jessfraz / dockerfiles Goto Github PK

Hi,
As a 'thank you' for providing certain dockerized apps, like firefox etc. Here is to share with you my newest creation:

IRC Ultimate Everything Docker image

I play around with the chrome container almost got it working... Seems to have some issues with the sandboxing and it runs very unstable without the sandboxing...

Anyways, to get it working with any X11 things I had to mount in .Xauthority, the following two options did the trick for me... I suspect they are needed for all images.

    -v ${XAUTHORITY}:/xauthority:ro # mount .Xauthority file, need for auth with Xorg
    -e XAUTHORITY='/xauthority' \ # point to .Xauthority file, so clients can find magic cookie

Hi !

I'm using Arch as host, with 4.6.2-1 kernel and 1.11.2 is my Docker version.

This doesn't work for me:

 docker run -it \
    --net host \ # may as well YOLO
    --cpuset-cpus 0 \ # control the cpu
    --memory 512mb \ # max memory it can use
    -v /tmp/.X11-unix:/tmp/.X11-unix \ # mount the X11 socket
    -e DISPLAY=unix$DISPLAY \
    -v $HOME/Downloads:/root/Downloads \
    -v $HOME/.config/google-chrome/:/data \ # if you want to save state
    --device /dev/snd \ # so we have sound
    -v /dev/shm:/dev/shm \
    --name chrome \
    jess/chrome

this doesn't open the chrome window for me. but when I add--no-sandbox or --disable-setuid-sandbox, it works.

Also, with 512mb ram, it crashes tabs multiple times, also "HTTPS everywhere" and "uBlock" will crash multiple times. adding --disable-appcontainer won't help either.

is there any way to run Chrome container with sand-boxing in Arch ?

best regards.

I keep getting this error when trying to run the Chrome image. If I run with the --no-sandbox argument for Chrome, it then complains about running as the root user and dies immediately. What's the solution?

Failed to move to new namespace: PID namespaces supported, Network namespace supported, but failed: errno = Operation not permitted

Why do not you use a variable DEBIAN_FRONTEND?
Because of this, during the installation using the apt-get errors similar to the following:

debconf: unable to initialize frontend: Dialog
debconf: (TERM is not set, so the dialog frontend is not usable.)
debconf: falling back to frontend: Readline
debconf: unable to initialize frontend: Readline
debconf: (This frontend requires a controlling tty.)
debconf: falling back to frontend: Teletype
invoke-rc.d: unknown initscript, /etc/init.d/systemd-logind not found.
invoke-rc.d: policy-rc.d denied execution of start.

If Dockerfile specify the following line, the error will disappear:

ENV DEBIAN_FRONTEND=noninteractive

It seems chrome is not able to run with sandbox. It suggests to recompile with that option.

[1:1:0426/110158:ERROR:browser_main_loop.cc(171)] Running without the SUID sandbox! See https://code.google.com/p/chromium/wiki/LinuxSUIDSandboxDevelopment for more information on developing with the sandbox on.

May be is there another workaround?

debug log generates quite a lot of messages. why not set the default log level?

First things first, awesome job FYI. Love throwing desktop apps into docker.

Everything works great and I've even got Hipchat running throught X11. Just one thing left that's been bothering me, hiDPI.

docker run --rm -it -v /etc/machine-id:/etc/machine-id:ro
-v /etc/localtime:/etc/localtime:ro
-v /tmp/.X11-unix:/tmp/.X11-unix
-e DISPLAY=unix$DISPLAY
--device /dev/snd
-v /var/run/dbus:/var/run/dbus
-e GDK_SCALE
-e GDK_DPI_SCALE
-e QT_DEVICE_PIXEL_RATIO
--name hipchat hipchat

But no matter what I do, it doesn't scale. In QT or GDK. I've Google'd for hours and troubleshooted and I've came here as a last resort.

FYI, I'm running Debian 8 with Gnome3 and the GDK_SCALE values, etc, are in my .zshrc + .bashrc

Any ideas what I may be missing?

While trying to get Docker integration tests running on ARM one major problem is that the current unshare image only works for x86.

Together with @StefanScherer I created a quick'n'dirty variant of the unshare image which can be found here: https://github.com/hypriot/armhf-unshare

As the unshare image is used for the integration tests makes me think that it also should be part of the official docker-library. Same as for the busybox image.

How could we best achieve this? How could I help?

Link https://code.google.com/p/chromium/wiki/LinuxSUIDSandboxDevelopment
I put export CHROME_DEVEL_SANDBOX=/usr/local/sbin/chrome-devel-sandbox in my ~/.zshenv, to no avail.

❯ VBoxManage -v
4.3.22r98236

~/Code
❯ docker run -it --net host --cpuset 0 --memory 512mb -v /tmp/.X11-unix:/tmp/.X11-unix -e DISPLAY=unix$DISPLAY -v $HOME/Downloads:/root/Downloads -v $HOME/.config/google-chrome/:/data -v /dev/snd:/dev/snd --privileged --name chrome jess/chrome
zsh: correct '$HOME/Downloads:/root/Downloads' to '$HOME/Downloads/root/Downloads' [nyae]? n
Unable to find image 'jess/chrome:latest' locally
Pulling repository jess/chrome
afd0b9ff8436: Download complete
511136ea3c5a: Download complete
8771fbfe935c: Download complete
0e30e84e9513: Download complete
51234c8e1d7b: Download complete
717610759d79: Download complete
b93129b92962: Download complete
4596e961e5ab: Download complete
91ef00dbf657: Download complete
Status: Downloaded newer image for jess/chrome:latest
[1:1:0222/051636:ERROR:browser_main_loop.cc(164)] Running without the SUID sandbox! See https://code.google.com/p/chromium/wiki/LinuxSUIDSandboxDevelopment for more information on developing with the sandbox on.
[1:1:0222/051636:ERROR:browser_main_loop.cc(210)] Gtk: cannot open display: unix/private/tmp/com.apple.launchd.sxSz0Md9aE/org.macosforge.xquartz:0

