[BUG] ERROR:nacl_helper_linux.cc(354)] NaCl helper process running without a sandbox!

[Nefcanto]

Description

I am trying to run a headful Google Chrome inside the docker. I don't want headless Chrome, and I don't want to fake an X Server using Xvfb. I want a real Google Chrome with a GUI that I can interact with.

This is the custom image I have built:

FROM node:lts-bullseye-slim

WORKDIR /home/node

RUN apt-get update && \
    apt-get install gnupg wget -y && \
    wget --quiet --output-document=- https://dl-ssl.google.com/linux/linux_signing_key.pub | gpg --dearmor > /etc/apt/trusted.gpg.d/google-archive.gpg && \
    sh -c 'echo "deb [arch=amd64] https://dl.google.com/linux/chrome/deb/ stable main" >> /etc/apt/sources.list.d/google.list' && \
    apt-get update && \
    apt-get install google-chrome-stable -y --no-install-recommends && \
    rm -rf /var/lib/apt/lists/*

USER node

Based on this custom image which has Google Chrome installed in it, I run this docker-compose.yml file:

version: "3.9"
services:
    crawl:
        privileged: true
        image: headed-chrome
        container_name: chrome
        hostname: chrome
        working_dir: /home/node
        ports:
            - 3000:3000
        environment:
            - Key=Value
            - DISPLAY=:1
        restart: always
        command: tail -f /dev/null
        volumes:
            - /tmp/.X11-unix:/tmp/.X11-unix
            - /var/run/dbus/system_bus_socket:/var/run/dbus/system_bus_socket

Then I enter the container using docker exec -it chrome bash and I try to run the chrome using google-chrome --no-sandbox:

I get this error:

node@chrome:~$ google-chrome --no-sandbox
Trace/breakpoint trap (core dumped)
node@chrome:~$ [1002/071410.395354:ERROR:nacl_helper_linux.cc(354)] NaCl helper process running without a sandbox!
Most likely you need to configure your SUID sandbox correctly

Reproduce

1- Create a docker image as above
2- Install Google Chrome on it as above
3- Create a docker-compose file as above
4- Run it
5- Try to run Google Chrome in a headful manner and see it on your local machine

Expected behavior

No response

docker version

Client: Docker Engine - Community
 Version:           24.0.6
 API version:       1.43
 Go version:        go1.20.7
 Git commit:        ed223bc
 Built:             Mon Sep  4 12:31:44 2023
 OS/Arch:           linux/amd64
 Context:           default

Server: Docker Engine - Community
 Engine:
  Version:          24.0.6
  API version:      1.43 (minimum version 1.12)
  Go version:       go1.20.7
  Git commit:       1a79695
  Built:            Mon Sep  4 12:31:44 2023
  OS/Arch:          linux/amd64
  Experimental:     false
 containerd:
  Version:          1.6.24
  GitCommit:        61f9fd88f79f081d64d6fa3bb1a0dc71ec870523
 runc:
  Version:          1.1.9
  GitCommit:        v1.1.9-0-gccaecfc
 docker-init:
  Version:          0.19.0
  GitCommit:        de40ad0

docker info

Client: Docker Engine - Community
 Version:    24.0.6
 Context:    default
 Debug Mode: false
 Plugins:
  buildx: Docker Buildx (Docker Inc.)
    Version:  v0.11.2
    Path:     /usr/libexec/docker/cli-plugins/docker-buildx
  compose: Docker Compose (Docker Inc.)
    Version:  v2.21.0
    Path:     /usr/libexec/docker/cli-plugins/docker-compose

Server:
 Containers: 1
  Running: 1
  Paused: 0
  Stopped: 0
 Images: 11
 Server Version: 24.0.6
 Storage Driver: overlay2
  Backing Filesystem: extfs
  Supports d_type: true
  Using metacopy: false
  Native Overlay Diff: true
  userxattr: false
 Logging Driver: json-file
 Cgroup Driver: systemd
 Cgroup Version: 2
 Plugins:
  Volume: local
  Network: bridge host ipvlan macvlan null overlay
  Log: awslogs fluentd gcplogs gelf journald json-file local logentries splunk syslog
 Swarm: inactive
 Runtimes: io.containerd.runc.v2 runc
 Default Runtime: runc
 Init Binary: docker-init
 containerd version: 61f9fd88f79f081d64d6fa3bb1a0dc71ec870523
 runc version: v1.1.9-0-gccaecfc
 init version: de40ad0
 Security Options:
  apparmor
  seccomp
   Profile: builtin
  cgroupns
 Kernel Version: 6.2.0-33-generic
 Operating System: Ubuntu 22.04.3 LTS
 OSType: linux
 Architecture: x86_64
 CPUs: 4
 Total Memory: 15.49GiB
 Name: local
 ID: 6def1339-1e91-4e8d-87eb-c4ac3e5f2c59
 Docker Root Dir: /var/lib/docker
 Debug Mode: false
 Username: nefcanto
 Experimental: false
 Insecure Registries:
  127.0.0.0/8
 Live Restore Enabled: false

Additional Info

No response