Repository navigation
[BUG] Document Chromium sandbox failure with Docker default seccomp profile #447
Description
Is there an existing issue for this?
- I have searched the existing issues
Current Behavior
On Debian 13 with Docker Engine 29.2.1 and lscr.io/linuxserver/webtop:debian-kde, Chromium failed to start with “No usable sandbox.”
During the debug session, the chromium-sandbox package was installed, but the failure persisted. With Docker’s default seccomp profile, strace showed:
clone(..., flags=CLONE_NEWUSER|SIGCHLD) = -1 EPERM
Temporarily setting seccomp:unconfined allowed Chromium to start. Instead, I copied Docker’s default seccomp profile and added a rule allowing clone only when its flags argument is CLONE_NEWUSER | SIGCHLD; Chromium then started with seccomp enabled.
here is the webtop-seccomp.json I used
{
"names": [
"clone"
],
"action": "SCMP_ACT_ALLOW",
"args": [
{
"index": 0,
"value": 268435473,
"op": "SCMP_CMP_EQ"
}
]
}And in the compose.yml I added this to the webtop service
security_opt:
- seccomp:./webtop-seccomp.jsonNote: This profile is clearly a host-side, version/architecture-dependent workaround
Could the Webtop documentation mention this failure mode and explain the safer custom-profile approach.
Expected Behavior
No response
Steps To Reproduce
start the lscr.io/linuxserver/webtop:debian-kde image
in a terminal run chromium
see error
ERROR:content/browser/zygote_host/zygote_host_impl_linux.cc:130] No usable sandbox! If this is a Debian system, please install the chromium-sandbox package to solve this problem. If you are running on Ubuntu 23.10+ or another Linux distro that has disabled unprivileged user namespaces with AppArmor, see https://chromium.googlesource.com/chromium/src/+/main/docs/security/apparmor-userns-restrictions.md. If you want to live dangerously and need an immediate workaround, you can try using --no-sandbox.
Environment
- OS: macosx
- How docker service was installed: colimaCPU architecture
arm64
Docker creation
---
services:
webtop:
image: lscr.io/linuxserver/webtop:debian-kde
container_name: webtop
environment:
- PUID=501
- PGID=20
- TZ=Etc/UTC
volumes:
- ./config:/config
ports:
- 3000:3000
- 3001:3001
shm_size: "1gb"
restart: unless-stoppedContainer logs
[migrations] started
[migrations] no migrations found
───────────────────────────────────────
██╗ ███████╗██╗ ██████╗
██║ ██╔════╝██║██╔═══██╗
██║ ███████╗██║██║ ██║
██║ ╚════██║██║██║ ██║
███████╗███████║██║╚██████╔╝
╚══════╝╚══════╝╚═╝ ╚═════╝
Brought to you by linuxserver.io
───────────────────────────────────────
To support LSIO projects visit:
https://www.linuxserver.io/donate/
───────────────────────────────────────
GID/UID
───────────────────────────────────────
User UID: 501
User GID: 20
───────────────────────────────────────
[ls.io-init] Creating initial backup of system rc.xml
[custom-init] No custom files found, skipping...
[ls.io-init] done.
17
18
[X11] Configuring Output: 1760x1804 @ 60.00 FPS (Encode Node: -2)
[X11] Zero-copy capture (NvFBC) unavailable: the X server offers no NV-GLX.
[X11] Zero-copy capture (DRI3) unavailable: encode node 0 has no readable render node; capturing through XShm.
[X11] Encoder: software H264 (x264) 4:2:0 8-bit, 3 threads.
[X11] Stream settings active -> Res: 1760x1804 | FPS: 60.0 | Encoder: CPU (x264) | Mode: H264 | CRF: 25 | PaintOver CRF: 18 (Burst: 5f) | Colorspace: I420 (Limited Range) | Damage Thresh: 10f | Damage Dur: 20f
[pcmflux] SUCCESS: Opus encoder created (2 ch).
[pcmflux] Capture loop started. Device: output.monitor, Rate: 48000, Channels: 2, Bitrate: 128 kbps, VBR: On, Silence Gate: On
[X11] Configuring Output: 1760x1804 @ 60.00 FPS (Encode Node: -2)
[X11] Zero-copy capture (NvFBC) unavailable: the X server offers no NV-GLX.
[X11] Zero-copy capture (DRI3) unavailable: encode node 0 has no readable render node; capturing through XShm.
[X11] Encoder: software H264 (x264) 4:2:0 8-bit, 3 threads.
[X11] Stream settings active -> Res: 1760x1804 | FPS: 60.0 | Encoder: CPU (x264) | Mode: H264 | CRF: 25 | PaintOver CRF: 18 (Burst: 5f) | Colorspace: I420 (Limited Range) | Damage Thresh: 10f | Damage Dur: 20f
[pcmflux] First non-silent audio chunk detected! Encoding...
[pcmflux] Stop requested. Cleaning up capture loop...
[pcmflux] Audio capture loop finished. Resources released.
Activity
github-actions commentedon Nov 1, 2026
Thanks for opening your first issue here! Be sure to follow the relevant issue templates, or risk having this issue marked as invalid.
thelamer commentedon Nov 2, 2026
In general we support docker-ce on linux, the readme is already full of noise I doubt this would help the broad audience. But also the actual problem is that debian-kde uses an old wrapper I just fixed this in f04eed8 .