~/Code  2m 55s
❯ VBoxManage -v
4.3.22r98236

~/Code
❯ boot2docker -v info
Boot2Docker-cli version: v1.5.0
Git commit: ccd9032
2015/02/21 23:17:02 executing: VBoxManage showvminfo boot2docker-vm --machinereadable
{
    "Name": "boot2docker-vm",
    "UUID": "64e423d4-1d60-4ae5-9997-bd13f7cd3b41",
    "Iso": "/Users/kevinsuttle/.boot2docker/boot2docker.iso",
    "State": "running",
    "CPUs": 8,
    "Memory": 2048,
    "VRAM": 8,
    "CfgFile": "/Users/kevinsuttle/VirtualBox VMs/boot2docker-vm/boot2docker-vm.vbox",
    "BaseFolder": "/Users/kevinsuttle/VirtualBox VMs/boot2docker-vm",
    "OSType": "",
    "Flag": 0,
    "BootOrder": null,
    "DockerPort": 0,
    "SSHPort": 2022,
    "SerialFile": "/Users/kevinsuttle/.boot2docker/boot2docker-vm.sock"
}
~/Code
❯ docker info
Containers: 1
Images: 9
Storage Driver: aufs
 Root Dir: /mnt/sda1/var/lib/docker/aufs
 Backing Filesystem: extfs
 Dirs: 11
Execution Driver: native-0.2
Kernel Version: 3.18.5-tinycore64
Operating System: Boot2Docker 1.5.0 (TCL 5.4); master : a66bce5 - Tue Feb 10 23:31:27 UTC 2015
CPUs: 8
Total Memory: 1.961 GiB
Name: boot2docker
ID: G3HM:KNYD:UUZS:CDQI:WOSQ:4GH5:IL66:YPOG:RCHY:IREC:LUZU:GHLZ
Debug mode (server): true
Debug mode (client): false
Fds: 10
Goroutines: 16
EventsListeners: 0
Init Path: /usr/local/bin/docker
Docker Root Dir: /mnt/sda1/var/lib/docker

OS X 10.10.2

Hi,

@jfrazelle:
first of all: Thank you very much for these Dockerfiles - they're fantastic! 👏

My problem is related to running the Chrome Docker container without having sound inside the container. I run the container with:

docker run -it \
            --rm \
            --net host \
            --cpuset-cpus 0 \
            --memory 512mb \
            -v /tmp/.X11-unix:/tmp/.X11-unix \
            --device /dev/snd \
            -e DISPLAY=unix$DISPLAY \
            --name chrome \
            my/jfrazelle_chrome:2015-11-28

I get following errors as soon as Chrome tries to access the sound device (browsing to youtube.com, for example):

ALSA lib confmisc.c:768:(parse_card) cannot find card '0'
            ALSA lib conf.c:4260:(_snd_config_evaluate) function snd_func_card_driver returned error: No such file or directory
            ALSA lib confmisc.c:392:(snd_func_concat) error evaluating strings
            ALSA lib conf.c:4260:(_snd_config_evaluate) function snd_func_concat returned error: No such file or directory
            ALSA lib confmisc.c:1251:(snd_func_refer) error evaluating name
            ALSA lib conf.c:4260:(_snd_config_evaluate) function snd_func_refer returned error: No such file or directory
            ALSA lib conf.c:4739:(snd_config_expand) Evaluate error: No such file or directory
            ALSA lib pcm.c:2267:(snd_pcm_open_noupdate) Unknown PCM default
            ALSA lib confmisc.c:768:(parse_card) cannot find card '0'
            ALSA lib conf.c:4260:(_snd_config_evaluate) function snd_func_card_driver returned error: No such file or directory
            ALSA lib confmisc.c:392:(snd_func_concat) error evaluating strings
            ALSA lib conf.c:4260:(_snd_config_evaluate) function snd_func_concat returned error: No such file or directory
            ALSA lib confmisc.c:1251:(snd_func_refer) error evaluating name
            ALSA lib conf.c:4260:(_snd_config_evaluate) function snd_func_refer returned error: No such file or directory
            ALSA lib conf.c:4739:(snd_config_expand) Evaluate error: No such file or directory
            ALSA lib pcm.c:2267:(snd_pcm_open_noupdate) Unknown PCM default

I run Docker v1.9.1 build a34a1d5 on Ubuntu 14.04.3 LTS.

Some more information gathered inside the Chrome container:

root@godock:/# cat /proc/asound/cards 
 1 [PCH            ]: HDA-Intel - HDA Intel PCH
                      HDA Intel PCH at 0xf7418000 irq 65
root@godock:/# cat /proc/asound/modules 
 1 snd_hda_intel
root@godock:/# cat /proc/asound/devices 
  1:        : sequencer
  2: [ 1- 0]: digital audio playback
  3: [ 1- 0]: digital audio capture
  4: [ 1- 0]: hardware dependent
  5: [ 1]   : control
 33:        : timer

Any help would be much appreciated.

Best,
Andreas

Hey there,

Try to run tor-browser on Docker for Synology. SSH'd to the machine and ran the commands

docker run -v /tmp/.X11-unix:/tmp/.X11-unix -v /dev/snd:/dev/snd -e DISPLAY=unix$DISPLAY jess/tor-browser

But getting this issue

Error response from daemon: Cannot start container 569cbe3a00c03925cd700d45c5144d2d250ea86867104279792c7870c09b883c: stat /tmp/.X11-unix: no such file or directory

Perhaps this is a noob issue, but I don't know how to sort this?

