cb6bf01c143df7d001ad945abaeaafbdcc58e6 Mon Sep 17 00:00:00 2001 From: Rafael Garcia Date: Mon, 14 Jul 2025 14:50:33 -0700 Subject: [PATCH 04/25] disable "connected" notification --- images/chromium-headful/client/src/neko/index.ts | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/images/chromium-headful/client/src/neko/index.ts b/images/chromium-headful/client/src/neko/index.ts index d40fa568..91b4c433 100644 --- a/images/chromium-headful/client/src/neko/index.ts +++ b/images/chromium-headful/client/src/neko/index.ts @@ -97,13 +97,14 @@ export class NekoClient extends BaseClient implements EventEmitter { clean: true, }) - this.$vue.$notify({ - group: 'neko', - type: 'success', - title: this.$vue.$t('connection.connected') as string, - duration: 5000, - speed: 1000, - }) + // KERNEL: disable notifcation on connected + // this.$vue.$notify({ + // group: 'neko', + // type: 'success', + // title: this.$vue.$t('connection.connected') as string, + // duration: 5000, + // speed: 1000, + // }) } protected [EVENT.DISCONNECTED](reason?: Error) { From 33422c6fe9771f88d043979b813de0d3b1b7cd11 Mon Sep 17 00:00:00 2001 From: Rafael Garcia Date: Mon, 14 Jul 2025 14:51:03 -0700 Subject: [PATCH 05/25] disable fullscreen, resolution, and pip controls --- images/chromium-headful/client/src/components/video.vue | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/images/chromium-headful/client/src/components/video.vue b/images/chromium-headful/client/src/components/video.vue index 13aef000..6d73c1b7 100644 --- a/images/chromium-headful/client/src/components/video.vue +++ b/images/chromium-headful/client/src/components/video.vue @@ -38,8 +38,10 @@
  • +