I am running chromedriver + chrome inside Docker in my test environment.
Everything was working fine until latest CoreOS upgrade.
These are the versions that seem to work:
VERSION=1185.5.0 VERSION_ID=1185.5.0 BUILD_ID=2016-12-07-0937
And this a newer version that causes chrome to coredump:
VERSION=1235.4.0 VERSION_ID=1235.4.0 BUILD_ID=2017-01-04-0450
Looking at changes, it seems docker was upgraded from 1.11.x to 1.12.x, which broke
setns() call inside container.
setns() is used by Chrome for creating a namespaces.
This are the example outputs:
jsosic-coreos-test-20161207 ~ # docker --version Docker version 1.11.2, build bac3bae
From inside one container on this box:
[root@2939f21ecfaa /]# /opt/google/chrome/google-chrome [57:57:0107/015130:ERROR:browser_main_loop.cc(261)] Gtk: cannot open display:
This is how the new version broke it:
jsosic-coreos-test-2017-01-04 ~ # docker --version Docker version 1.12.3, build 34a2ead [root@13ab34c36c82 /]# /opt/google/chrome/chrome Failed to move to new namespace: PID namespaces supported, Network namespace supported, but failed: errno = Operation not permitted Aborted (core dumped)
What I have found out is that if I start the container with either
--privileged - Chrome works as expected.
What is the difference between those two switches? What capabilities are enabled by
And, can I allow
setns() inside container without compromising security?