# Passing params to docker run

**URL:** <https://community.fly.io/t/passing-params-to-docker-run/2016>\
**Category:** Questions / Help\
**Created:** [July 24, 2021, 6:30pm UTC](https://community.fly.io/t/passing-params-to-docker-run/2016 "2021-07-24T18:30:13Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![doriansmiley](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/doriansmiley/32/958_2.png) [@doriansmiley](https://community.fly.io/u/doriansmiley)\
**Post date:** [July 24, 2021, 6:30pm UTC](https://community.fly.io/t/passing-params-to-docker-run/2016/1 "2021-07-24T18:30:13Z")

</div>

I have a container that I run with the following command:

```auto
"docker run -p 3000:3000 -i --init --rm --cap-add=SYS_ADMIN --name codestrap-website node -e \"`cat server.js`\""

```

How can I pass the `--cap-add=SYS_ADMIN` and `node -e \"`cat server.js`\"` params to the docker run command in fly?

---

<div class="post-metadata">

**Author:** ![matthewford](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/matthewford/32/667_2.png) [@matthewford](https://community.fly.io/u/matthewford)\
**Post date:** [July 24, 2021, 11:31pm UTC](https://community.fly.io/t/passing-params-to-docker-run/2016/2 "2021-07-24T23:31:30Z")

</div>

Could an entry script work?

---

<div class="post-metadata">

**Author:** ![doriansmiley](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/doriansmiley/32/958_2.png) [@doriansmiley](https://community.fly.io/u/doriansmiley)\
**Post date:** [July 25, 2021, 12:59am UTC](https://community.fly.io/t/passing-params-to-docker-run/2016/4 "2021-07-25T00:59:58Z")

</div>

> [@doriansmiley](#):
>
> I would allow me to start the node server. But `--cap-add=SYS_ADMIN` adds linux admin permissions required in my application (puppeteer). MAybe there is a way to add these permissions in the Dockerfile?

I would allow me to start the node server. But `--cap-add=SYS_ADMIN` adds linux admin permissions required in my application (puppeteer). MAybe there is a way to add these permissions in the Dockerfile?

---

<div class="post-metadata">

**Author:** ![kurt](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/kurt/32/43757_2.png) [@kurt](https://community.fly.io/u/kurt)\
**Post date:** [July 25, 2021, 4:05am UTC](https://community.fly.io/t/passing-params-to-docker-run/2016/5 "2021-07-25T04:05:50Z")

</div>

You should have full root access to your VMs by default. The arguments came to tweak Docker don’t apply to your app on Fly. Are you getting permission errors?

---

<div class="post-metadata">

**Author:** ![doriansmiley](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/doriansmiley/32/958_2.png) [@doriansmiley](https://community.fly.io/u/doriansmiley)\
**Post date:** [July 25, 2021, 3:53pm UTC](https://community.fly.io/t/passing-params-to-docker-run/2016/6 "2021-07-25T15:53:16Z")

</div>

I get an Unable to open X display error without adding SYS\_ADMIN. When `google-chrome-stable` is run it barfs about some permissions issue that ends up leading to this inability to locate it display. Under the hood I think puppeteer is trying to use [xvfb](https://en.wikipedia.org/wiki/Xvfb).

---

<div class="post-metadata">

**Author:** ![doriansmiley](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/doriansmiley/32/958_2.png) [@doriansmiley](https://community.fly.io/u/doriansmiley)\
**Post date:** [July 28, 2021, 2:33am UTC](https://community.fly.io/t/passing-params-to-docker-run/2016/7 "2021-07-28T02:33:12Z")

</div>

I get an Unable to open X display error without adding SYS\_ADMIN. When `google-chrome-stable` is run it barfs about some permissions issue that ends up leading to this inability to locate it display. Under the hood I think puppeteer is trying to use [xvfb](https://en.wikipedia.org/wiki/Xvfb).

