refac

CHANGELOG.md

@@ -4,6 +4,12 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## [0.15.5] - 2026-11-02
+
+### Changed
+
+- Docker images now default to `OPEN_TERMINAL_BROWSER_NO_SANDBOX=true` so Chromium can start under Docker's default security restrictions. Chromium's sandbox remains enabled by default outside Docker. Container isolation is unchanged, but Chromium's protection for files and processes inside the container is disabled. Deployments that support Chromium's sandbox can restore it with `OPEN_TERMINAL_BROWSER_NO_SANDBOX=false`.
+
 ## [0.15.4] - 2026-11-02
 
 ### Changed

Dockerfile

@@ -85,6 +85,7 @@ RUN useradd -m -s /bin/bash user && echo 'user ALL=(ALL) NOPASSWD:ALL' >> /etc/s
 
 USER user
 ENV SHELL=/bin/bash
+ENV OPEN_TERMINAL_BROWSER_NO_SANDBOX=true
 ENV PATH="/home/user/.local/bin:${PATH}"
 WORKDIR /home/user
 

Dockerfile.alpine

@@ -133,6 +133,7 @@ RUN chmod +x /app/entrypoint-slim.sh
 # and simplify the entrypoint — but su-exec handles it cleanly either way.
 #
 ENV SHELL=/bin/bash
+ENV OPEN_TERMINAL_BROWSER_NO_SANDBOX=true
 
 EXPOSE 8000
 

Dockerfile.openshift

@@ -14,6 +14,7 @@ ENV PYTHONDONTWRITEBYTECODE=1
 ENV PYTHONUNBUFFERED=1
 ENV HOME=/home/user
 ENV SHELL=/bin/bash
+ENV OPEN_TERMINAL_BROWSER_NO_SANDBOX=true
 ENV USER=user
 ENV XDG_CONFIG_HOME=/home/user/.config
 ENV XDG_STATE_HOME=/home/user/.local/state

Dockerfile.slim

@@ -126,6 +126,7 @@ RUN chmod +x /app/entrypoint-slim.sh
 # and simplify the entrypoint — but gosu handles it cleanly either way.
 #
 ENV SHELL=/bin/bash
+ENV OPEN_TERMINAL_BROWSER_NO_SANDBOX=true
 
 EXPOSE 8000
 

README.md

@@ -234,11 +234,19 @@ and advertise them as disabled in `/api/config`. Values `false`, `0`, and `no`
 (case-insensitive) disable the feature. Restart the server after changing these settings.
 Desktop support still requires its platform dependencies to be available.
 
-Chromium's sandbox is enabled by default, including in Docker. For a deployment
-that cannot support it, set `OPEN_TERMINAL_BROWSER_NO_SANDBOX=true` and restart the
-server. This applies to both managed Browser tabs and Chromium launched from the
-Linux Desktop in the Docker image. It disables Chromium's sandbox; the container's isolation remains
-unchanged. Values `true`, `1`, and `yes` (case-insensitive) enable this override.
+Chromium's sandbox is enabled by default outside Docker. All published Docker image
+variants set `OPEN_TERMINAL_BROWSER_NO_SANDBOX=true` so Browser can start under
+Docker's default security restrictions when Chromium is installed. This applies to
+both managed Browser tabs and Chromium launched from the Linux Desktop in the full
+Docker image. Container isolation remains unchanged, but Chromium's own sandbox
+no longer protects files and processes inside the container from a browser exploit.
+
+To enable Chromium's sandbox in Docker, pass
+`-e OPEN_TERMINAL_BROWSER_NO_SANDBOX=false` when creating the container; the runtime
+must permit Chromium's sandbox operations. Outside Docker, set the variable to
+`true` only if your deployment cannot support the sandbox. Values `true`, `1`, and
+`yes` (case-insensitive) disable the sandbox. Restart or recreate Open Terminal
+after changing this setting.
 
 > [!TIP]
 > Use the system config at `/etc/open-terminal/config.toml` to set site-wide defaults for host and port, and the user config for personal settings like the API key — this keeps the key out of `ps` / `htop`.

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "open-terminal"
-version = "0.15.4"
+version = "0.15.5"
 description = "A remote computer API."
 license = "MIT"
 readme = "README.md"