Question: Attempting to run Puppeteer, a Node library to control a headless Chromium (in order to do things like create a PDF of a website), in Docker is a surprisingly fiddly thing.

The problem is that, from my understanding, to run as root, you need the option `--no-sandbox`, which is rightly decried as being an insecure and bad solution. The problem is that the go-to alternatives seem to be just as bad:

* Running the container with `CAP_ADD=SYS_ADMIN`, which I think I needn't comment further, or
* Running as non-root, but to run Puppeteer in a non-root sandbox, you need to enable the kernel option `unprivileged_userns_clone`, which once I started researching found it was said to

> 
> "open[s] up severe vulnerabilities in the Linux kernel" ([link](https://security.stackexchange.com/a/209533/211395))
> 
> 
> 

as well as

> 
> "Unprivileged user namespaces are *extremely* dangerous" ([link](https://security.stackexchange.com/a/209534/211395))
> 
> 
> 

I am surprised that doing something as simple and comparatively low level as running a web browser seems to require such wide ranging permissions that apparently open up wide swathes of attack vectors. The kind of warnings I'm reading are what I would expect to read if I were to root a phone or compromise the operating systems security routines.

Am I misunderstanding the situation here, or is to run Chromium in a Docker container tantamount to opening up my server to half the internet ?

Answer: 
It looks like the best option is to use a custom seccomp profile

You can see an example [here](https://github.com/Zenika/alpine-chrome#-the-best-with-seccomp)

Other links to the file you need in case they disappear: 

```
wget https://raw.githubusercontent.com/jfrazelle/dotfiles/master/etc/docker/seccomp/chrome.json

```

```
wget https://raw.githubusercontent.com/Zenika/alpine-chrome/master/chrome.json

```

Sample usage:

```
docker container run -it --rm --security-opt seccomp=$(pwd)/chrome.json zenika/alpine-chrome

```
I don't think that running puppeteer as a non-root user requires any modification of the configuration of the underlying host, as there are a number of Docker images which do this successfully.

One example is [Decktape](https://github.com/astefanutti/decktape) which is built on top of Puppeteer. The Docker image (which has commands linked in the GH repo) runs as the user `node` and works on an unmodified Linux instance.