Thanks

Hi there,

was excited to read on your blog about how to run desktop apps in docker on OSX, however I have some issues to get it working:

docker run -it -v /tmp/.X11-unix:/tmp/.X11-unix -e DISPLAY=unix$DISPLAY --device /dev/sda:/dev/sda --name gparted jess/gparted
Unable to find image 'jess/gparted:latest' locally
latest: Pulling from jess/gparted
523ef1d23f22: Pull complete 
140f9bdfeb97: Pull complete 
fc56060664de: Pull complete 
ddb241964ad8: Pull complete 
a003b543bde0: Pull complete 
Digest: sha256:cca27f1701433c5e4a343907b92f8649bdc4818acea5e76cb27fd7c61e6d98af
Status: Downloaded newer image for jess/gparted:latest

(gpartedbin:25): Gtk-WARNING **: cannot open display: unix

Other examples, like jess/htop that don't need display do work.

any comments/help will be very appreciated.

Thank you for this repository, it is very useful!

Not sure that this matters to you, but if you make an FFI accessible lib with rust (see here), cc is required. I may make a PR to fix this. THANKS!

Getting

E: The package index files are corrupted. No Filename: field for package libpng12-0.

when trying to build chromium.

So this is totally my stupidity, and likely just a lack of understanding of OpenVPN - but I'm attempting to use certificates and keys with this, and I'm getting this issue:

jono@macbook:~/projects/vpn-client% docker-compose run vpn myConfig.opvn 
Options error: --ca fails with '/etc/openvpn/ca.crt': No such file or directory
Options error: --cert fails with 'local.crt': No such file or directory
Options error: --key fails with 'local.key': No such file or directory

I've added this line to the docker file to put the certs and key into the etc/openvpn/ folder:

WORKDIR /etc/openvpn

COPY additional_files/* $WORKDIR/

ENTRYPOINT ["openvpn"]

If you notice in the error, I was attempting to test my understanding with the /etc/openvpn/ca.crt to see if hardcoding the path it would find that correctly, but no such luck.

Any advice?

Hello,
I have problem with your Dockerfile - buttslock.
I run container with docker run -d -ti -v /etc/passwd:/etc/passwd:ro -v /etc/shadow:/etc/shadow:ro -v /var/run/dbus:/var/run/dbus -v /tmp/.X11-unix:/tmp/.X11-unix --name locker -e DISPLAY=unix$DISPLAY -e USER=tro buttslock
and when my laptop go to sleep mode or lock mode nothing happens.
Using Debian 8.2.
Thx for help.

I'm following the nice blog post here, about Chrome inside Docker.

I've noticed the runtime binding -v $HOME/Downloads:/root/Downloads \ # optional, but nice.

Why does it run as root? Instead of as some user / nobody? Can it run without root?

These dockerfiles are very helpful!

I am a bit of newbie on docker -- but I hope you can point me in the right
direction if you can't answer this question directly.

1. I successfully launched Atom in the docker container -- after running the
   command xhost + on my local ubuntu host --- works great!

If I wanted to reach this container from my Windows platform and run Atom as
a remote gui app -- what would I need to do?

1. I noticed that the files in Atom were not persistent. Any suggestions on
   how to make these persistent using the local file system in the Container?

I only copied Dockerfile, build correct but when I run:

Unable to find image 'Dockerfile:latest' locally
repository name component must match "a-z0-9(?:[.]a-z0-9)"

CMD ["/usr/src/sublime_text/sublime_text", "-w"]
localhost:docker-test zdd$ docker version
Client:
Version: 1.9.1
API version: 1.21
Go version: go1.4.3
Git commit: a34a1d5
Built: Fri Nov 20 17:56:04 UTC 2015
OS/Arch: darwin/amd64

Server:
Version: 1.9.1
API version: 1.21
Go version: go1.4.3
Git commit: a34a1d5
Built: Fri Nov 20 17:56:04 UTC 2015
OS/Arch: linux/amd64

docker run -d -v /tmp/.X11-unix:/tmp/.X11-unix -e DISPLAY=unix$DISPLAY --device /dev/dri --name visualstudio jess/visualstudio
Unable to find image 'jess/visualstudio:latest' locally
latest: Pulling from jess/visualstudio
5385af2045ef: Pull complete
8e7f55543130: Pull complete
b7868c184c2f: Pull complete
3c63844759ef: Pull complete
00cc8e506cb0: Pull complete
67d87eb55e1b: Pull complete
cc4982629f83: Pull complete
8d6b3651744e: Pull complete
c818e0a83cf4: Pull complete
0e57ef9cf1ca: Pull complete
f9914c2bee3b: Pull complete
2c98714cd135: Pull complete
4723c1eafa97: Pull complete
4186e6387c9f: Pull complete
552ca6a9a1b4: Pull complete
6fac5857b266: Pull complete
19ab81b3cf7a: Already exists
Digest: sha256:459df677cbfc29c3ef379050dba34747213c5ccaa81827977bfebbac9abd53bd
Status: Downloaded newer image for jess/visualstudio:latest
a099691d3f4969eccc94e2c9bbc5392d4b08c1f5d5c04d3ca3f4f01020fe18c6
FATA[0125] Error response from daemon: Cannot start container a099691d3f4969eccc94e2c9bbc5392d4b08c1f5d5c04d3ca3f4f01020fe18c6: error gathering device information while adding custom device "/dev/dri": not a device node

When messing around with your Docker images, I wanted to check if a container was completely isolated. I tried it with your Spotify image, as I know Spotify doesn't like being started multiple times.
So I created 2 containers with your Spotify-image, and tried to run them both.
It didn't work :(
Spotify knew there was already a Spotify running. I figured it might be, because both instances were mapped to the same folders on the host, so I changed that. No luck.

