Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[universal] - Issue universal config change for non-root default codespace user and installing google chrome browser reuse sandboc to run puppeteer cli in universal image #1287

Open
wants to merge 15 commits into
base: main
Choose a base branch
from
Open

[universal] - Issue universal config change for non-root default codespace user and installing google chrome browser reuse sandboc to run puppeteer cli in universal image #1287

Show file tree
Hide file tree
Changes from 8 commits
Commits
Show all changes
15 commits
Select commit Hold shift + click to select a range
8dd6829
Changing config to force 1001 as UID for codespace in universal image
Kaniska244 Jan 22, 2025
1cb542b
Forcing the UID as 1001 for codespace user in universal image
Kaniska244 Jan 22, 2025
55086d0
Fixing puppeteer code on the --no-sandbox option to to make it work i…
Kaniska244 Jan 23, 2025
d8db581
Trying with different image version for runner.
Kaniska244 Jan 23, 2025
5ff7666
Reverting back the ubuntu version change for runer
Kaniska244 Jan 23, 2025
bdd690b
Setting updateRemoteUserUID flag to false.
Kaniska244 Jan 27, 2025
bd1149f
Reverting back the puppeteer fix to ensure the issue is isolated.
Kaniska244 Jan 27, 2025
f13430c
Another fix for puppeteer cli.
Kaniska244 Jan 28, 2025
8aa5786
Merge branch 'main' into Issue_Universal_Config_change_codespace_user
Kaniska244 Jan 29, 2025
af2f6b5
Changes done to make google chrome installation a part of the univers…
Kaniska244 Jan 29, 2025
0dd9b52
Commit again
Kaniska244 Jan 29, 2025
c2e8b2c
Small change to ensure postCreateCoammend doesn't fail when /workspac…
Kaniska244 Feb 2, 2025
cede6c1
Merge branch 'main' into Issue_Universal_Config_change_codespace_user
Kaniska244 Feb 4, 2025
bcccb04
Making change to change the UID workaround.
Kaniska244 Feb 5, 2025
be29d05
Check the increased image size.
Kaniska244 Feb 5, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion src/universal/.devcontainer/devcontainer.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -103,7 +103,8 @@
],
"remoteUser": "codespace",
"containerUser": "codespace",

"updateRemoteUserUID": false,
"postStartCommand": "sudo chown -R 1000:1000 /workspaces/images/",
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

May I know why this need to be a postStartCommand?
postStartCommand re runs on every time container is restarted. We need to do this work only once

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi @eljog ,
Indeed it would be executed during every restart. Initially I saw that as part of configurations in one of the features of universal image, git-lfs has already got postCreateCommand used in devcontainer-feature.json. So I avoided the postCreateCommand option & opted for postStartCommand.
However, I have checked now that for a devcontainer configuration if the same lifecycle hook such as postCreateCommand is used in both devcontainer-feature.json & devcontainer.json, then the commands provided in the devcontainer-feature.json would be executed first followed by the commands in devcontainer.json. So I changed that & tested the same now. Kindly let me know in case of any further concerns on this.

With Regards,
Kaniska

// Use 'forwardPorts' to make a list of ports inside the container available locally.
// "forwardPorts": [],

Expand Down
13 changes: 13 additions & 0 deletions src/universal/test-project/test.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -133,6 +133,19 @@ check "zsh" zsh --version
check "RAILS_DEVELOPMENT_HOSTS is set correctly" echo $RAILS_DEVELOPMENT_HOSTS | grep ".githubpreview.dev,.preview.app.github.dev,.app.github.dev"

# Check that we can run a puppeteer node app.
# installing google chrome for puppeteer
cd /
sudo wget https://dl.google.com/linux/direct/google-chrome-stable_current_amd64.deb
sudo dpkg -i google-chrome-stable_current_amd64.deb

cd /opt/google/chrome/
sudo chown root:root chrome-sandbox
sudo chmod 4755 chrome-sandbox
sudo cp -p chrome-sandbox /usr/local/sbin/chrome-devel-sandbox

# export CHROME_DEVEL_SANDBOX env variable
export CHROME_DEVEL_SANDBOX=/usr/local/sbin/chrome-devel-sandbox
cd /workspaces/images/src/universal/test-project/
yarn
check "run-puppeteer" node puppeteer.js
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Will this command work on the container when the user runs it?
Or is it passing here because the additional setup done above, before running the check?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi @eljog ,

My idea was that the main objective behind this particular test "run-puppeteer" was to demonstrate that puppeteer cli library can be used in a node app & the same cane be executed in the universal image. So I changed it in the test.sh alone considering that & also due to the fact that as part of the solution I am downloading & installing google chrome in the image which increases the image size if done as part of the build.

Now I have changed that. Following points are needed to be considered for this change.

  • Made change in Dockerfile to install three more libraries which are required to install chrome.
  • Made change in install.sh of the local feature setup-user to install chrome & placing the sandbox in the desired location. Please let me know if I should introduce a new local feature for this instead.
  • Made change in devcontainer.json to configure "remoteEnv" tag for the CHROME_DEVEL_SANDBOX variable with the sandbox location which is used by the puppeteer library while launching the browser.
  • Size of the image has now increased considerably due to the chrome installation which is still within the configured threshold but only by about 64 MB. With the previous change the gap was about 422 MB.

Kindly let me know in case of any concerns on this.

With Regards,
Kaniska Sengupta

Copy link
Member

@eljog eljog Jan 29, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

My concern is more about the user experience here.
If we don't install chrome on the image, will the puppeteer scenarios start breaking for them from the new version?
Are the users expected to manually install the setup each time, to get things working? Not sure if that's the expectation on using universal images.

Tagging other maintainers for their thoughts. @chrmarti @bamurtaugh

Copy link
Contributor Author

@Kaniska244 Kaniska244 Jan 29, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

My concern is more about the user experience here. If we don't install chrome on the image, will the puppeteer scenarios start breaking for them from the new version? Are the users expected to manually install the setup each time, to get things working? Not sure if that's the expectation on using universal images.

Tagging other maintainers for their thoughts. @chrmarti @bamurtaugh

Hi @eljog ,

Actually right now in the image built on top of ubuntu-24.04 runner image in CI, no sandbox is available to reuse for puppeteer node app which forces us to install chrome as it comes with sandbox & also due to enhanced security feature of ubuntu-24.04, its not possible to create sandbox without enabling user namespace cloning which still has some vulnerabilities.
Ref:- https://github.com/puppeteer/puppeteer/blob/88ef09c6ccc27d024972725c728a9db50f010f36/docs/troubleshooting.md#setting-up-chrome-linux-sandbox

puppeteer/puppeteer#12818 (comment)

With Regards,
Kaniska


Expand Down
Loading