---

<div class="post-metadata">

**Author:** ![doriansmiley](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/doriansmiley/32/958_2.png) [@doriansmiley](https://community.fly.io/u/doriansmiley)\
**Post date:** [July 28, 2021, 2:49am UTC](https://community.fly.io/t/passing-params-to-docker-run/2016/8 "2021-07-28T02:49:25Z")

</div>

I think what is going on here is my setup starts puppeteer with Chrome using `CMD ["google-chrome-stable"]`. `PUPPETEER_SKIP_CHROMIUM_DOWNLOAD` is false. This enables full media support (at least that’s what I assume is happening). However your [example app](https://github.com/fly-apps/puppeteer-js-renderer/blob/master/index.js) uses:

```auto
const browser = await puppeteer.launch(
      {
        executablePath: process.env.CHROME_BIN,

```

Does [fly.io](http://fly.io) provide a Chrome bin? If so I can modify my setup for fly. However, it would be cool to be able to use the best practice container provided by Google.

---

<div class="post-metadata">

**Author:** ![doriansmiley](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/doriansmiley/32/958_2.png) [@doriansmiley](https://community.fly.io/u/doriansmiley)\
**Post date:** [December 10, 2021, 1:14am UTC](https://community.fly.io/t/passing-params-to-docker-run/2016/9 "2021-12-10T01:14:14Z")

</div>

I just got around to revisiting this. In looking at fly’s [sample](https://github.com/fly-apps/puppeteer-js-renderer/) it looks like PUPPETEER\_EXECUTABLE\_PATH must be supplied by the platform. I’ve tried to implement `puppeteer-core` to avoid the need to pass system capabilities in docker run. I am getting the following error:

```auto
// puppeteer-core doesn't take into account PUPPETEER_* env variables.
    if (!launcher._isPuppeteerCore) {
        const executablePath = process.env.PUPPETEER_EXECUTABLE_PATH ||
            process.env.npm_config_puppeteer_executable_path ||
            process.env.npm_package_config_puppeteer_executable_path;
        if (executablePath) {
            const missingText = !fs.existsSync(executablePath)
                ? 'Tried to use PUPPETEER_EXECUTABLE_PATH env variable to launch browser but did not find any executable at: ' +
                    executablePath
                : null;
            return { executablePath, missingText };
        }
    }

```

Puppeteer resolves the executable path as follows:

```auto
// puppeteer-core doesn't take into account PUPPETEER_* env variables.
    if (!launcher._isPuppeteerCore) {
        const executablePath = process.env.PUPPETEER_EXECUTABLE_PATH ||
            process.env.npm_config_puppeteer_executable_path ||
            process.env.npm_package_config_puppeteer_executable_path;
        if (executablePath) {
            const missingText = !fs.existsSync(executablePath)
                ? 'Tried to use PUPPETEER_EXECUTABLE_PATH env variable to launch browser but did not find any executable at: ' +
                    executablePath
                : null;
            return { executablePath, missingText };
        }
    }

```

Do you have undocumented support for a browser executable by setting `PUPPETEER_EXECUTABLE_PATH` in your environments? If not you really need to add support for [container capabilities](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task_definition_parameters.html#container_definition_security) like AWS did.

---

<div class="post-metadata">

**Author:** ![kurt](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/kurt/32/43757_2.png) [@kurt](https://community.fly.io/u/kurt)\
**Post date:** [December 10, 2021, 2:17am UTC](https://community.fly.io/t/passing-params-to-docker-run/2016/10 "2021-12-10T02:17:18Z")

</div>

We don’t actually run containers, we extract your app into a VM with full root access. So the container capabilities in Docker don’t exactly apply!

Can you share your Dockerfile? Also can you share the exact logs you’re seeing when you start one?

---

<div class="post-metadata">

**Author:** ![doriansmiley](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/doriansmiley/32/958_2.png) [@doriansmiley](https://community.fly.io/u/doriansmiley)\
**Post date:** [December 10, 2021, 4:12am UTC](https://community.fly.io/t/passing-params-to-docker-run/2016/11 "2021-12-10T04:12:10Z")

