Create a user to avoid running the agent with root user

[Maresther-B]

A issue has been reported by Dave, while trying to run estheniacollaboration/rfswarm-agent-seleniumlibrary-chrome image with a DISPLAY on his mac computer.

The Dockerfile containt's used by Dave is:

FROM estheniacollaboration/rfswarm-agent-seleniumlibrary-chrome:latest ENV DISPLAY=192.168.13.141:0 where 192.168.13.141 is the IP of his mac.

This happen because we can't run root apps on a remote display

Dave think that, maybe the better option is to create a user like rfsagent and switch to that before running the entrypoint

The steps realized to reproduce the issue are described below:

• On my mac I opened XQuartz and in the terminal it opened I ran xhost + to allow any host to display an x window on this X display
• I tried to run a couple of robots on this container and chrome promptly crashed
• I then ran docker exec -it bash and tried running chrome from a bah prompt, it crashed with Running as root without --no-sandbox is not supported
• I then tried again with /opt/google/chrome/chrome --no-sandbox and it crashed with an error about the display
• so then I thought, lets try an xterm, so apt install xterm followed by running xterm and it gave me the error: Warning: This program is an suid-root program or is being run by the root user. The full text of the error or warning message cannot be safely formatted in this environment. You may get a more descriptive message by running the program as a non-root user or by removing the suid bit on the executable. xterm: Xt error: Can't open display: %s

Here is a link which explains the context: https://www.docker.com/blog/understanding-the-docker-user-instruction/

Thanks to @Dave for the report

[damies13]

OK working on some steps to help you reproduce the issues and get a working image

On Mac:

• open XQuartz
• when xterm terminal window opens
  • run xhost + (this allows any local machine to display a window in XQuartz)
  • run ifconfig |grep 192.168 or ifconfig |grep 10. (this is to get your Mac's ip address, you'll need that below), for me it was 192.168.13.114

On docker machine (this might be your mac or another machine, for me it's a Linux VM)

Demonstrating the issue where Chrome crashes even without being run in robot framework or rfswarm-agent

• xtest docker
  • on the docker machine I created a directory xtest
  • I then created a docker file: ~/xtest/Dockerfile

    FROM  estheniacollaboration/rfswarm-agent-seleniumlibrary-chrome:latest
    ENV   DISPLAY=192.168.13.114:0

  • run cd xtest
  • run docker build -t 'xtest' .
  • run docker run -d xtest
  • run docker ps (to get the list of container names, in this case it was kind_zhukovsky)
  • run docker exec -it kind_zhukovsky bash (connect to the container with a shell environment as the default shell is running rfswarm-agent)
  • run google-chrome or /opt/google/chrome/chrome
  • chrome will crash (this is what happens when robot runs chrome)

Attempting to fix the issue, I investigated a number of the crash reasons and added them to a docker file in the xtestu directory:

• xtestu docker

  • on the docker machine I created a directory xtestu
  • I then created a docker file: ~/xtestu/Dockerfile

    FROM  estheniacollaboration/rfswarm-agent-seleniumlibrary-chrome:latest
    RUN echo [D-BUS Service]> /usr/share/dbus-1/services/org.freedesktop.Notifications.service
    RUN echo Name=org.freedesktop.Notifications>> /usr/share/dbus-1/services/org.freedesktop.Notifications.service
    RUN echo Exec=/usr/lib/notification-daemon-1.0/notification-daemon>> /usr/share/dbus-1/services/org.freedesktop.Notifications.service
    RUN apt install nano -y
    RUN useradd -m rfsagent
    USER rfsagent
    ENV   DISPLAY=192.168.13.114:0
    ENV XDG_CONFIG_HOME=~/.chrome
    ENV XDG_CACHE_HOME=~/.chrome
    RUN mkdir ~/.chrome
    RUN cd

  • cd xtestu
  • docker build -t 'xtestu' .
  • docker run --privileged -d xtestu (one of the chrome errors was related to the user not having privileged kernel access, that's why this has --privileged)
  • docker ps (to get the list of container names, in this case it was goofy_mccarthy)
  • docker exec -it goofy_mccarthy bash (connect to the container with a shell environment as the default shell is running rfswarm-agent)
  • run google-chrome or /opt/google/chrome/chrome
  • chrome will run but after some time as you try to use it, it will still crash
  • I then tried running chrome from robot framework, in the docker container I created a directory /home/rfsagent/robot
  • I changed to that directory and used nano to create the file simple.robot

    
    *** Settings ***
    Library  SeleniumLibrary

  Test Cases Open My Browser Open browser http://robotframework.org/ Chrome options=add_experimental_option("detach",True) sleep 10 Go To https://github.com/Esthenia-collaboration/rfswarm-docker/ sleep 10 Go To https://hub.docker.com/r/estheniacollaboration/rfswarm-agent-seleniumlibrary-chrome sleep 10 Go To https://github.com/damies13/rfswarm

  
  - I then tried running `robot simple.robot`
  - the test doesn't pass, sometimes it will load the first page, sometimes it will crash loading the first page, until this robot file can run no point testing that you can run tests with the agent

I haven't figured out the full solution but I think this will help you on the right track and help you troubleshoot the issue.

[Maresther-B]

Thanks so much Dave, this is well detailed.

[Maresther-B]

.K I reproduced the issue and I got this error message: [34:34:1106/223443.549030:ERROR:zygote_host_impl_linux.cc(101)] Running as root without --no-sandbox is not supported. See https://crbug.com/638180. This is while running the image without any custom user