[universal] - Issue universal config change for non-root default codespace user and installing google chrome browser reuse sandboc to run puppeteer cli in universal image #1287

Kaniska244 · 2025-01-22T15:17:51Z

Dev container name:

Universal

Description:

This PR change is made to force 1001 as UID for the non-root default codespace user in the universal image due changes in GitHub runner for larger runners to force 1001 as UID for the runner user.

Changelog:

Updated devcontainer.json file to force 1001 as UID for codespace user in universal image & removed the GID value so that its picked up as automatic.

Checklist:

Checked that applied changes work as expected.

…n ubuntu 24.04

Kaniska244 · 2025-01-27T15:13:12Z

Hi @ddoyle2017 ,

Tested another workaround for this instead of forcing the UID 1001 as that was increasing the size of the image considerably.

Setting "updateRemoteUserUID" flag to false so that UID & GID aren't replaced, so that the UID & GID of codespace user remains 1000.
Adding "postStartCommand" to change the ownership of /workspaces/images folder to the same as of the codespace user, not using "postCreateCommand" option as its already used in other sub-features in universal image. This folder is directly mounted from the local machine containing the images repo sources.
Tests are fine with this. Also tested locally in a codespace along with the devcontainer CI pipeline.

Would you kindly review the same. Please let me know in case of any concern.

With Regards,
Kaniska

ddoyle2017

Almost there! Can we revert the puppeteer --no-sandbox changes and rerun the Actions?

Kaniska244 · 2025-01-28T14:07:02Z

Hi @ddoyle2017 ,

I have tested one fix for the puppeteer cli issue. Uploaded the fix. Would you kindly review the same & let me know in case of any concern.
Please note the change is only in the test script as the purpose of the test is to demonstrate that its possible to run a puppeteer node app in the universal container.

PFB the details:

The actual issue was that there was no sandbox available to launch the browser when runner image is on ubuntu-24.04.
Downloaded google chrome amd64-deb variant latest stable version & installed the same in the container.
Chrome is shipped with a default sandbox, copied the same & populated this CHROME_DEVEL_SANDBOX variable which is used by the puppeteer by default.
All tests are fine with this & this appears to be the safest approach compared to the other approaches which would require to launch the browser directly in the container without the sandbox or modifying the kernel to allow unprivileged access.

Ref - https://github.com/puppeteer/puppeteer/blob/88ef09c6ccc27d024972725c728a9db50f010f36/docs/troubleshooting.md#setting-up-chrome-linux-sandbox

With Regards,
Kaniska Sengupta

ddoyle2017

I think this is a reasonable work around for the Puppeteer issues with Ubuntu 24.04! Can you add a comment above both your changes to explain what issue they're solving?

eljog · 2025-01-28T20:27:05Z

src/universal/.devcontainer/devcontainer.json

@@ -103,7 +103,8 @@
    ],
    "remoteUser": "codespace",
    "containerUser": "codespace",
-
+    "updateRemoteUserUID": false,
+    "postStartCommand": "sudo chown -R 1000:1000 /workspaces/images/",


May I know why this need to be a postStartCommand?
postStartCommand re runs on every time container is restarted. We need to do this work only once

Hi @eljog ,
Indeed it would be executed during every restart. Initially I saw that as part of configurations in one of the features of universal image, git-lfs has already got postCreateCommand used in devcontainer-feature.json. So I avoided the postCreateCommand option & opted for postStartCommand.
However, I have checked now that for a devcontainer configuration if the same lifecycle hook such as postCreateCommand is used in both devcontainer-feature.json & devcontainer.json, then the commands provided in the devcontainer-feature.json would be executed first followed by the commands in devcontainer.json. So I changed that & tested the same now. Kindly let me know in case of any further concerns on this.

With Regards,
Kaniska

eljog · 2025-01-28T20:36:10Z

src/universal/test-project/test.sh

+
+# export CHROME_DEVEL_SANDBOX env variable
+export CHROME_DEVEL_SANDBOX=/usr/local/sbin/chrome-devel-sandbox
+cd /workspaces/images/src/universal/test-project/
 yarn
 check "run-puppeteer" node puppeteer.js


Will this command work on the container when the user runs it?
Or is it passing here because the additional setup done above, before running the check?

