[🐛 Bug]: Standalone Chrome does not work with readOnlyRootFilesystem = true on Kubernetes #2648
Comments
|
@majusmisiak, thank you for creating this issue. We will troubleshoot it as soon as we can. Info for maintainersTriage this issue by using labels.
If information is missing, add a helpful comment and then
If the issue is a question, add the
If the issue is valid but there is no time to troubleshoot it, consider adding the
If the issue requires changes or fixes from an external project (e.g., ChromeDriver, GeckoDriver, MSEdgeDriver, W3C),
add the applicable
After troubleshooting the issue, please add the Thank you! |
|
I think this is similar to this #2382, which is still not support fully. |
What happened?
I am attempting to run Selenium inside security hardened Kubernetes cluster. Current policy does now allow read-write access to the root filesystem of the container.
After deploying Selenium with read-only filesystem, the container will run, but it is not possible to connect to it using external client.
The only breaking flag in below configuration is
If I deploy exact same configuration as attached below, just changing the flag to
false, everything will work fine.It seems that Selenium container under the hood writes (unrestricted) to all kind of various filesystem paths. So this issue could be solved by allowing specify separate list of
emptyDirvolumes mounted in all locations that selenium container writes / caches data to. Searching through the documentation and open issues on github, I did not found a list of folders that Selenium container is writing to, and the purpose of each writable volume. Please assist :)Reproduction - deploy selenium using attached manifest, then run following script:
Client:
Result:
Command used to start Selenium Grid with Docker (or Kubernetes)
--- apiVersion: apps/v1 kind: Deployment metadata: labels: app.kubernetes.io/component: run app.kubernetes.io/name: chromedriver name: chromedriver spec: replicas: 1 selector: matchLabels: app.kubernetes.io/component: run app.kubernetes.io/name: chromedriver strategy: rollingUpdate: null type: Recreate template: metadata: labels: app.kubernetes.io/component: run app.kubernetes.io/name: chromedriver spec: containers: - env: - name: "SCREEN_WIDTH" value: "1920" - name: "SCREEN_HEIGHT" value: "1080" - name: "SCREEN_DEPTH" value: "24" - name: "SE_NODE_GRID_URL" value: "http://localhost:4444" - name: "SE_NODE_SESSION_TIMEOUT" value: "600" - name: "SE_ENABLE_TRACING" value: "false" - name: "SE_NEW_SESSION_THREAD_POOL_SIZE" value: "32" - name: "SE_NODE_OVERRIDE_MAX_SESSIONS" value: "true" - name: "SE_NODE_MAX_SESSIONS" value: "4" - name: "JAVA_OPTS" value: "-XX:ActiveProcessorCount=4" - name: "SEL_UID" value: "1200" - name: "SEL_GID" value: "1201" image: selenium/standalone-chrome:4.28.1-20250202 imagePullPolicy: "Always" name: "selenium" ports: - containerPort: 4444 protocol: "TCP" resources: limits: memory: "4Gi" cpu: "2000m" ephemeral-storage: "2Gi" requests: memory: "4Gi" cpu: "500m" ephemeral-storage: "2Gi" securityContext: allowPrivilegeEscalation: false capabilities: drop: - "ALL" readOnlyRootFilesystem: true runAsGroup: 1201 runAsNonRoot: true runAsUser: 1200 seccompProfile: type: "RuntimeDefault" volumeMounts: - mountPath: "/dev/shm" name: "dshm" - mountPath: "/tmp" name: "tmp" nodeSelector: kubernetes.io/os: "linux" restartPolicy: "Always" securityContext: fsGroup: 1201 runAsGroup: 1201 runAsNonRoot: true runAsUser: 1200 volumes: - emptyDir: {} name: "tmp" - emptyDir: medium: "Memory" sizeLimit: "2Gi" name: "dshm"Relevant log output
Operating System
Kubernetes Server Version: v1.29.4+vmware.3-fips.1
Docker Selenium version (image tag)
4.28.1-20250202
Selenium Grid chart version (chart version)
Standalone (no chart)
The text was updated successfully, but these errors were encountered: