From ab9a9eb128c8a698ea032e9dfa0ac5572ec84663 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Thu, 24 Sep 2026 00:44:56 +0000 Subject: [PATCH 1/2] Let CI runners give Chromium a usable sandbox GitHub's Ubuntu runners confine unprivileged user namespaces with AppArmor, so the dashboard renderer's sandboxed Chromium launch failed the real-browser gate. Allow user namespaces on the runner instead of rendering without a sandbox, and document the same requirement for Linux hosts that confine them. Co-authored-by: Gersham Meharg --- .github/workflows/ci.yml | 9 +++++++++ plugins/screenrig/.github/workflows/ci.yml | 9 +++++++++ .../skills/screenrig-dashboard/references/runtime.md | 7 +++++++ skills/screenrig-dashboard/references/runtime.md | 7 +++++++ 4 files changed, 32 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index d2a6b94b..5567c4f2 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -86,6 +86,15 @@ jobs: PYTHONDONTWRITEBYTECODE=1 python3 scripts/test-launcher.py PYTHONDONTWRITEBYTECODE=1 python3 scripts/test-plugin-freshness.py PYTHONDONTWRITEBYTECODE=1 python3 scripts/test-docs-only.py + - name: Allow the unprivileged user namespaces Chromium's sandbox needs + run: | + # Ubuntu 23.10+ confines unprivileged user namespaces with AppArmor, + # so Playwright's Chromium finds no usable sandbox. Lift that on this + # throwaway runner rather than rendering with a weakened sandbox. + # https://chromium.googlesource.com/chromium/src/+/main/docs/security/apparmor-userns-restrictions.md + knob=/proc/sys/kernel/apparmor_restrict_unprivileged_userns + test -e "${knob}" || exit 0 + echo 0 | sudo tee "${knob}" > /dev/null - name: Verify optional dashboard runtime and repeat rendering run: | plugins/screenrig/skills/screenrig-dashboard/scripts/screenrig-dashboard setup > "${RUNNER_TEMP}/dashboard-setup.json" diff --git a/plugins/screenrig/.github/workflows/ci.yml b/plugins/screenrig/.github/workflows/ci.yml index d2a6b94b..5567c4f2 100644 --- a/plugins/screenrig/.github/workflows/ci.yml +++ b/plugins/screenrig/.github/workflows/ci.yml @@ -86,6 +86,15 @@ jobs: PYTHONDONTWRITEBYTECODE=1 python3 scripts/test-launcher.py PYTHONDONTWRITEBYTECODE=1 python3 scripts/test-plugin-freshness.py PYTHONDONTWRITEBYTECODE=1 python3 scripts/test-docs-only.py + - name: Allow the unprivileged user namespaces Chromium's sandbox needs + run: | + # Ubuntu 23.10+ confines unprivileged user namespaces with AppArmor, + # so Playwright's Chromium finds no usable sandbox. Lift that on this + # throwaway runner rather than rendering with a weakened sandbox. + # https://chromium.googlesource.com/chromium/src/+/main/docs/security/apparmor-userns-restrictions.md + knob=/proc/sys/kernel/apparmor_restrict_unprivileged_userns + test -e "${knob}" || exit 0 + echo 0 | sudo tee "${knob}" > /dev/null - name: Verify optional dashboard runtime and repeat rendering run: | plugins/screenrig/skills/screenrig-dashboard/scripts/screenrig-dashboard setup > "${RUNNER_TEMP}/dashboard-setup.json" diff --git a/plugins/screenrig/skills/screenrig-dashboard/references/runtime.md b/plugins/screenrig/skills/screenrig-dashboard/references/runtime.md index f812d6b8..092c74e0 100644 --- a/plugins/screenrig/skills/screenrig-dashboard/references/runtime.md +++ b/plugins/screenrig/skills/screenrig-dashboard/references/runtime.md @@ -33,6 +33,13 @@ SQLite version; an actual render is the browser capability test. Supported-host claims require a successful local run. Normal screenRIG commands do not depend on this runtime. +Rendering always keeps Chromium's sandbox on. Linux hosts that confine +unprivileged user namespaces, including Ubuntu 23.10+ under AppArmor and many +containers, fail at launch with `No usable sandbox`. Grant that browser binary +user namespaces, through an AppArmor profile or by clearing +`kernel.apparmor_restrict_unprivileged_userns` on a disposable machine, rather +than rendering without a sandbox. + Snapshots include a payload digest and separate metadata file. Pass its `*.meta.json` path to render for replay. Snapshot queries use one SQLite read transaction; corrections are append-only, retaining older record revisions. diff --git a/skills/screenrig-dashboard/references/runtime.md b/skills/screenrig-dashboard/references/runtime.md index f812d6b8..092c74e0 100644 --- a/skills/screenrig-dashboard/references/runtime.md +++ b/skills/screenrig-dashboard/references/runtime.md @@ -33,6 +33,13 @@ SQLite version; an actual render is the browser capability test. Supported-host claims require a successful local run. Normal screenRIG commands do not depend on this runtime. +Rendering always keeps Chromium's sandbox on. Linux hosts that confine +unprivileged user namespaces, including Ubuntu 23.10+ under AppArmor and many +containers, fail at launch with `No usable sandbox`. Grant that browser binary +user namespaces, through an AppArmor profile or by clearing +`kernel.apparmor_restrict_unprivileged_userns` on a disposable machine, rather +than rendering without a sandbox. + Snapshots include a payload digest and separate metadata file. Pass its `*.meta.json` path to render for replay. Snapshot queries use one SQLite read transaction; corrections are append-only, retaining older record revisions. From be9dad2c97ce2d96744f29b6a6f3e1d1a6ec34a5 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Thu, 24 Sep 2026 00:58:17 +0000 Subject: [PATCH 2/2] Record provenance of the current screenrig/cli main pack screenrig/cli main is unchanged at ce737dd, but that commit has since been tagged v26.09.204, so package-release.sh stamps a later CalVer and the tarball no longer hashes to the recorded digest. Re-pack that commit and record the artifact CI packs today; the generated bundle is unchanged because the bundled CLI version is normalized. Co-authored-by: Gersham Meharg --- components.lock.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/components.lock.json b/components.lock.json index 81bc162b..c7640c27 100644 --- a/components.lock.json +++ b/components.lock.json @@ -6,7 +6,7 @@ "commit": "ce737dde6dd179fa5bcbfe2bb2a59ddb266bfa5c", "artifact": { "file": "screenrig-cli.tgz", - "sha256": "e0e06065ee8c44edf094df6174c153b26be5c239677f5d06e78afe406a33ce9c" + "sha256": "f5feb909b96467573819bfd6569630e74fdaf708cf22eb74f6de52e8883823e1" } } }