Hi @eljog ,

My idea was that the main objective behind this particular test "run-puppeteer" was to demonstrate that puppeteer cli library can be used in a node app & the same cane be executed in the universal image. So I changed it in the test.sh alone considering that & also due to the fact that as part of the solution I am downloading & installing google chrome in the image which increases the image size if done as part of the build.

Now I have changed that. Following points are needed to be considered for this change.

Made change in Dockerfile to install three more libraries which are required to install chrome.

Made change in install.sh of the local feature setup-user to install chrome & placing the sandbox in the desired location. Please let me know if I should introduce a new local feature for this instead.

Made change in devcontainer.json to configure "remoteEnv" tag for the CHROME_DEVEL_SANDBOX variable with the sandbox location which is used by the puppeteer library while launching the browser.

Size of the image has now increased considerably due to the chrome installation which is still within the configured threshold but only by about 64 MB. With the previous change the gap was about 422 MB.

Kindly let me know in case of any concerns on this.

With Regards,
Kaniska Sengupta

My concern is more about the user experience here.
If we don't install chrome on the image, will the puppeteer scenarios start breaking for them from the new version?
Are the users expected to manually install the setup each time, to get things working? Not sure if that's the expectation on using universal images.

Tagging other maintainers for their thoughts. @chrmarti @bamurtaugh

My concern is more about the user experience here. If we don't install chrome on the image, will the puppeteer scenarios start breaking for them from the new version? Are the users expected to manually install the setup each time, to get things working? Not sure if that's the expectation on using universal images.

Tagging other maintainers for their thoughts. @chrmarti @bamurtaugh

Hi @eljog ,

Actually right now in the image built on top of ubuntu-24.04 runner image in CI, no sandbox is available to reuse for puppeteer node app which forces us to install chrome as it comes with sandbox & also due to enhanced security feature of ubuntu-24.04, its not possible to create sandbox without enabling user namespace cloning which still has some vulnerabilities.
Ref:- https://github.com/puppeteer/puppeteer/blob/88ef09c6ccc27d024972725c728a9db50f010f36/docs/troubleshooting.md#setting-up-chrome-linux-sandbox

puppeteer/puppeteer#12818 (comment)

With Regards,
Kaniska

ddoyle2017 · 2025-01-28T21:03:44Z

hey @Kaniska244, so @eljog and I had a discussion about how to move forward with the release and I think we need to reorganize your changes for Puppeteer.

Currently, your Chrome workaround works for our CI test, but Puppeteer will still be broken for users of this image. We should apply your updates to the image as a whole (not just in test.sh), then see if that fixes the issue 👍

…al image and setting postCreateCommand instead of postStartCommand.

Kaniska244 · 2025-01-29T19:12:22Z

hey @Kaniska244, so @eljog and I had a discussion about how to move forward with the release and I think we need to reorganize your changes for Puppeteer.

Currently, your Chrome workaround works for our CI test, but Puppeteer will still be broken for users of this image. We should apply your updates to the image as a whole (not just in test.sh), then see if that fixes the issue 👍

Hi @ddoyle2017 ,

I have made the changes according to the comments & all tests are fine with this. Would you kindly review the latest change.
PFB the details of the change.

Changed the postStartCommand option to postCreateCommand as per the review comments.
Made change in Dockerfile to install three more libraries which are required to install chrome.
Made change in install.sh of the local feature setup-user to install chrome & placing the sandbox in the desired location. Please let me know if I should introduce a new local feature for this instead.
Made change in devcontainer.json to configure "remoteEnv" tag for the CHROME_DEVEL_SANDBOX variable with the sandbox location which is used by the puppeteer library while launching the browser.
Size of the image has now increased considerably due to the chrome installation which is still within the configured threshold but only by about 64 MB. With the previous change the gap was about 422 MB.
Added comments on top of the changes for more clarity.

With Regards,
Kaniska

…es/images directory doesn't exist.

