diff --git a/chrome/beta/Dockerfile b/chrome/beta/Dockerfile index 3269cc4..67e79ac 100644 --- a/chrome/beta/Dockerfile +++ b/chrome/beta/Dockerfile @@ -6,13 +6,16 @@ # --memory 512mb \ # max memory it can use # -v /tmp/.X11-unix:/tmp/.X11-unix \ # mount the X11 socket # -e DISPLAY=unix$DISPLAY \ -# -v $HOME/Downloads:/root/Downloads \ +# -v $HOME/Downloads:/home/chrome/Downloads \ # -v $HOME/.config/google-chrome/:/data \ # if you want to save state +# --security-opt seccomp=/etc/docker/seccomp/chrome.json # --device /dev/snd \ # so we have sound # -v /dev/shm:/dev/shm \ # --name chrome \ # jess/chrome:beta # +# You will want the custom seccomp profile: +# wget https://raw.githubusercontent.com/jfrazelle/dotfiles/master/etc/docker/seccomp/chrome.json -o ~/chrome.json # Base docker image FROM debian:sid @@ -43,8 +46,15 @@ RUN apt-get update && apt-get install -y \ && rm -rf /var/lib/apt/lists/* \ && rm -rf /src/*.deb +# Add chrome user +RUN groupadd -r chrome && useradd -r -g chrome -G audio,video chrome \ + && mkdir -p /home/chrome/Downloads && chown -R chrome:chrome /home/chrome + COPY local.conf /etc/fonts/local.conf +# Run Chrome as non privileged user +USER chrome + # Autorun chrome ENTRYPOINT [ "google-chrome" ] CMD [ "--user-data-dir=/data" ] diff --git a/chrome/stable/Dockerfile b/chrome/stable/Dockerfile index c3dab19..f329d7b 100644 --- a/chrome/stable/Dockerfile +++ b/chrome/stable/Dockerfile @@ -8,13 +8,14 @@ # -e DISPLAY=unix$DISPLAY \ # -v $HOME/Downloads:/home/chrome/Downloads \ # -v $HOME/.config/google-chrome/:/data \ # if you want to save state +# --security-opt seccomp=/etc/docker/seccomp/chrome.json # --device /dev/snd \ # so we have sound # -v /dev/shm:/dev/shm \ # --name chrome \ # jess/chrome # -# For Ubuntu I had to add download Jessie's chrome.json. -# wget wget https://raw.githubusercontent.com/jfrazelle/dotfiles/master/etc/docker/seccomp/chrome.json -o ~/chrome.json +# You will want the custom seccomp profile: +# wget https://raw.githubusercontent.com/jfrazelle/dotfiles/master/etc/docker/seccomp/chrome.json -o ~/chrome.json # Base docker image FROM debian:sid @@ -44,12 +45,16 @@ RUN apt-get update && apt-get install -y \ && apt-get purge --auto-remove -y curl \ && rm -rf /var/lib/apt/lists/* \ && rm -rf /src/*.deb + +# Add chrome user RUN groupadd -r chrome && useradd -r -g chrome -G audio,video chrome \ && mkdir -p /home/chrome/Downloads && chown -R chrome:chrome /home/chrome COPY local.conf /etc/fonts/local.conf + # Run Chrome as non privileged user USER chrome + # Autorun chrome ENTRYPOINT [ "google-chrome" ] CMD [ "--user-data-dir=/data" ]