You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
77 lines
3.8 KiB
77 lines
3.8 KiB
# LibreWolf, displayed on a remote desktop through waypipe (Wayland over SSH).
|
|
#
|
|
# waypipe is installed *here* rather than on the Fedora CoreOS host: the waypipe
|
|
# server has to share a mount namespace with the browser (it creates the Wayland
|
|
# socket the browser connects to), and putting it in the image keeps the host a
|
|
# stock, immutable CoreOS with no layered packages. It also pins the waypipe
|
|
# version, which matters: waypipe 0.9 (C) and 0.10+ (Rust) do not interoperate,
|
|
# and the client and server versions have to match.
|
|
FROM quay.io/fedora/fedora:44
|
|
|
|
COPY librewolf.repo /etc/yum.repos.d/librewolf.repo
|
|
|
|
# The font set is pinned explicitly and must stay identical across rebuilds: the
|
|
# list of installed fonts is a fingerprinting vector, and a set that drifts every
|
|
# night would make this browser a little more recognisable every day.
|
|
#
|
|
# mesa-dri-drivers provides llvmpipe -- there is no GPU in this VM.
|
|
#
|
|
# The icon theme, the extra gdk-pixbuf loaders and the MIME database are weak
|
|
# dependencies, and they are not optional here: without them GTK cannot resolve
|
|
# an icon, falls back to image-missing.svg, fails to load that too, and aborts
|
|
# the whole browser with
|
|
# "Gtk:ERROR:gtkiconhelper.c:495:ensure_surface_for_gicon: assertion failed".
|
|
RUN dnf install -y --setopt=install_weak_deps=False \
|
|
librewolf \
|
|
waypipe \
|
|
adwaita-icon-theme \
|
|
hicolor-icon-theme \
|
|
gdk-pixbuf2-modules-extra \
|
|
shared-mime-info \
|
|
util-linux \
|
|
dejavu-sans-fonts dejavu-serif-fonts dejavu-sans-mono-fonts \
|
|
liberation-sans-fonts liberation-serif-fonts liberation-mono-fonts \
|
|
google-noto-color-emoji-fonts \
|
|
mesa-dri-drivers \
|
|
&& dnf clean all \
|
|
&& rm -rf /var/cache/dnf
|
|
|
|
# See the header of itix-hardening.cfg for why this is appended to LibreWolf's
|
|
# own AutoConfig file instead of living in librewolf.overrides.cfg (which would
|
|
# sit in the persistent profile volume and escape the nightly rebuild).
|
|
COPY itix-hardening.cfg /tmp/itix-hardening.cfg
|
|
RUN cat /tmp/itix-hardening.cfg >> /usr/share/librewolf/librewolf.cfg \
|
|
&& rm -f /tmp/itix-hardening.cfg
|
|
|
|
# Two sandboxes fight over CAP_SYS_CHROOT in here, and setpriv (util-linux) is
|
|
# what reconciles them:
|
|
#
|
|
# - Firefox's content sandbox chroots itself. It does so inside a fresh user
|
|
# namespace, where it holds every capability still present in the *bounding*
|
|
# set -- so CAP_SYS_CHROOT has to be in the bounding set, or content
|
|
# processes die with "Sandbox: chroot: EPERM".
|
|
# - bubblewrap, which glycin (Fedora's SVG image loader) uses, refuses to run
|
|
# at all when the calling process holds capabilities without being setuid:
|
|
# "bwrap: Unexpected capabilities but not setuid, old file caps config?".
|
|
# GTK then fails to load an icon and aborts the browser.
|
|
#
|
|
# podman's --cap-add puts the capability in the *ambient* set too when the
|
|
# container runs as a non-root user, which is exactly what bubblewrap objects
|
|
# to. Dropping ambient and inheritable capabilities needs no privilege, and
|
|
# leaves the bounding set untouched, so both sandboxes get what they want.
|
|
ENTRYPOINT [ "/usr/bin/setpriv", "--inh-caps=-all", "--ambient-caps=-all", "--" ]
|
|
|
|
# XDG_RUNTIME_DIR for the browser user: waypipe creates its Wayland socket in
|
|
# there. podman does not mount a tmpfs over /run, so a directory baked into the
|
|
# image with the right ownership is writable, and disappears with the container.
|
|
#
|
|
# The uid/gid are hardcoded, like everywhere else in this cookbook; they have to
|
|
# match BROWSER_UID/BROWSER_GID in browser.conf.
|
|
RUN install -d -m 0755 -o root -g root /run/user \
|
|
&& install -d -m 0700 -o 10017 -g 10000 /run/user/10017
|
|
|
|
# The profile and the download directory are bind-mounted at run time.
|
|
VOLUME /home/browser /downloads
|
|
|
|
# The shim runs "waypipe ... server -- librewolf" through the entrypoint above.
|
|
CMD [ "librewolf" ]
|
|
|