From 8137834d190ea8a8009aa46958654029fc4e1de1 Mon Sep 17 00:00:00 2001 From: Timothy Jaeryang Baek Date: Mon, 2 Nov 2026 09:53:08 +0900 Subject: [PATCH] refac --- CHANGELOG.md | 6 ++++++ Dockerfile | 1 + Dockerfile.alpine | 1 + Dockerfile.openshift | 1 + Dockerfile.slim | 1 + README.md | 18 +++++++++++++----- pyproject.toml | 2 +- 7 files changed, 24 insertions(+), 6 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index e35b8ec..85aaed9 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,6 +4,12 @@ All notable changes to this project will be documented in this file. The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). +## [0.15.5] - 2026-11-02 + +### Changed + +- Docker images now default to `OPEN_TERMINAL_BROWSER_NO_SANDBOX=true` so Chromium can start under Docker's default security restrictions. Chromium's sandbox remains enabled by default outside Docker. Container isolation is unchanged, but Chromium's protection for files and processes inside the container is disabled. Deployments that support Chromium's sandbox can restore it with `OPEN_TERMINAL_BROWSER_NO_SANDBOX=false`. + ## [0.15.4] - 2026-11-02 ### Changed diff --git a/Dockerfile b/Dockerfile index c89a410..42711b2 100644 --- a/Dockerfile +++ b/Dockerfile @@ -85,6 +85,7 @@ RUN useradd -m -s /bin/bash user && echo 'user ALL=(ALL) NOPASSWD:ALL' >> /etc/s USER user ENV SHELL=/bin/bash +ENV OPEN_TERMINAL_BROWSER_NO_SANDBOX=true ENV PATH="/home/user/.local/bin:${PATH}" WORKDIR /home/user diff --git a/Dockerfile.alpine b/Dockerfile.alpine index ce397c3..1702c88 100644 --- a/Dockerfile.alpine +++ b/Dockerfile.alpine @@ -133,6 +133,7 @@ RUN chmod +x /app/entrypoint-slim.sh # and simplify the entrypoint — but su-exec handles it cleanly either way. # ENV SHELL=/bin/bash +ENV OPEN_TERMINAL_BROWSER_NO_SANDBOX=true EXPOSE 8000 diff --git a/Dockerfile.openshift b/Dockerfile.openshift index 682833d..0d4ec34 100644 --- a/Dockerfile.openshift +++ b/Dockerfile.openshift @@ -14,6 +14,7 @@ ENV PYTHONDONTWRITEBYTECODE=1 ENV PYTHONUNBUFFERED=1 ENV HOME=/home/user ENV SHELL=/bin/bash +ENV OPEN_TERMINAL_BROWSER_NO_SANDBOX=true ENV USER=user ENV XDG_CONFIG_HOME=/home/user/.config ENV XDG_STATE_HOME=/home/user/.local/state diff --git a/Dockerfile.slim b/Dockerfile.slim index e00206d..083a258 100644 --- a/Dockerfile.slim +++ b/Dockerfile.slim @@ -126,6 +126,7 @@ RUN chmod +x /app/entrypoint-slim.sh # and simplify the entrypoint — but gosu handles it cleanly either way. # ENV SHELL=/bin/bash +ENV OPEN_TERMINAL_BROWSER_NO_SANDBOX=true EXPOSE 8000 diff --git a/README.md b/README.md index 3e3a3e6..ec45741 100644 --- a/README.md +++ b/README.md @@ -234,11 +234,19 @@ and advertise them as disabled in `/api/config`. Values `false`, `0`, and `no` (case-insensitive) disable the feature. Restart the server after changing these settings. Desktop support still requires its platform dependencies to be available. -Chromium's sandbox is enabled by default, including in Docker. For a deployment -that cannot support it, set `OPEN_TERMINAL_BROWSER_NO_SANDBOX=true` and restart the -server. This applies to both managed Browser tabs and Chromium launched from the -Linux Desktop in the Docker image. It disables Chromium's sandbox; the container's isolation remains -unchanged. Values `true`, `1`, and `yes` (case-insensitive) enable this override. +Chromium's sandbox is enabled by default outside Docker. All published Docker image +variants set `OPEN_TERMINAL_BROWSER_NO_SANDBOX=true` so Browser can start under +Docker's default security restrictions when Chromium is installed. This applies to +both managed Browser tabs and Chromium launched from the Linux Desktop in the full +Docker image. Container isolation remains unchanged, but Chromium's own sandbox +no longer protects files and processes inside the container from a browser exploit. + +To enable Chromium's sandbox in Docker, pass +`-e OPEN_TERMINAL_BROWSER_NO_SANDBOX=false` when creating the container; the runtime +must permit Chromium's sandbox operations. Outside Docker, set the variable to +`true` only if your deployment cannot support the sandbox. Values `true`, `1`, and +`yes` (case-insensitive) disable the sandbox. Restart or recreate Open Terminal +after changing this setting. > [!TIP] > Use the system config at `/etc/open-terminal/config.toml` to set site-wide defaults for host and port, and the user config for personal settings like the API key — this keeps the key out of `ps` / `htop`. diff --git a/pyproject.toml b/pyproject.toml index 9d5d5f2..b1f06ba 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -1,6 +1,6 @@ [project] name = "open-terminal" -version = "0.15.4" +version = "0.15.5" description = "A remote computer API." license = "MIT" readme = "README.md"