Use ROOT 6.26/00's RBrowser in Docker container with chromium --no-sandbox

[feickert]

Hi. ROOT v6.26/00 introduced RBrowser as the default browser

Starting from ROOT version 6.26/00, RBrowser is the first web-based component used by default when ROOT is built with root7 . It is automatically invoked with new TBrowser . We recommend to install the chrome/chromium web browser, but all other web browsers should do the job

This seems pretty nice. However, if I take an existing Docker image that I’ve been able to use TBrowser with X11 Forwarding, and install chromium in it

# Dockerfile
FROM atlasamglab/stats-base:root6.26.00 as base

RUN apt-get update && \
    apt-get -y install --no-install-recommends \
        chromium && \
    apt-get -y autoclean && \
    apt-get -y autoremove && \
    rm -rf /var/lib/apt/lists/*

RUN echo 'WebGui.HttpPort: 8088' > ~/.rootrc

docker build -f Dockerfile -t feickert/rootforum:debug .

, then I run into a problem as chromium complains that it can’t run if the user is root unless run with --no-sandbox.

# run.sh
xhost +
docker run --rm -ti \
    -e DISPLAY="${DISPLAY}" \
    -v /tmp/.X11-unix:/tmp/.X11-unix \
    -v /tmp/"krb5cc_$(id -u ${USER})":/tmp/krb5cc_0 \
    -v /tmp/:/tmp/ \
    -v "${HOME}":"${HOME}" \
    -p 8088:8088 \
    feickert/rootforum:debug

$ bash run.sh
root@e1459ebab32c:~/data# root
   ------------------------------------------------------------------
  | Welcome to ROOT 6.26/00                        https://root.cern |
  | (c) 1995-2021, The ROOT Team; conception: R. Brun, F. Rademakers |
  | Built for linuxx8664gcc on Mar 10 2022, 18:49:00                 |
  | From tags/v6-26-00@v6-26-00                                      |
  | With c++ (Debian 10.2.1-6) 10.2.1 20210110                       |
  | Try '.help', '.demo', '.license', '.credits', '.quit'/'.q'       |
   ------------------------------------------------------------------

root [0] TBrowser b

ROOT comes with a web-based browser, which is now being started. 
Revert to TBrowser by setting "Browser.Name: TRootBrowser" in rootrc file or
by starting "root --web=off"
Find more info on https://root.cern/for_developers/root7/#rbrowser
Info in <THttpEngine::Create>: Starting HTTP server on port 8088
[46:46:0315/032710.784859:ERROR:zygote_host_impl_linux.cc(90)] Running as root without --no-sandbox is not supported. See https://crbug.com/638180.
(TBrowser &) Name: Browser Title: ROOT Object Browser

I can still follow the instructions given in the error message to get TBrowser over X11, and I’m able to launch a chromium session with chromium --no-sandbox, but as I have pretty limited experience with actually controlling browsers from anything other than Selenium I’m not sure how I would force chromium to run with --no-sandbox when it is called by ROOT. Any thoughts?

---

ROOT Version: v6.26/00

$ root --version
ROOT Version: 6.26/00
Built for linuxx8664gcc on Mar 10 2022, 18:49:00
From tags/v6-26-00@v6-26-00

Platform: Debian

$ cat /etc/os-release 
PRETTY_NAME="Debian GNU/Linux 11 (bullseye)"
NAME="Debian GNU/Linux"
VERSION_ID="11"
VERSION="11 (bullseye)"
VERSION_CODENAME=bullseye
ID=debian
HOME_URL="https://www.debian.org/"
SUPPORT_URL="https://www.debian.org/support"
BUG_REPORT_URL="https://bugs.debian.org/"

Compiler: g++ v10.2.1-6

$ root-config --cflags
-pthread -std=c++17 -m64 -D__ROOFIT_NOBANNER -I/usr/local/venv/include
# g++ --version | head -n 1
g++ (Debian 10.2.1-6) 10.2.1 20210110

---

[couet]

I guess @linev can help you.

[linev]

Hi,

--no-sandbox option can be specified in rootrc file.
Just create .rootrc file where you starting ROOT:

WebGui.ChromeInteractive: $prog $geometry --new-window --no-sandbox --app='$url' &

But you also can use web browser on your host and forward http port from docker container.
Just add in .rootrc file:

WebGui.HttpPort: 9200

And start root with arguments root --web=server
If you now forward 9200 from docker to your host, you should be able to use your own web browser.
With current master and v6-26-00-patches branch one can call root --web=server:9200 without editing rootrc file.

Regards,
Sergey

[feickert]

@linev If I take the Docker image I described in my question that has WebGui.HttpPort: 8088 described in the ~/.rootrc already

$ bash run.sh 
access control disabled, clients can connect from any host
root@763965ea64d7:~/data# cat ~/.rootrc 
WebGui.HttpPort: 8088
root@763965ea64d7:~/data# root --web=server
   ------------------------------------------------------------------
  | Welcome to ROOT 6.26/00                        https://root.cern |
  | (c) 1995-2021, The ROOT Team; conception: R. Brun, F. Rademakers |
  | Built for linuxx8664gcc on Mar 10 2022, 18:49:00                 |
  | From tags/v6-26-00@v6-26-00                                      |
  | With c++ (Debian 10.2.1-6) 10.2.1 20210110                       |
  | Try '.help', '.demo', '.license', '.credits', '.quit'/'.q'       |
   ------------------------------------------------------------------

root [0] TBrowser b

ROOT comes with a web-based browser, which is now being started. 
Revert to TBrowser by setting "Browser.Name: TRootBrowser" in rootrc file or
by starting "root --web=off"
Find more info on https://root.cern/for_developers/root7/#rbrowser
Info in <THttpEngine::Create>: Starting HTTP server on port 8088
New web window: http://localhost:8088/win1/
(TBrowser &) Name: Browser Title: ROOT Object Browser
root [1] 

when I open the URL locally on my machine I get

This localhost page can’t be found
No webpage was found for the web address: http://localhost:8088/win1/
HTTP ERROR 404

I think this might be something on my side though, as if I install JupyterLab I’m also unable to open it (which should work given the ports I’m exposing).

[linev]

Hi,

Most probably you missing port 8088 forwarding from docker to your host machine.

[feickert]

No, see my first post where I show I’m passing -p 8088:8088 in at the docker run command.

[linev]

Strange.
Can you just check that http server is running inside docker. Like:
wget http://localhost:8088.
And the same on your host?