Upon googling a bit more, I suspect it's because X11 is used. Do you know how to fix that, or is there a workaround?

Hi, I followed this steps (https://blog.jessfraz.com/post/routing-traffic-through-tor-docker-container/) to get my traffic routed through a Docker container running Tor but, though everything seems to be working nice (iptables rules are loaded with the script you provide and docker log gives no error at all) when I check my connection at https://check.torproject.org/ my IP is still visible.

What can be wrong???

I tested the solution at Ubuntu 14.04, Arch Linux and Debian Jessie with Docker Engine 1.9

I run the container with the command:

docker run -d --net host --restart always --name tor jess/tor

and executing as sudo this script:

#!/bin/bash
# Most of this is credited to
# https://trac.torproject.org/projects/tor/wiki/doc/TransparentProxy
# With a few minor edits

# to run iptables commands you need to be root
if [ "$EUID" -ne 0 ]; then
echo "Please run as root."
return 1
fi

### set variables
# destinations you don't want routed through Tor
_non_tor="192.168.1.0/24 192.168.0.0/24"

# get the UID that Tor runs as
_tor_uid=$(docker exec -u tor tor id -u)

# Tor's TransPort
_trans_port="9040"
_dns_port="5353"

### set iptables *nat
iptables -t nat -A OUTPUT -m owner --uid-owner $_tor_uid -j RETURN
iptables -t nat -A OUTPUT -p udp --dport 53 -j REDIRECT --to-ports $_dns_port

# allow clearnet access for hosts in $_non_tor
for _clearnet in $_non_tor 127.0.0.0/9 127.128.0.0/10; do
iptables -t nat -A OUTPUT -d $_clearnet -j RETURN
done

# redirect all other output to Tor's TransPort
iptables -t nat -A OUTPUT -p tcp --syn -j REDIRECT --to-ports $_trans_port

### set iptables *filter
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# allow clearnet access for hosts in $_non_tor
for _clearnet in $_non_tor 127.0.0.0/8; do
iptables -A OUTPUT -d $_clearnet -j ACCEPT
done

# allow only Tor output
iptables -A OUTPUT -m owner --uid-owner $_tor_uid -j ACCEPT
iptables -A OUTPUT -j REJECT

Hi Jess ! Thank you for your all repository.
I'm trying your virtualbox docker file, but i got this error :

WARNING: The character device /dev/vboxdrv does not exist. Try
sudo /etc/init.d/vboxdrv restart
and if that is not successful, try to re-install the package.
You will not be able to start VMs until this problem is fixed.

I think that The virtualbox driver device must be mounted from host.
Maybe we have to add within the builfile this :

VOLUME /dev/vboxdrv

But don't work too.
I'm still searching :)

Do you think its worth adding xhost local: to the instructions for all X based images?

Thanks,
Dan

Hi Jess,

Sorry to keep raising issues.

This is the result of running your PulseAudio build from the Docker Hub on my system. This is the system which now has a custom kernel with USER_NS enabled.