Kaniska244 added 2 commits January 22, 2025 12:49

Changing config to force 1001 as UID for codespace in universal image

8dd6829

Forcing the UID as 1001 for codespace user in universal image

1cb542b

Kaniska244 marked this pull request as ready for review January 22, 2025 16:21

Kaniska244 requested a review from a team as a code owner January 22, 2025 16:21

Kaniska244 added 4 commits January 23, 2025 09:29

Fixing puppeteer code on the --no-sandbox option to to make it work i…

55086d0

…n ubuntu 24.04

Trying with different image version for runner.

d8db581

Reverting back the ubuntu version change for runer

5ff7666

Setting updateRemoteUserUID flag to false.

bdd690b

ddoyle2017 requested changes Jan 27, 2025

View reviewed changes

Kaniska244 added 2 commits January 27, 2025 15:52

Reverting back the puppeteer fix to ensure the issue is isolated.

bd1149f

Another fix for puppeteer cli.

f13430c

ddoyle2017 requested changes Jan 28, 2025

View reviewed changes

eljog reviewed Jan 28, 2025

View reviewed changes

Kaniska244 added 3 commits January 29, 2025 09:57

Merge branch 'main' into Issue_Universal_Config_change_codespace_user

8aa5786

Changes done to make google chrome installation a part of the univers…

af2f6b5

…al image and setting postCreateCommand instead of postStartCommand.

Commit again

0dd9b52

Small change to ensure postCreateCoammend doesn't fail when /workspac…

c2e8b2c

…es/images directory doesn't exist.

Kaniska244 mentioned this pull request Feb 4, 2025

Support PHP 8.4 in php and universal images #1275

Open

Merge branch 'main' into Issue_Universal_Config_change_codespace_user

cede6c1

Kaniska244 added 2 commits February 5, 2025 15:57

Making change to change the UID workaround.

bcccb04

Check the increased image size.

be29d05

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[universal] - Issue universal config change for non-root default codespace user and installing google chrome browser reuse sandboc to run puppeteer cli in universal image #1287

[universal] - Issue universal config change for non-root default codespace user and installing google chrome browser reuse sandboc to run puppeteer cli in universal image #1287

Kaniska244 commented Jan 22, 2025

Kaniska244 commented Jan 27, 2025

ddoyle2017 left a comment

Kaniska244 commented Jan 28, 2025 •

edited

Loading

ddoyle2017 left a comment

eljog Jan 28, 2025

Kaniska244 Jan 29, 2025

eljog Jan 28, 2025

Kaniska244 Jan 29, 2025

eljog Jan 29, 2025 •

edited

Loading

Kaniska244 Jan 29, 2025 •

edited

Loading

ddoyle2017 commented Jan 28, 2025

Kaniska244 commented Jan 29, 2025

[universal] - Issue universal config change for non-root default codespace user and installing google chrome browser reuse sandboc to run puppeteer cli in universal image #1287

Are you sure you want to change the base?

[universal] - Issue universal config change for non-root default codespace user and installing google chrome browser reuse sandboc to run puppeteer cli in universal image #1287

Conversation

Kaniska244 commented Jan 22, 2025

Kaniska244 commented Jan 27, 2025

ddoyle2017 left a comment

Choose a reason for hiding this comment

Kaniska244 commented Jan 28, 2025 • edited Loading

ddoyle2017 left a comment

Choose a reason for hiding this comment

eljog Jan 28, 2025

Choose a reason for hiding this comment

Kaniska244 Jan 29, 2025

Choose a reason for hiding this comment

eljog Jan 28, 2025

Choose a reason for hiding this comment

Kaniska244 Jan 29, 2025

Choose a reason for hiding this comment

eljog Jan 29, 2025 • edited Loading

Choose a reason for hiding this comment

Kaniska244 Jan 29, 2025 • edited Loading

Choose a reason for hiding this comment

ddoyle2017 commented Jan 28, 2025

Kaniska244 commented Jan 29, 2025

Kaniska244 commented Jan 28, 2025 •

edited

Loading

eljog Jan 29, 2025 •

edited

Loading

Kaniska244 Jan 29, 2025 •

edited

Loading