Skip to content

Let CI runners give Chromium a usable sandbox #11

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
gersham merged 2 commits into from
Sep 24, 2026
Merged

Let CI runners give Chromium a usable sandbox #11

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
ab9a9eb
Let CI runners give Chromium a usable sandbox
cursoragent Sep 24, 2026
be9dad2
Record provenance of the current screenrig/cli main pack
cursoragent Sep 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 9 additions & 0 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -86,6 +86,15 @@ jobs:
PYTHONDONTWRITEBYTECODE=1 python3 scripts/test-launcher.py
PYTHONDONTWRITEBYTECODE=1 python3 scripts/test-plugin-freshness.py
PYTHONDONTWRITEBYTECODE=1 python3 scripts/test-docs-only.py
- name: Allow the unprivileged user namespaces Chromium's sandbox needs
run: |
# Ubuntu 23.10+ confines unprivileged user namespaces with AppArmor,
# so Playwright's Chromium finds no usable sandbox. Lift that on this
# throwaway runner rather than rendering with a weakened sandbox.
# https://chromium.googlesource.com/chromium/src/+/main/docs/security/apparmor-userns-restrictions.md
knob=/proc/sys/kernel/apparmor_restrict_unprivileged_userns
test -e "${knob}" || exit 0
echo 0 | sudo tee "${knob}" > /dev/null
- name: Verify optional dashboard runtime and repeat rendering
run: |
plugins/screenrig/skills/screenrig-dashboard/scripts/screenrig-dashboard setup > "${RUNNER_TEMP}/dashboard-setup.json"
Expand Down
2 changes: 1 addition & 1 deletion components.lock.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@
"commit": "ce737dde6dd179fa5bcbfe2bb2a59ddb266bfa5c",
"artifact": {
"file": "screenrig-cli.tgz",
"sha256": "e0e06065ee8c44edf094df6174c153b26be5c239677f5d06e78afe406a33ce9c"
"sha256": "f5feb909b96467573819bfd6569630e74fdaf708cf22eb74f6de52e8883823e1"
}
}
}
9 changes: 9 additions & 0 deletions plugins/screenrig/.github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -86,6 +86,15 @@ jobs:
PYTHONDONTWRITEBYTECODE=1 python3 scripts/test-launcher.py
PYTHONDONTWRITEBYTECODE=1 python3 scripts/test-plugin-freshness.py
PYTHONDONTWRITEBYTECODE=1 python3 scripts/test-docs-only.py
- name: Allow the unprivileged user namespaces Chromium's sandbox needs
run: |
# Ubuntu 23.10+ confines unprivileged user namespaces with AppArmor,
# so Playwright's Chromium finds no usable sandbox. Lift that on this
# throwaway runner rather than rendering with a weakened sandbox.
# https://chromium.googlesource.com/chromium/src/+/main/docs/security/apparmor-userns-restrictions.md
knob=/proc/sys/kernel/apparmor_restrict_unprivileged_userns
test -e "${knob}" || exit 0
echo 0 | sudo tee "${knob}" > /dev/null
- name: Verify optional dashboard runtime and repeat rendering
run: |
plugins/screenrig/skills/screenrig-dashboard/scripts/screenrig-dashboard setup > "${RUNNER_TEMP}/dashboard-setup.json"
Expand Down
7 changes: 7 additions & 0 deletions plugins/screenrig/skills/screenrig-dashboard/references/runtime.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,13 @@ SQLite version; an actual render is the browser capability test. Supported-host
claims require a successful local run. Normal screenRIG commands do not depend
on this runtime.

Rendering always keeps Chromium's sandbox on. Linux hosts that confine
unprivileged user namespaces, including Ubuntu 23.10+ under AppArmor and many
containers, fail at launch with `No usable sandbox`. Grant that browser binary
user namespaces, through an AppArmor profile or by clearing
`kernel.apparmor_restrict_unprivileged_userns` on a disposable machine, rather
than rendering without a sandbox.

Snapshots include a payload digest and separate metadata file. Pass its
`*.meta.json` path to render for replay. Snapshot queries use one SQLite read
transaction; corrections are append-only, retaining older record revisions.
Expand Down
7 changes: 7 additions & 0 deletions skills/screenrig-dashboard/references/runtime.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,13 @@ SQLite version; an actual render is the browser capability test. Supported-host
claims require a successful local run. Normal screenRIG commands do not depend
on this runtime.

Rendering always keeps Chromium's sandbox on. Linux hosts that confine
unprivileged user namespaces, including Ubuntu 23.10+ under AppArmor and many
containers, fail at launch with `No usable sandbox`. Grant that browser binary
user namespaces, through an AppArmor profile or by clearing
`kernel.apparmor_restrict_unprivileged_userns` on a disposable machine, rather
than rendering without a sandbox.

Snapshots include a payload digest and separate metadata file. Pass its
`*.meta.json` path to render for replay. Snapshot queries use one SQLite read
transaction; corrections are append-only, retaining older record revisions.
Expand Down
Loading