10:32:27 › docker run -v /etc/localtime:/etc/localtime -p 4713:4713 --device /dev/snd --name pulseaudio jess/pulseaudio
I: [pulseaudio] main.c: setrlimit(RLIMIT_NICE, (31, 31)) failed: Operation not permitted
I: [pulseaudio] main.c: setrlimit(RLIMIT_RTPRIO, (9, 9)) failed: Operation not permitted
D: [pulseaudio] core-rtclock.c: Timer slack is set to 50 us.
E: [pulseaudio] core-util.c: Failed to connect to system bus: Failed to connect to socket /var/run/dbus/system_bus_socket: No such file or directory
E: [pulseaudio] core-util.c: Failed to connect to system bus: Failed to connect to socket /var/run/dbus/system_bus_socket: No such file or directory
E: [pulseaudio] core-util.c: Failed to connect to system bus: Failed to connect to socket /var/run/dbus/system_bus_socket: No such file or directory
E: [pulseaudio] core-util.c: Failed to connect to system bus: Failed to connect to socket /var/run/dbus/system_bus_socket: No such file or directory
E: [pulseaudio] core-util.c: Failed to connect to system bus: Failed to connect to socket /var/run/dbus/system_bus_socket: No such file or directory
E: [pulseaudio] core-util.c: Failed to connect to system bus: Failed to connect to socket /var/run/dbus/system_bus_socket: No such file or directory
E: [pulseaudio] core-util.c: Failed to connect to system bus: Failed to connect to socket /var/run/dbus/system_bus_socket: No such file or directory
E: [pulseaudio] core-util.c: Failed to connect to system bus: Failed to connect to socket /var/run/dbus/system_bus_socket: No such file or directory
E: [pulseaudio] core-util.c: Failed to connect to system bus: Failed to connect to socket /var/run/dbus/system_bus_socket: No such file or directory
E: [pulseaudio] core-util.c: Failed to connect to system bus: Failed to connect to socket /var/run/dbus/system_bus_socket: No such file or directory
E: [pulseaudio] core-util.c: Failed to connect to system bus: Failed to connect to socket /var/run/dbus/system_bus_socket: No such file or directory
I: [pulseaudio] core-util.c: Failed to acquire high-priority scheduling: Input/output error
I: [pulseaudio] main.c: This is PulseAudio 7.0
D: [pulseaudio] main.c: Compilation host: x86_64-pc-linux-gnu
D: [pulseaudio] main.c: Compilation CFLAGS: -g -O2 -fstack-protector-strong -Wformat -Werror=format-security -Wall -W -Wextra -pipe -Wno-long-long -Wno-overlength-strings -Wunsafe-loop-optimizations -Wundef -Wformat=2 -Wlogical-op -Wsign-compare -Wformat-security -Wmissing-include-dirs -Wformat-nonliteral -Wpointer-arith -Winit-self -Wdeclaration-after-statement -Wfloat-equal -Wmissing-prototypes -Wredundant-decls -Wmissing-declarations -Wmissing-noreturn -Wshadow -Wendif-labels -Wcast-align -Wstrict-aliasing -Wwrite-strings -Wno-unused-parameter -ffast-math -fno-common -fdiagnostics-show-option -fdiagnostics-color=auto
D: [pulseaudio] main.c: Running on host: Linux x86_64 4.2.5-1-cellardoor-docker #1 SMP PREEMPT Sun Nov 15 23:51:25 GMT 2015
D: [pulseaudio] main.c: Found 4 CPUs.
I: [pulseaudio] main.c: Page size is 4096 bytes
D: [pulseaudio] main.c: Compiled with Valgrind support: no
D: [pulseaudio] main.c: Running in valgrind mode: no
D: [pulseaudio] main.c: Running in VM: no
D: [pulseaudio] main.c: Optimized build: yes
D: [pulseaudio] main.c: FASTPATH defined, only fast path asserts disabled.
I: [pulseaudio] main.c: Machine ID is fa8e7bd373e24885a0cfb9884acec197.
I: [pulseaudio] main.c: Using runtime directory /home/pulseaudio/.config/pulse/fa8e7bd373e24885a0cfb9884acec197-runtime.
I: [pulseaudio] main.c: Using state directory /home/pulseaudio/.config/pulse.
I: [pulseaudio] main.c: Using modules directory /usr/lib/pulse-7.0/modules.
I: [pulseaudio] main.c: Running in system mode: no
I: [pulseaudio] main.c: Fresh high-resolution timers available! Bon appetit.
D: [pulseaudio] memblock.c: Using shared memory pool with 1024 slots of size 64.0 KiB each, total size is 64.0 MiB, maximum usable slot size is 65472
D: [pulseaudio] memblock.c: Using shared memory pool with 1024 slots of size 64.0 KiB each, total size is 64.0 MiB, maximum usable slot size is 65472
I: [pulseaudio] cpu-x86.c: CPU flags: CMOV MMX SSE SSE2 SSE3 SSSE3 SSE4_1 SSE4_2 
I: [pulseaudio] svolume_mmx.c: Initialising MMX optimized volume functions.
I: [pulseaudio] remap_mmx.c: Initialising MMX optimized remappers.
I: [pulseaudio] svolume_sse.c: Initialising SSE2 optimized volume functions.
I: [pulseaudio] remap_sse.c: Initialising SSE2 optimized remappers.
I: [pulseaudio] sconv_sse.c: Initialising SSE2 optimized conversions.
I: [pulseaudio] svolume_orc.c: Initialising ORC optimized volume functions.
D: [pulseaudio] alsa-util.c: Trying default with SND_PCM_NO_AUTO_FORMAT ...
I: [pulseaudio] (alsa-lib)confmisc.c: cannot find card '0'
I: [pulseaudio] (alsa-lib)conf.c: function snd_func_card_driver returned error: No such file or directory
I: [pulseaudio] (alsa-lib)confmisc.c: error evaluating strings
I: [pulseaudio] (alsa-lib)conf.c: function snd_func_concat returned error: No such file or directory
I: [pulseaudio] (alsa-lib)confmisc.c: error evaluating name
I: [pulseaudio] (alsa-lib)conf.c: function snd_func_refer returned error: No such file or directory
I: [pulseaudio] (alsa-lib)conf.c: Evaluate error: No such file or directory
I: [pulseaudio] (alsa-lib)pcm.c: Unknown PCM default
I: [pulseaudio] alsa-util.c: Error opening PCM device default: No such file or directory
E: [pulseaudio] module.c: Failed to load module "module-alsa-source" (argument: "device="default" tsched=1"): initialization failed.
E: [pulseaudio] main.c: Module load failed.
E: [pulseaudio] main.c: Failed to initialize daemon.
I: [pulseaudio] main.c: Daemon terminated.

It seems to have the most complaints about DBUS files not being available, which makes sense as they are not being passed to the container. Any advice?

Enhancement: Update the TOR version from 4.4.2 to 4.4.3 (the latest version)

https://www.torproject.org/download/download-easy.html.en

Hi Jess:

How are you? I don't know if you're still looking at new issues but am stumped so figured I'd try. I'm trying to get Chrome to run in Docker per https://github.com/jfrazelle/dockerfiles/blob/master/chrome/stable/Dockerfile. My sense is Google has changed how it does sandboxing (and I can get chrome to start with the no sandbox flag).

Per some other posts (https://blog.docker.com/2016/02/docker-engine-1-10-security/, #17 and #65) I believe I need to turn on user namespaces in my kernel (Debian Stretch kernel 4.6.0-1, Docker 1.11.2).

Q1: am I on the right track? It's been a long time since I've added re-compiled a kernel and am hoping to avoid this.

Q: do you know of anyone who has gotten chrome working that might have some scripts I could use to upgrade the kernel?