</div>

Kurt, thanks for responding. Full docker file is below:

```auto
FROM node:16-slim

MAINTAINER Dorian Smiley, dsmiley@codestrap.me

WORKDIR /usr/app

# Install latest chrome dev package and fonts to support major charsets (Chinese, Japanese, Arabic, Hebrew, Thai and a few others)
# Note: this installs the necessary libs to make the bundled version of Chromium that Puppeteer
# installs, work.
RUN apt-get update \
    && apt-get install -y wget gnupg \
    && wget -q -O - https://dl-ssl.google.com/linux/linux_signing_key.pub | apt-key add - \
    && sh -c 'echo "deb [arch=amd64] http://dl.google.com/linux/chrome/deb/ stable main" >> /etc/apt/sources.list.d/google.list' \
    && apt-get update \
    && apt-get install -y xvfb \
    && apt-get install -y google-chrome-stable fonts-ipafont-gothic fonts-wqy-zenhei fonts-thai-tlwg fonts-kacst fonts-freefont-ttf libxss1 \
      --no-install-recommends \
    && rm -rf /var/lib/apt/lists/*

# If running Docker >= 1.13.0 use docker run's --init arg to reap zombie processes, otherwise
# uncomment the following lines to have `dumb-init` as PID 1
# ADD https://github.com/Yelp/dumb-init/releases/download/v1.2.2/dumb-init_1.2.2_x86_64 /usr/local/bin/dumb-init
# RUN chmod +x /usr/local/bin/dumb-init
# ENTRYPOINT ["dumb-init", "--"]

# Uncomment to skip the chromium download when installing puppeteer. If you do,
# you'll need to launch puppeteer with:
# browser.launch({executablePath: 'google-chrome-stable'})
# ENV PUPPETEER_SKIP_CHROMIUM_DOWNLOAD true
COPY package.json .
# COPY package-lock.json .
COPY index.html .
COPY favicon.ico .
COPY index.js .
COPY ./css ./css
COPY ./img ./img
COPY ./program ./program
COPY server.js .
COPY ./ssr ./ssr

# Install puppeteer so it's available in the container.
RUN npm install \
    # Add user so we don't need --no-sandbox.
    # same layer as npm install to keep re-chowned files from using up several hundred MBs more space
    && groupadd -r pptruser && useradd -r -g pptruser -G audio,video pptruser \
    && mkdir -p /home/pptruser/Downloads \
    && chown -R pptruser:pptruser /home/pptruser \
    && chown -R pptruser:pptruser /usr/app/node_modules

# allow the pptruser write permissions to the container
RUN chown -R pptruser:pptruser /usr/app
RUN chmod 755 /usr/app

# Run everything after as non-privileged user.
USER pptruser

ENV PORT=80
ENV DISPLAY=1.0
ENV DEBUG='codestrap-website:*'

EXPOSE 3000
EXPOSE 80
EXPOSE 443

CMD ["google-chrome-stable"]

```

This is mostly taken from Google’s official docker guide for Puppeteer. The error is ` Unable to open X display` which is described in [this](https://stackoverflow.com/questions/65415881/puppeteer-chromium-unable-to-open-x-display-ubuntu-20-04) stack overflow issue. However `xvfb` requires `--cap-add=SYS_ADMIN`.

---

<div class="post-metadata">

**Author:** ![doriansmiley](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/doriansmiley/32/958_2.png) [@doriansmiley](https://community.fly.io/u/doriansmiley)\
**Post date:** [December 10, 2021, 4:15am UTC](https://community.fly.io/t/passing-params-to-docker-run/2016/12 "2021-12-10T04:15:46Z")

</div>

Also, the error I get when running the fly example app for puppeteer is:

```auto
Error: Could not find browser revision 756035. Run "npm install" or "yarn install" to download a browser binary.
    at ChromeLauncher.launch (/Users/doriansmiley/workspace/puppeteer-js-renderer/node_modules/puppeteer-core/lib/Launcher.js:59:23)
    at async /Users/doriansmiley/workspace/puppeteer-js-renderer/server.js:40:25

```

---

<div class="post-metadata">

**Author:** ![doriansmiley](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/doriansmiley/32/958_2.png) [@doriansmiley](https://community.fly.io/u/doriansmiley)\
**Post date:** [December 10, 2021, 4:34am UTC](https://community.fly.io/t/passing-params-to-docker-run/2016/13 "2021-12-10T04:34:15Z")

