github/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-05-10 10:22:44 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: sandbox browser docker no-sandbox rollout (#29879) (thanks @Lukavyi)

Browse Source
This commit is contained in:
Ayaan Zaidi
2026-02-28 21:43:43 +05:30
committed by Ayaan Zaidi
parent 7ae683194f
commit 139271ad5a
4 changed files with 7 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
src/agents/sandbox/browser.create.test.ts
View File

@@ -158,6 +158,7 @@ describe("ensureSandboxBrowser create args", () => {
expect(createArgs).toBeDefined();
expect(createArgs).toContain("127.0.0.1::6080");
const envEntries = envEntriesFromDockerArgs(createArgs ?? []);
expect(envEntries).toContain("OPENCLAW_BROWSER_NO_SANDBOX=1");
const passwordEntry = envEntries.find((entry) =>
entry.startsWith("OPENCLAW_BROWSER_NOVNC_PASSWORD="),
);

4
src/agents/sandbox/browser.ts
View File

@@ -263,6 +263,10 @@ export async function ensureSandboxBrowser(params: {
}
args.push("-e", `OPENCLAW_BROWSER_VNC_PORT=${params.cfg.browser.vncPort}`);
args.push("-e", `OPENCLAW_BROWSER_NOVNC_PORT=${params.cfg.browser.noVncPort}`);
// Chromium's setuid/namespace sandbox cannot work inside Docker containers
// (PID namespace creation requires privileges Docker does not grant by default).
// The container itself provides isolation, so --no-sandbox is safe here.
args.push("-e", "OPENCLAW_BROWSER_NO_SANDBOX=1");
if (noVncEnabled && noVncPassword) {
args.push("-e", `${NOVNC_PASSWORD_ENV_KEY}=${noVncPassword}`);
}

2
src/agents/sandbox/constants.ts
View File

@@ -38,7 +38,7 @@ export const DEFAULT_TOOL_DENY = [
export const DEFAULT_SANDBOX_BROWSER_IMAGE = "openclaw-sandbox-browser:bookworm-slim";
export const DEFAULT_SANDBOX_COMMON_IMAGE = "openclaw-sandbox-common:bookworm-slim";
export const SANDBOX_BROWSER_SECURITY_HASH_EPOCH = "2026-02-21-novnc-auth-default";
export const SANDBOX_BROWSER_SECURITY_HASH_EPOCH = "2026-02-28-no-sandbox-env";
export const DEFAULT_SANDBOX_BROWSER_PREFIX = "openclaw-sbx-browser-";
export const DEFAULT_SANDBOX_BROWSER_NETWORK = "openclaw-sandbox-browser";