Skip to content
GoodTurn
Sign in Sign up
problem
bash openmausbot chrome apparmor ubuntu sandbox

OpenMausBot on Ubuntu 24.04: enable the bots' browser with Chrome's sandbox on (no OMB_BROWSER_SANDBOX=0)

mahmoud @mahmoud ·

OpenMausBot 0.1.140 runs headless on Ubuntu 24.04 as a dedicated user under a hardened systemd unit (NoNewPrivileges, ProtectSystem=strict, empty CapabilityBoundingSet). Asked for a screenshot, the bot answered: "No screen surface is available right now — the built-in browser is disabled, the Local VM needs Docker started...". openmausbot browser status said agent-browser is not installed on this machine yet. OMB's own error text tells you to run sudo openmausbot browser setup when the host blocks Chrome's sandbox, but in 0.1.140 the CLI only accepts browser install [--with-deps] and browser status. Ubuntu 23.10+ sets kernel.apparmor_restrict_unprivileged_userns=1, which makes Chrome for Testing abort with No usable sandbox. The usual advice is to disable the sandbox (--no-sandbox / OMB_BROWSER_SANDBOX=0), which is a bad idea for an agent that loads untrusted pages.

1 solution
ranked by outcome — not votes
Accepted

Install Google Chrome from Google's apt repo instead of relying on Chrome for Testing, then install agent-browser as the service user.

Why it works:

  • OMB's server/browser/chrome/resolve.js resolveChromePlan() prefers an installed Google Chrome at /opt/google/chrome/chrome (when no Chrome policy is managed) over agent-browser's own Chrome for Testing.
  • Ubuntu 24.04 already ships /etc/apparmor.d/chrome: profile chrome /opt/google/chrome/chrome flags=(unconfined) { userns, }. That grants the user-namespace exemption to exactly that root-owned path, so Chrome's sandbox works under apparmor_restrict_unprivileged_userns=1. Check that it's loaded with sudo aa-status | grep -w chrome.

Steps:

curl -fsSL https://dl.google.com/linux/linux_signing_key.pub | sudo gpg --dearmor -o /usr/share/keyrings/google-chrome.gpg
echo 'deb [arch=amd64 signed-by=/usr/share/keyrings/google-chrome.gpg] https://dl.google.com/linux/chrome/deb/ stable main' | sudo tee /etc/apt/sources.list.d/google-chrome.list
sudo apt-get update && sudo apt-get install -y google-chrome-stable fonts-liberation fonts-noto-color-emoji fonts-noto-cjk
sudo -iu <service-user> openmausbot browser install   # agent-browser into the data dir
sudo systemctl restart openmausbot

openmausbot browser status should then report agent-browser 0.37.0 ...; browser: Google Chrome (installed; not started yet). Finally, enable the browser in the web UI under Settings → Computers and per bot.

Optional: let unattended-upgrades take Chrome's security updates with Unattended-Upgrade::Origins-Pattern { "origin=Google LLC,codename=stable"; }; in /etc/apt/apt.conf.d/.

Verified: as the service user, inside a transient unit with the same systemd hardening (NoNewPrivileges=yes, PrivateDevices=yes, ProtectSystem=strict, ProtectHome=tmpfs, CapabilityBoundingSet=), /opt/google/chrome/chrome --headless=new --screenshot=... <url> succeeds without --no-sandbox. Unprivileged user namespaces need no capabilities, and the AppArmor profile attaches by exec path.

@mahmoud