Thanks....and best wishes.

sudo docker run -it -v /tmp/.X11-unix:/tmp/.X11-unix -e "DISPLAY=unix$DISPLAY" --device /dev/dri/ --name visualstudio jesse/visualstudio
[8:0818/210207:ERROR:browser_main_loop.cc(170)] Running without the SUID sandbox! See https://code.google.com/p/chromium/wiki/LinuxSUIDSandboxDevelopment for more information on developing with the sandbox on.

using docker 1.8.0 on FC22

Hi jess,

As the title said, I'm having a terminal rendering problem with weechat in a container. I already posted this and much more details about it on reddit:

https://www.reddit.com/r/linuxquestions/comments/3ppeli/terminal_rendering_problem_when_running_weechat/

I would be very grateful if you could take a quick look and let me know what you think might be the problem.

Thanks and keep up the good work! :) I have played with docker on my desktop lately and your dockerfiles have been really useful.

Hello @jfrazelle!

First thanks for this awesome tricks!

I'm facing a problem when trying to launch your chrome image with the command line provided in your blog post, here is the error message:

WARNING: Your kernel does not support swap limit capabilities. Limitation discarded.
[1:1:0223/072428:ERROR:browser_main_loop.cc(164)] Running without the SUID sandbox! See https://code.google.com/p/chromium/wiki/LinuxSUIDSandboxDevelopment for more information on developing with the sandbox on.
No protocol specified
[1:1:0223/072428:ERROR:browser_main_loop.cc(210)] Gtk: cannot open display: unix:0

I'm a newbie with docker, can you help me? ;)

Hi Jessie,
inspired by your blog post and the Docker file you are sharing here I wrote this blog post:
https://medium.com/@EliaPalme/scalable-ajax-crawling-on-docker-with-chrome-and-no-display-4560af08dff5#.6tmy1atk0

Maybe this Dockerfile - Gits could be of interest to you:
https://gist.github.com/theely/7ab9eb5a7e4b17c20a170d353324d849

I had this thought inspired by the containerized apps here. Ideally, when trying out a new but trusted app, I would only want to isolate the newly installed libraries and code, but be able to access the whole file system, run it as already existing user, find the PID "normally", etc... Do others share this sentiment ? Is there a framework for this ? I realize this would only use a small subset of what docker does, so it might be an independent project. So conceptually:

1. You specify a list of files/directories that are overlaid and cannot be shared with the host.
2. You specify a list of binaries that need to be started thru a wrapper that sets up the overlay before starting.

Profit. Thoughts ?

Hi Jessica,
Where these options work for many GUI applications:
-v /tmp/.X11-unix:/tmp/.X11-unix \
-v /dev/snd:/dev/snd \
-e DISPLAY=unix$DISPLAY \

this output is the most frequent when it doesn't work:
No protocol specified
<entrypoint>: cannot connect to X server :0.0

Any thoughts on this?

(I hope it is the appropriate place for this question.)

I use a Aladdin eToken with Windows and would also use it with my Linux PC for pubkey ssh auth. Is it possible to create a docker container with Safenet Authentication client / pkiclient for eToken support?

Hi Jessie,
Sorry for using the issue tracker to reach out to you.
I was recently also playing around with running X-Win applications inside docker.
for example
https://github.com/kohlerm/docker-darktable
and
https://github.com/kohlerm/docker-evolution

The issue is that in both cases the application fails to start during the first run, but runs fine when started for the second time.
The same happens with https://hub.docker.com/r/jonadev95/kitematic-docker/.

I'm running docker 1.8.1 on RHEL 7.1 at the moment.

Have you experienced this?
Greetings,
Markus

Hello! This looks cool. Managed to get it running on an Ubuntu 16.04 by using "xhost local:root" from #6, but I'm struggling on a Fedora 24 .. where it still fails with "QXcbConnection: Could not connect to display unix:0", despite xhost local:root (which resolved the same error message on Ubuntu).

I'm assuming that on Fedora security locked down more tight, but don't know where/how.. any clue?

This is NOT through Wayland on Fedora 24, that would be fun too, but later.. ;-) Normal X11 GNOME session.

Hi, thanks for the dockerfiles!

I'm trying to test the atom dockerfile in an ssh session. The server got the image configured but running:

docker run -v /tmp/.X11-unix:/tmp/.X11-unix -e DISPLAY=unix$DISPLAY atom

returns:

18:0422/154056:ERROR:browser_main_loop.cc(203)] Running without the SUID sandbox! See https://code.google.com/p/chromium/wiki/LinuxSUIDSandboxDevelopment for more information on developing with the sandbox on.
[18:0422/154056:ERROR:browser_main_loop.cc(253)] Gtk: cannot open display: unixlocalhost:10.0

Is there anything else I could do in that case?

When I try to run jess/skype it immediately exits, what command am I supposed to use to start it?

$ docker run -it jess/skype
$ docker ps -a
CONTAINER ID        IMAGE               COMMAND             CREATED             STATUS                     PORTS               NAMES
887c009961fd        jess/skype:latest   "skype"             3 seconds ago       Exited (1) 2 seconds ago                       jolly_wright

I've also tried:

$ docker run jess/skype

$ docker run -d jess/skype

$ docker restart <container ID>

$ docker run -it --rm jess/skype

and more, but it just exits.

My docker version:

$ docker --version
Docker version 1.6.2, build 7c8fca2

Hi jess - I am hoping you might expand on the solution noted in closed issue #38 re; pulseaudio crashing (I would also echo how great your container work is!). Am having same trouble as xinity, and am unclear how this was solved. I'm trying to get the Tor and pulseaudio containers to link (in virtualbox Centos 7, Mate VMs). Like xinity, I have pulseaudio running on the host but have tried uninstalling it with no joy. I think pulseaudio is crashing with same errors shown in #38. Did solution "adapt my host config" mean changing the "HostConfig object" in a way that pierces the container and is there a URL you could suggest on how to do this? Does this introduce security issues by having the container use the host in this way and if so, is there another way to get my pulseaudio container to work? I'm using Docker 1.8.3. Thanks!

