I want to run selenium and headless chrome in my docker container for testing purpose.

I have tried to run selenium in headless chrome (outside my docker container) with the following in my .js file. This worked:

const client = webdriverio.remote({
   desiredCapabilities: {
   browserName: 'chrome',
   chromeOptions: {
     args: ['--headless', '--disable-gpu']
   },
   binary: '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'
   },
 baseUrl: CONFIG.host,
 logLevel: 'verbose',
 waitForTimeout: 3000
 })

But I can't get this to work in my docker container. In my docker container I use "FROM selenium/standalone-chrome". There does not seem to be any problem with my dockerfile. The problem occurs when I try to run my selenium tests. I changed the binary_path in my .js file to /opt/google/chrome/google-chrome. But the tests fails and client can not even be initiated.

So I tried to just run /opt/google/chrome/google-chrome in order to see if chrome works, but then I get this error:

[0711/005304.226472:ERROR:nacl_helper_linux(311)] NaCl helper 
process running without a sandbox!
Most likely you need to configure your SUID sandbox correctly      

I am pretty new to this (and stack overflow) so there might be some basic things I have missed.

I want to run selenium and headless chrome in my docker container for testing purpose.

I have tried to run selenium in headless chrome (outside my docker container) with the following in my .js file. This worked:

const client = webdriverio.remote({
   desiredCapabilities: {
   browserName: 'chrome',
   chromeOptions: {
     args: ['--headless', '--disable-gpu']
   },
   binary: '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'
   },
 baseUrl: CONFIG.host,
 logLevel: 'verbose',
 waitForTimeout: 3000
 })

But I can't get this to work in my docker container. In my docker container I use "FROM selenium/standalone-chrome". There does not seem to be any problem with my dockerfile. The problem occurs when I try to run my selenium tests. I changed the binary_path in my .js file to /opt/google/chrome/google-chrome. But the tests fails and client can not even be initiated.

So I tried to just run /opt/google/chrome/google-chrome in order to see if chrome works, but then I get this error:

[0711/005304.226472:ERROR:nacl_helper_linux(311)] NaCl helper 
process running without a sandbox!
Most likely you need to configure your SUID sandbox correctly      

I am pretty new to this (and stack overflow) so there might be some basic things I have missed.

• javascript
• google-chrome
• selenium
• docker

2 Answers 2

Try to include --no-sandbox

chromeOptions: {
  args: ['--headless', '--disable-gpu', '--no-sandbox']
},

As I'm doing at docker-selenium

This error message...

[1003/144118.702053:ERROR:nacl_helper_linux(310)] NaCl helper process running without a sandbox!
Most likely you need to configure your SUID sandbox correctly

...implies that you have no setuid sandbox in your system, hence the program was unable to initiate/spawn a new Browsing Context i.e. Chrome Browser session.

Solution

The easiest (not so clean) solution is, if you want to run Chrome and only use the namespace sandbox, you can set the flag:

--disable-setuid-sandbox

This flag will disable the setuid sandbox (Linux only). But if you do so on a host without appropriate kernel support for the namespace sandbox, Chrome will not spin up. As an alternative you can also use the flag:

--no-sandbox

This flag will disable the sandbox for all process types that are normally sandboxed.

Example:

chromeOptions: {
      args: ['--disable-setuid-sandbox', '--no-sandbox']
},

You can find a detailed discussion in Security Considerations - ChromeDriver - Webdriver for Chrome

Deep dive

As per the documentation in Linux SUID Sandbox Development google-chrome needs a SUID helper binary to turn on the sandbox on Linux. In majority of the cases you can install the proper sandbox for you using the mand:

build/update-linux-sandbox.sh

This program will install the proper sandbox for you in /usr/local/sbin and tell you to update your .bashrc if required.

However, there can be some exceptions as an example, if your setuid binary is out of date, you will get messages such as:

NaCl helper process running without a sandbox!
Most likely you need to configure your SUID sandbox correctly 

Or

Running without the SUID sandbox!

In these cases, you need to:

• Build chrome_sandbox whenever you build chrome (ninja -C xxx chrome chrome_sandbox instead of ninja -C xxx chrome)

• After building, execute update-linux-sandbox.sh.

  # needed if you build on NFS!
  sudo cp out/Debug/chrome_sandbox /usr/local/sbin/chrome-devel-sandbox
  sudo chown root:root /usr/local/sbin/chrome-devel-sandbox
  sudo chmod 4755 /usr/local/sbin/chrome-devel-sandbox
  

• Finally, you have to include the following line in your ~/.bashrc (or .zshenv):

  export CHROME_DEVEL_SANDBOX=/usr/local/sbin/chrome-devel-sandbox