如何以非特权用户身份运行 docker CMD 命令？

Question

我正在尝试对需要 puppeteer 的应用进行 docker 化，但在运行我的应用时出现以下错误：

Launching Browser
/usr/src/app/node_modules/puppeteer/lib/cjs/puppeteer/node/BrowserRunner.js:229
reject(new Error([

^

Error: Failed to launch the browser process!

[0204/174647.675714:ERROR:zygote_host_impl_linux.cc(90)] Running as root without --no-sandbox is not supported. See https://crbug.com/638180.



TROUBLESHOOTING: https://github.com/puppeteer/puppeteer/blob/main/docs/troubleshooting.md

at onClose (/usr/src/app/node_modules/puppeteer/lib/cjs/puppeteer/node/BrowserRunner.js:229:20)
at Interface.<anonymous> (/usr/src/app/node_modules/puppeteer/lib/cjs/puppeteer/node/BrowserRunner.js:219:68)
at Interface.emit (node:events:402:35)
at Interface.close (node:readline:586:8)
at Socket.onend (node:readline:277:10)
at Socket.emit (node:events:402:35)
at endReadableNT (node:internal/streams/readable:1343:12)
at processTicksAndRejections (node:internal/process/task_queues:83:21)

这是我的 dockerfile：

FROM node:16
WORKDIR /usr/src/app
COPY . .

# Do stuff that puppeteer requires for some reason
RUN apt-get update \
    && apt-get install -y wget gnupg \
    && wget -q -O - https://dl-ssl.google.com/linux/linux_signing_key.pub | apt-key add - \
    && sh -c 'echo "deb [arch=amd64] http://dl.google.com/linux/chrome/deb/ stable main" >> /etc/apt/sources.list.d/google.list' \
    && apt-get update \
    && apt-get install -y google-chrome-stable fonts-ipafont-gothic fonts-wqy-zenhei fonts-thai-tlwg fonts-kacst fonts-freefont-ttf libxss1 \
      --no-install-recommends \
    && rm -rf /var/lib/apt/lists/*
    
# Insall other deps
RUN apt-get update && apt-get install -y imagemagick ghostscript
RUN npm ci
CMD ["node","index.js"]

我需要做什么才能让 dockerfile 的 CMD 命令以非特权用户身份运行？我已经尝试在我的浏览器上启用no-sandbox

const browser = await puppeteer.launch({
        defaultViewport: { width: 1920, height: 1080 },
        headless: true,
        args:['no-sandbox']
    });

Answer 1

Dockerfile 中的所有当前语句均由 root 用户执行。您应该在目标指令之前定义指定非 root 用户的 USER 指令。您可以根据需要在Dockerfile 中多次使用USER。

在node 图像中，通常可以使用同名的node 用户；因此，您的 Dockerfile 可能如下所示以非 root 用户 node 运行 CMD：

[..]

# Insall other deps
RUN apt-get update && apt-get install -y imagemagick ghostscript
RUN npm ci
USER node
CMD ["node","index.js"]