Hi,

When I start sublime text, I got this error:

Your system's locale is set to a value that can not handle non-ASCII characters. Package Control can not properly work unless this is fixed.

On Linux, please reference your distribution's docs for information on properly setting the LANG environmental variable. As a temporary work-around, you can launch Sublime Text from the terminal with:

LANG=en_US.UTF-8 sublime_text

So I tried to add -e LANG=en_US.UTF-8 in the docker command but I still have the error.

I try to install plugin on sublime text 3 with package control.
But when I do CTRL+SHIFT+P then Install Package nothing append and here is the console stacktrace:

Exception in thread Thread-2:
Traceback (most recent call last):
  File "./threading.py", line 901, in _bootstrap_inner
  File "package_control.commands.install_package_command in /root/.config/sublime-text-3/Installed Packages/Package Control.sublime-package", line 46, in run
  File "package_control.package_installer in /root/.config/sublime-text-3/Installed Packages/Package Control.sublime-package", line 92, in make_package_list
  File "package_control.package_manager in /root/.config/sublime-text-3/Installed Packages/Package Control.sublime-package", line 246, in is_vcs_package
  File "package_control.package_manager in /root/.config/sublime-text-3/Installed Packages/Package Control.sublime-package", line 221, in _is_git_package
  File "./genericpath.py", line 18, in exists
UnicodeEncodeError: 'ascii' codec can't encode character '\xea' in position 78: ordinal not in range(128)

Have you any idea how to fix this ?

I get the following error message:
/usr/local/bin/entrypoint.sh: line 4: ps: command not found

Solution:
apt-get update && apt-get install procps

I have been testing some of these X App images like Chrome and VLC etc.
When I am on a Linux PC and run:

docker run -d -v /tmp/.X11-unix:/tmp/.X11-unix -e DISPLAY=unix$DISPLAY --name chrome jess/chrome

The Chrome app container opens and works perfectly - just as expected.

Sometimes when I am at work I need to test some things by simulating an "outside" connection so when this comes up I use my VPS and generally start a lightweight browser and forward that over X.
i.e.
ssh -X [email protected]
$ midori 2>/dev/null &
That will send Midori to my local PC so I can test some things as if I were outside my network.
I would really love to be able to pull Midori, and all the extra nonsense that it needed, from my VPS and use your Chrome Docker container to simulate the external testing.

However - when I am ssh'd into my VPS and run the same command it does not send Chrome to my local machine.
If I re-run it with -it instead of -d the error I get is:
Gtk: cannot open display: unixlocalhost:10.0
I have tried running: xhost +local:docker
-and-
sudo xhost +local:docker (As seen here: https://registry.hub.docker.com/u/jess/chrome/)
But the error remains.

I guess my first question would be is this something that can be done / accomplished?
And if yes - I am guessing there is some tweaking that needs to be done to my VPS - or there are some different / additional Docker switches that need to be passed to get it to run.

Any help / suggestions would be really appreciated.

