acdcjunior/chrome-headless-chromedriver-java8 repository overview

org.openqa.selenium.WebDriverException: unknown error: an X display is required for keycode conversions, consider using Xvfb

Failed to move to new namespace: PID namespaces supported, Network namespace supported, but failed: errno = Operation not permitted

Actually it's saying that it's running without the sandbox enabled. What that means is that the renderer (ie. the process that draws web pages), is running with more permissions than it usually would. That means a bug in the renderer is more likely to lead to your kernel being exploited than if you are running with the sandbox enabled.

⁠Why cap-add=SYS_ADMIN is needed

Currently, there is a user namespace issue in OSX that generates this error:

Failed to move to new namespace: PID namespaces supported, Network namespace supported,
but failed: errno = Operation not permitted

Copy

There are two mitigations, but none of them are ideal as it gives the container some special capabilities:

1. Use a special seccomp profile, as stated in https://twitter.com/jessfraz/status/681934414687801345⁠

docker run -it --rm --name chrome --shm-size=1024m -p=127.0.0.1:9222:9222 --security-opt seccomp:/path/to/chrome.json \
  yukinying/chrome-headless-browser

Copy

1. Use CAP_SYS_ADMIN

docker run -it --rm --name chrome --shm-size=1024m -p=127.0.0.1:9222:9222 --name chrome --cap-add=SYS_ADMIN \
  yukinying/chrome-headless-browser

Copy

Very nice works perfectly with Selenium, no window size . This run on ubuntu 17.04

@BeforeTest
public void setupTest() {
    ChromeDriverManager.getInstance().setup();
    ChromeOptions options = new ChromeOptions();
    options.addArguments("--headless", "--disable-gpu");
    driver =  new ChromeDriver( options );
}

Copy

ChromeDriverManager its a project of Boni Garcia https://github.com/bonigarcia/webdrivermanager⁠