Merge pull request #1430 from w3c/apparmor

Disable AppArmor to run Puppeteer
w3c · Jan 7, 2025 · 48d6b12 · 48d6b12
2 parents 734ec92 + dc122de
commit 48d6b12
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 0 deletions.
diff --git a/.github/workflows/update-ed.yml b/.github/workflows/update-ed.yml
@@ -7,6 +7,13 @@ jobs:
   update:
     runs-on: ubuntu-latest
     steps:
+    # Starting with Ubuntu 23+, a security feature prevents running Puppeteer
+    # by default. It needs to be disabled. Using the "easiest" option, see:
+    # https://chromium.googlesource.com/chromium/src/+/main/docs/security/apparmor-userns-restrictions.md
+    # https://github.com/puppeteer/puppeteer/pull/13196/files
+    - name: Disable AppArmor
+      run: echo 0 | sudo tee /proc/sys/kernel/apparmor_restrict_unprivileged_userns
+
     - name: Checkout repo
       uses: actions/checkout@v4
 

diff --git a/.github/workflows/update-tr.yml b/.github/workflows/update-tr.yml
@@ -7,6 +7,13 @@ jobs:
   update:
     runs-on: ubuntu-latest
     steps:
+    # Starting with Ubuntu 23+, a security feature prevents running Puppeteer
+    # by default. It needs to be disabled. Using the "easiest" option, see:
+    # https://chromium.googlesource.com/chromium/src/+/main/docs/security/apparmor-userns-restrictions.md
+    # https://github.com/puppeteer/puppeteer/pull/13196/files
+    - name: Disable AppArmor
+      run: echo 0 | sudo tee /proc/sys/kernel/apparmor_restrict_unprivileged_userns
+
     - name: Checkout repo
       uses: actions/checkout@v4