feat(virtual-browser-jupyter): add managed Chromium policy and pin base image - #464
Draft
june-hua wants to merge 2 commits into
Draft
feat(virtual-browser-jupyter): add managed Chromium policy and pin base image#464june-hua wants to merge 2 commits into
june-hua wants to merge 2 commits into
Conversation
…se image - Add policies/managed-policy.json and bake it into the browser image at /etc/chromium/policies/managed/workbench-rbi.json. - Pin lscr.io/linuxserver/chromium by digest and register it in feature-versions/state.json so update.sh keeps it current. - Run Chromium in app mode against the JupyterLab URL via CHROME_CLI. - Make the browser the served app: shmSize/memoryLimit now apply to the application-server (browser) container, and jupyterlab publishes no ports. - Give the template its own id/name/description and a user-facing README.
Chromium's remote debugging interface is not enabled by default in this image, but the policy is the durable place to keep it off: it overrides command-line flags, so the debug port stays closed even if --remote-debugging-port is added later. Verified against the built image that Chromium refuses to open the port when explicitly forced. Note --remote-debugging-address makes the port bind 0.0.0.0 rather than loopback, so this matters wherever the container shares a network with other containers.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stacks on #463. Adds the Chromium configuration that template was missing, pins the base image into
the repo's version-tracking system, and fixes a couple of template-metadata issues.
Changes
policies/managed-policy.json(new) — a managed Chromium enterprise policy, copied into/etc/chromium/policies/managed/inbrowser.Dockerfile. Chromium reads every*.jsonin thatdirectory at startup and applies it as immutable, so these settings can't be changed from within
the session. Configures the session as a single-purpose app view: navigation pinned to the app URL,
downloads/printing/file-dialogs off, devtools and extensions off, clipboard and popups off.
It's baked into the image deliberately rather than mounted — the compose context is mounted as the
user's writable workspace, so a mounted policy file would be editable from inside the session.
Base image pinned —
lscr.io/linuxserver/chromium@sha256:4c7b9086…instead of:latest, with amatching entry in
feature-versions/state.jsonsoupdate.shtracks it. Note the existingsrc/.*/Dockerfilefilters do not matchbrowser.Dockerfile, so a dedicated entry with its ownfilter is required.
docker-compose.yaml— movedshm_size/mem_limitonto theappservice. Those templateoptions are computed by
050-parse-devcontainer.shfor the container namedapplication-server,which is the browser; Chromium is also the container that actually needs the shared memory. Added
--app=/--force-app-mode/--start-fullscreentoCHROME_CLI, keeping the existing proxyrestriction.
Template metadata —
devcontainer-template.jsonhadid: "custom-workbench-jupyter-template"copied from another template, which collides with two existing directories and would conflict on
publish. Gave it its own id/name/description.
README.md— operational documentation for the template: what it is, which browser featuresare unavailable, how to point it at a different app, how to build locally.
Verified
Built the image locally: the pinned digest resolves and pulls, and the policy file is present at
/etc/chromium/policies/managed/workbench-rbi.jsonin the built image.Needs review / testing
DefaultClipboardSetting: 2may also block pasting into the session. Worth testing beforethis leaves draft — researchers paste code frequently and that would be daily friction.
URLAllowlistmust stay in sync with theCHROME_CLIapp URL. Changing one without the otherbreaks navigation. Possible follow-up: derive both from a single template option.
generator workflow is
workflow_dispatch-only and last ran in March 2024. I hand-wrote this READMEand dropped the footer rather than leave an inaccurate claim. If you'd prefer to keep it
regeneration-safe, the prose should move to
NOTES.mdinstead — happy to switch.