[desktop-lite] XFCE4 Terminal fails on Debian 12 Bookworm

[huw]

On Debian 12 Bookworm, the XFCE4 terminal fails to load inside of NoVNC (using the desktop-lite feature):

Failed to fdwalk: Operation not permitted

I’m not 100% sure about the cause (discussed further in mviereck/x11docker#346), but there’s some interaction occurring on systems which use vte3>=0.63.91. The workaround for now is to add the following to your runArgs in devcontainer.json:

{
  "runArgs": ["--security-opt", "seccomp=unconfined"]
}

I’m not 100% sure what the best call for this repo should be (maybe moving away from xfce4-terminal?), but I figured I’d report the issue and include a workaround in case anyone else runs into this :)

[jkeech]

Can you share the version of Docker that you are using? From the linked issues, it sounds like Docker/moby should allow the close_range syscall without needing to pass --security-opt seccomp=unconfined.

[huw]

Ah, this should be getting fixed this week then, since GitHub Codespaces are updating the host image from Ubuntu 18.04 to 22.04. I’ll set a reminder to check and return next week :)

[alexander-smolyakov]

Hey @huw, I'm currently looking into this issue. Could you please share the following information?

• Information about the environment: Where you try to run the container. What OS is used on the host, and what is in the container;
• Docker version;

Also, providing a repro sample could help speed up the investigation.

[huw]

@alexander-smolyakov This is difficult, as I’m running the container in GitHub Codespaces. According to their announcement from this week, they’re updating the host OS from Ubuntu 18.04 to 22.04. I don’t know what the Docker version is because Microsoft don’t release this publicly, AFAIK. I’m running Debian 12 bookworm in the container (FROM buildpack-deps:bookworm).

Since the host OS upgrade is ongoing, I suspect it’ll take a week or so before we can tell if the upgrade fixes the issue, so I suggest we put this on hold until then and I can report back with whether it’s fixed or not ^_^

[huw]

@alexander-smolyakov It looks like the Codespaces host upgrade didn’t fix it, but I can’t confirm whether the upgrade has happened for my account yet. I can only assume it has given the timeline GitHub provided in that announcement.

Here’s my minimum reproduction, also in this repo so you can create a Codespace on it to test yourself.

devcontainer.json:

{
  "name": "Codespace",
  "build": {
    "dockerfile": "Dockerfile",
  },

  "features": {
    // Add common utilities (zsh, sudo, etc.)
    "ghcr.io/devcontainers/features/common-utils:2": {
			"installZsh": "true",
			"username": "node",
			"upgradePackages": "true"
		},
    // Add a desktop & VNC for browser testing
    "ghcr.io/devcontainers/features/desktop-lite:1": {},
  },

  "forwardPorts": [6080],

  "portsAttributes": {
    "6080": {
      "label": "noVNC"
    },
  },

  // Comment out to connect as root instead. More info: https://aka.ms/vscode-remote/containers/non-root.
  "remoteUser": "node"
}

Dockerfile

FROM buildpack-deps:bookworm

RUN groupadd --gid 1000 node \
  && useradd --uid 1000 --gid node --shell /bin/bash --create-home node

Once you’ve created the Codespace, visit the forwarded port 6080 in your browser, and create a terminal. You should see the error as described.

[alexander-smolyakov]

@huw, thanks for the update! I will continue the investigation on my end.