</div>

> [@doriansmiley](#):
>
> SYS\_ADMIN

here’s the exact error message when I remove the added sys admin capabilities:

```auto
/usr/app/node_modules/puppeteer/lib/cjs/puppeteer/node/BrowserRunner.js:194
            reject(new Error([
                   ^

Error: Failed to launch the browser process!
[1210/043312.672580:FATAL:zygote_host_impl_linux.cc(117)] No usable sandbox! Update your kernel or see https://chromium.googlesource.com/chromium/src/+/master/docs/linux/suid_sandbox_development.md for more information on developing with the SUID sandbox. If you want to live dangerously and need an immediate workaround, you can try using --no-sandbox.
#0 0x55b715021259 base::debug::CollectStackTrace()
#1 0x55b714f8d9e3 base::debug::StackTrace::StackTrace()
#2 0x55b714f9e610 logging::LogMessage::~LogMessage()
#3 0x55b71368783b content::ZygoteHostImpl::Init()
#4 0x55b714f2d80c content::ContentMainRunnerImpl::Initialize()
#5 0x55b714f2bb09 content::RunContentProcess()
#6 0x55b714f2bc3d content::ContentMain()
#7 0x55b714f87c29 headless::HeadlessBrowserMain()
#8 0x55b714f8793a headless::HeadlessShellMain()
#9 0x55b711fb83e1 ChromeMain
#10 0x7fc585ed609b __libc_start_main
#11 0x55b711fb822a _start

Received signal 6
#0 0x55b715021259 base::debug::CollectStackTrace()
#1 0x55b714f8d9e3 base::debug::StackTrace::StackTrace()
#2 0x55b715020e00 base::debug::(anonymous namespace)::StackDumpSignalHandler()
#3 0x7fc587f5a730 (/lib/x86_64-linux-gnu/libpthread-2.28.so+0x1272f)
#4 0x7fc585ee97bb gsignal
#5 0x7fc585ed4535 abort
#6 0x55b715020425 base::debug::BreakDebugger()
#7 0x55b714f9ea37 logging::LogMessage::~LogMessage()
#8 0x55b71368783b content::ZygoteHostImpl::Init()
#9 0x55b714f2d80c content::ContentMainRunnerImpl::Initialize()
#10 0x55b714f2bb09 content::RunContentProcess()
#11 0x55b714f2bc3d content::ContentMain()
#12 0x55b714f87c29 headless::HeadlessBrowserMain()
#13 0x55b714f8793a headless::HeadlessShellMain()
#14 0x55b711fb83e1 ChromeMain
#15 0x7fc585ed609b __libc_start_main
#16 0x55b711fb822a _start
  r8: 0000000000000000 r9: 00007fff07a37520 r10: 0000000000000008 r11: 0000000000000246
 r12: 00007fff07a387f0 r13: 00007fff07a37780 r14: 00007fff07a38800 r15: aaaaaaaaaaaaaaaa
  di: 0000000000000002 si: 00007fff07a37520 bp: 00007fff07a37770 bx: 0000000000000006
  dx: 0000000000000000 ax: 0000000000000000 cx: 00007fc585ee97bb sp: 00007fff07a37520
  ip: 00007fc585ee97bb efl: 0000000000000246 cgf: 002b000000000033 erf: 0000000000000000
 trp: 0000000000000000 msk: 0000000000000000 cr2: 0000000000000000
[end of stack trace]
Calling _exit(1). Core file will not be generated.

TROUBLESHOOTING: https://github.com/puppeteer/puppeteer/blob/main/docs/troubleshooting.md

    at onClose (/usr/app/node_modules/puppeteer/lib/cjs/puppeteer/node/BrowserRunner.js:194:20)
    at Interface.<anonymous> (/usr/app/node_modules/puppeteer/lib/cjs/puppeteer/node/BrowserRunner.js:184:68)
    at Interface.emit (node:events:402:35)
    at Interface.close (node:readline:586:8)
    at Socket.onend (node:readline:277:10)
    at Socket.emit (node:events:402:35)
    at endReadableNT (node:internal/streams/readable:1343:12)
    at processTicksAndRejections (node:internal/process/task_queues:83:21)

