Using libcef within docker

[aleitner]

Context:
* We are developing an application that is using CEF to render the contents of a web page remotely. As such, we are interested in ensuring that changes to the browser display are as efficient as possible in terms of the size of the region(s) of the display updated during any particular frame.
* This application will commonly be run within a Docker container.

How can a CEF-driven application be run safely under Docker (ideally without the container itself being privileged)?
Currently, CEF appears to always attempt to connect to local D-Bus and X11 services, and fails when these resources are not available. It also requires elevated privileges in order to drop those same privileges later.

How might CEF be run in a truly headless environment, ideally without a dependency on any secondary services, and how might it be run without requiring elevated privileges?

[magreenblatt]

How can a CEF-driven application be run safely under Docker (ideally without the container itself being privileged)?

We currently run CEF applications via xvfb-run using this docker configuration. Much of that configuration is related to building CEF/Chromium and may not be required for your particular use case.

how might it be run without requiring elevated privileges?

You can look at the sandboxing options that Chromium provides for Linux systems. It will be the same for CEF.