如何以非特權用戶身份運行 docker CMD 命令？

Question

我正在嘗試對需要 puppeteer 的應用程序進行 docker 化，但在運行我的應用程序時出現以下錯誤：

Launching Browser
/usr/src/app/node_modules/puppeteer/lib/cjs/puppeteer/node/BrowserRunner.js:229
reject(new Error([

^

Error: Failed to launch the browser process!

[0204/174647.675714:ERROR:zygote_host_impl_linux.cc(90)] Running as root without --no-sandbox is not supported. See https://crbug.com/638180.



TROUBLESHOOTING: https://github.com/puppeteer/puppeteer/blob/main/docs/troubleshooting.md

at onClose (/usr/src/app/node_modules/puppeteer/lib/cjs/puppeteer/node/BrowserRunner.js:229:20)
at Interface.<anonymous> (/usr/src/app/node_modules/puppeteer/lib/cjs/puppeteer/node/BrowserRunner.js:219:68)
at Interface.emit (node:events:402:35)
at Interface.close (node:readline:586:8)
at Socket.onend (node:readline:277:10)
at Socket.emit (node:events:402:35)
at endReadableNT (node:internal/streams/readable:1343:12)
at processTicksAndRejections (node:internal/process/task_queues:83:21)

這是我的 dockerfile：

FROM node:16
WORKDIR /usr/src/app
COPY . .

# Do stuff that puppeteer requires for some reason
RUN apt-get update \
    && apt-get install -y wget gnupg \
    && wget -q -O - https://dl-ssl.google.com/linux/linux_signing_key.pub | apt-key add - \
    && sh -c 'echo "deb [arch=amd64] http://dl.google.com/linux/chrome/deb/ stable main" >> /etc/apt/sources.list.d/google.list' \
    && apt-get update \
    && apt-get install -y google-chrome-stable fonts-ipafont-gothic fonts-wqy-zenhei fonts-thai-tlwg fonts-kacst fonts-freefont-ttf libxss1 \
      --no-install-recommends \
    && rm -rf /var/lib/apt/lists/*
    
# Insall other deps
RUN apt-get update && apt-get install -y imagemagick ghostscript
RUN npm ci
CMD ["node","index.js"]

我需要做什么才能讓 dockerfile 的 CMD 命令以非特權用戶身份運行？ 我已經嘗試在我的瀏覽器上啟用no-sandbox

const browser = await puppeteer.launch({
        defaultViewport: { width: 1920, height: 1080 },
        headless: true,
        args:['no-sandbox']
    });

Answer 1

Dockerfile中的所有當前語句均由 root 用戶執行。 您應該在目標指令之前定義指定非 root 用戶的USER指令。 您可以根據需要在Dockerfile中多次使用USER 。

在node映像中，通常同名node用戶可用； 因此，您的Dockerfile可能如下所示以使用非node用戶運行CMD ：

[..]

# Insall other deps
RUN apt-get update && apt-get install -y imagemagick ghostscript
RUN npm ci
USER node
CMD ["node","index.js"]