CRT/storebound
1
0
Fork 0
Code Issues Pull requests Releases 1 Packages 1 Activity Actions

ci on Linux: --no-sandbox for the Chromium storebound starts itself as root on Linux or in a container (sandboxArgs; Chromium refuses root without it), never on macOS / Windows / a normal user; workflow caches Playwright's browsers; capture-web prints the capture's stderr when a run fails

Browse source
This commit is contained in:
CRTkafa 2026-10-13 02:51:48 +08:00
parent 8c7274edcc
commit 56591f4118
5 changed files with 42 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

12
cli/shots/browser.ts
View file

@ -60,6 +60,18 @@ export interface Candidate {
opts: Record<string, unknown>;
}
/**
* Switches for a Chromium storebound starts itself (Bun.spawn, not Playwright's launch, which already passes
* --no-sandbox unless chromiumSandbox is set): Chromium refuses to run as root on Linux without --no-sandbox
* ("Running as root without --no-sandbox is not supported", crbug.com/638180), and inside a Docker / Podman container
* its user-namespace sandbox is usually blocked by seccomp, so CI containers (the Forgejo runner runs jobs as root)
* need it too. Never on macOS or Windows, never for a normal user outside a container.
*/
export function sandboxArgs(platform: string = process.platform, uid: number | undefined = process.getuid?.(), inContainer: () => boolean = runsInContainer): string[] {
return platform === 'linux' && (uid === 0 || inContainer()) ? ['--no-sandbox'] : [];
}
const runsInContainer = (): boolean => existsSync('/.dockerenv') || existsSync('/run/.containerenv');
/** Where Playwright's channel "chrome" finds Google Chrome (stable). */
export function chromeChannelPaths(platform: string = process.platform, env: Record<string, string | undefined> = process.env): string[] {
if (platform === 'darwin') return ['/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'];