Thanks
--Tom

hi,

i'm trying to get pulseaudio working on my fresh ubuntu 14.04 install, but start fails with strange error:
I: [pulseaudio] main.c: setrlimit(RLIMIT_NICE, (31, 31)) failed: Operation not permitted
I: [pulseaudio] main.c: setrlimit(RLIMIT_RTPRIO, (9, 9)) failed: Operation not permitted
D: [pulseaudio] core-rtclock.c: Timer slack is set to 50 us.
E: [pulseaudio] core-util.c: Failed to connect to system bus: Failed to connect to socket /var/run/dbus/system_bus_socket: No such file or directory
E: [pulseaudio] core-util.c: Failed to connect to system bus: Failed to connect to socket /var/run/dbus/system_bus_socket: No such file or directory
E: [pulseaudio] core-util.c: Failed to connect to system bus: Failed to connect to socket /var/run/dbus/system_bus_socket: No such file or directory
E: [pulseaudio] core-util.c: Failed to connect to system bus: Failed to connect to socket /var/run/dbus/system_bus_socket: No such file or directory
E: [pulseaudio] core-util.c: Failed to connect to system bus: Failed to connect to socket /var/run/dbus/system_bus_socket: No such file or directory
E: [pulseaudio] core-util.c: Failed to connect to system bus: Failed to connect to socket /var/run/dbus/system_bus_socket: No such file or directory
E: [pulseaudio] core-util.c: Failed to connect to system bus: Failed to connect to socket /var/run/dbus/system_bus_socket: No such file or directory
E: [pulseaudio] core-util.c: Failed to connect to system bus: Failed to connect to socket /var/run/dbus/system_bus_socket: No such file or directory
E: [pulseaudio] core-util.c: Failed to connect to system bus: Failed to connect to socket /var/run/dbus/system_bus_socket: No such file or directory
E: [pulseaudio] core-util.c: Failed to connect to system bus: Failed to connect to socket /var/run/dbus/system_bus_socket: No such file or directory
E: [pulseaudio] core-util.c: Failed to connect to system bus: Failed to connect to socket /var/run/dbus/system_bus_socket: No such file or directory
I: [pulseaudio] core-util.c: Failed to acquire high-priority scheduling: Input/output error
I: [pulseaudio] main.c: This is PulseAudio 6.0
D: [pulseaudio] main.c: Compilation host: x86_64-pc-linux-gnu
D: [pulseaudio] main.c: Compilation CFLAGS: -g -O2 -fstack-protector-strong -Wformat -Werror=format-security -Wall -W -Wextra -pipe -Wno-long-long -Wno-overlength-strings -Wunsafe-loop-optimizations -Wundef -Wformat=2 -Wlogical-op -Wsign-compare -Wformat-security -Wmissing-include-dirs -Wformat-nonliteral -Wpointer-arith -Winit-self -Wdeclaration-after-statement -Wfloat-equal -Wmissing-prototypes -Wredundant-decls -Wmissing-declarations -Wmissing-noreturn -Wshadow -Wendif-labels -Wcast-align -Wstrict-aliasing -Wwrite-strings -Wno-unused-parameter -ffast-math -fno-common -fdiagnostics-show-option -fdiagnostics-color=auto
D: [pulseaudio] main.c: Running on host: Linux x86_64 3.16.0-41-generic #57~14.04.1-Ubuntu SMP Thu Jun 18 18:01:13 UTC 2015
D: [pulseaudio] main.c: Found 4 CPUs.
I: [pulseaudio] main.c: Page size is 4096 bytes
D: [pulseaudio] main.c: Compiled with Valgrind support: no
D: [pulseaudio] main.c: Running in valgrind mode: no
D: [pulseaudio] main.c: Running in VM: no
D: [pulseaudio] main.c: Optimized build: yes
D: [pulseaudio] main.c: FASTPATH defined, only fast path asserts disabled.
I: [pulseaudio] main.c: Machine ID is c13e7e2624cc4eb7979db4ae87de51f9.
I: [pulseaudio] main.c: Using runtime directory /home/pulseaudio/.config/pulse/c13e7e2624cc4eb7979db4ae87de51f9-runtime.
I: [pulseaudio] main.c: Using state directory /home/pulseaudio/.config/pulse.
I: [pulseaudio] main.c: Using modules directory /usr/lib/pulse-6.0/modules.
I: [pulseaudio] main.c: Running in system mode: no
I: [pulseaudio] main.c: Fresh high-resolution timers available! Bon appetit!
D: [pulseaudio] memblock.c: Using shared memory pool with 1024 slots of size 64.0 KiB each, total size is 64.0 MiB, maximum usable slot size is 65472
D: [pulseaudio] memblock.c: Using shared memory pool with 1024 slots of size 64.0 KiB each, total size is 64.0 MiB, maximum usable slot size is 65472
I: [pulseaudio] cpu-x86.c: CPU flags: CMOV MMX SSE SSE2 SSE3 SSSE3 SSE4_1 SSE4_2
I: [pulseaudio] svolume_mmx.c: Initialising MMX optimized volume functions.
I: [pulseaudio] remap_mmx.c: Initialising MMX optimized remappers.
I: [pulseaudio] svolume_sse.c: Initialising SSE2 optimized volume functions.
I: [pulseaudio] remap_sse.c: Initialising SSE2 optimized remappers.
I: [pulseaudio] sconv_sse.c: Initialising SSE2 optimized conversions.
I: [pulseaudio] svolume_orc.c: Initialising ORC optimized volume functions.
D: [pulseaudio] alsa-util.c: Trying default with SND_PCM_NO_AUTO_FORMAT ...
I: pulseaudiopcm_hw.c: open '/dev/snd/pcmC0D0c' failed (-2)
I: pulseaudiopcm_dsnoop.c: unable to open slave
I: [pulseaudio] alsa-util.c: Error opening PCM device default: No such file or directory
E: [pulseaudio] module.c: Failed to load module "module-alsa-source" (argument: "device="default" tsched=1"): initialization failed.
E: [pulseaudio] main.c: Module load failed.
E: [pulseaudio] main.c: Failed to initialize daemon.
I: [pulseaudio] main.c: Daemon terminated

and container keep restarting over and over :(

did i miss something ?

thanks a lot for your awesome container work !

Hi Jess!!
First of all, thanks for shared your dockerized desktop apps!! And nice post!!

Then, I have some thoughts about running desktop apps in docker (even if I really like the idea and find it extremely useful).

First, the size: a chrome binary is ~100 MB while your chrome docker image is ~700MB. But I can deal with it if I only need to dockerize few apps.

The second issue, that is about docker itself, is the fact it runs as root. I understand it is necessary to have the docker daemon running as root, but having the containers too as root can be a problem. You need to be able to be root (or sudoer) to run and kill the dockerized apps. Another example is that if I download something from your dockerized chrome I am not able to open it. Chrome responds

Please start Google Chrome as a normal user. To run as root, you must specify an alternate --user-data-dir for storage of profile information.

Am I missing something?

When I run a docker build -t jaren/spotify . I get the below error:

returned a non-zero code: 100

A simple update of apt-get install to include include -force-yes -y.

• Example apt-get install --force-yes -y

Let me know if you need anymore information -- will be sending a PR. Let me know, if you prefer for my changes to not be container specific.

Hi everyone,

@jfrazelle nice done! Thanks for sharing your dockerfiles so we can learn from them.

Now, Skype refuses to validate my credentials stating that the password or username are invalid - which is weird as that very same credentials works as expected on both locally-installed Skype copies and the web interface.

I tried to log into an interactive shell to debug the issue but 'run -ti jess/skype /bin/bash' won't connect either.

I would gladly appreciate if anyone can help me point to the right direction in order to debug this issue.

B.R.

I get this nice little error message when attempting to run spotify on a 15.04 system:

FATA[0000] Error response from daemon: Cannot start container 05b351ea134e190cb09465658c2b50f5880be3184bfc2ee7a17797ec2a7319da: error gathering device information while adding custom device "/dev/snd": not a device node 

Any advice on how to fix this? :)

It would be nice to have a README.md for each application that included a command-line to run the application in a container (esp. the gui apps).

Another suggestion, would be to have an app-name.sh shell script that ran said command.