```

---

<div class="post-metadata">

**Author:** ![michael](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/michael/32/16_2.png) [@michael](https://community.fly.io/u/michael)\
**Post date:** [December 10, 2021, 10:30pm UTC](https://community.fly.io/t/passing-params-to-docker-run/2016/14 "2021-12-10T22:30:06Z")

</div>

Chrome is refusing to start without a sandbox. There’s a url after the error message that looks promising: [puppeteer/troubleshooting.md at main · puppeteer/puppeteer · GitHub](https://github.com/puppeteer/puppeteer/blob/main/docs/troubleshooting.md#setting-up-chrome-linux-sandbox)

---

<div class="post-metadata">

**Author:** ![doriansmiley](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/doriansmiley/32/958_2.png) [@doriansmiley](https://community.fly.io/u/doriansmiley)\
**Post date:** [December 10, 2021, 10:34pm UTC](https://community.fly.io/t/passing-params-to-docker-run/2016/15 "2021-12-10T22:34:19Z")

</div>

Hey Michael, thanks for responding. " If you **absolutely trust** the content you open in Chrome, you can launch Chrome with the `--no-sandbox` argument". This is a website publishing service for a framework I created. I don’t trust the content passing through the service. That said I’ll add the no-sandbox option and see if it resolves the issue.

---

<div class="post-metadata">

**Author:** ![michael](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/michael/32/16_2.png) [@michael](https://community.fly.io/u/michael)\
**Post date:** [December 10, 2021, 10:38pm UTC](https://community.fly.io/t/passing-params-to-docker-run/2016/16 "2021-12-10T22:38:18Z")

</div>

Disabling the sandbox is the recommended way to run on Heroku and Lambda sadly. But since you have root access to the machine on Fly you should be able to configure it using one of the other methods. We also have an upcoming api that lets you launch and destroy VMs very quickly which you could use to run untrusted code safely.

---

<div class="post-metadata">

**Author:** ![doriansmiley](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/doriansmiley/32/958_2.png) [@doriansmiley](https://community.fly.io/u/doriansmiley)\
**Post date:** [December 10, 2021, 10:38pm UTC](https://community.fly.io/t/passing-params-to-docker-run/2016/17 "2021-12-10T22:38:40Z")

</div>

Adding `'--no-sandbox', '--disable-setuid-sandbox'` works but I don’t think I can use the service with those options enabled.

---

<div class="post-metadata">

**Author:** ![doriansmiley](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/doriansmiley/32/958_2.png) [@doriansmiley](https://community.fly.io/u/doriansmiley)\
**Post date:** [December 10, 2021, 10:41pm UTC](https://community.fly.io/t/passing-params-to-docker-run/2016/18 "2021-12-10T22:41:00Z")

</div>

I marked this one as resolved. In the future, if there’s a better solution where I can keep the sandbox enabled let me know. Thanks for your help!

---

<div class="post-metadata">

**Author:** ![michael](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/michael/32/16_2.png) [@michael](https://community.fly.io/u/michael)\
**Post date:** [December 10, 2021, 10:42pm UTC](https://community.fly.io/t/passing-params-to-docker-run/2016/19 "2021-12-10T22:42:36Z")

</div>

I think our replies got crossed 😄 this will probably work right now if you run it from an ENTRYPOINT script before starting `google-chrome-stable`

> <https://github.com/puppeteer/puppeteer/blob/main/docs/troubleshooting.md#recommended-enable-user-namespace-cloning>

---

<div class="post-metadata">

**Author:** ![doriansmiley](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/doriansmiley/32/958_2.png) [@doriansmiley](https://community.fly.io/u/doriansmiley)\
**Post date:** [December 11, 2021, 8:49pm UTC](https://community.fly.io/t/passing-params-to-docker-run/2016/20 "2021-12-11T20:49:49Z")

</div>

hey Michael, I am having numerous issues migrating this project so it will run on Fly. I tried implementing an entry point script but I could not get it to work. Could you checkout the repo and see if you can get this setup to work on flow. [codestrap/infra/fly/website at master · doriansmiley/codestrap · GitHub](https://github.com/doriansmiley/codestrap/tree/master/infra/fly/website)

---

<div class="post-metadata">

**Author:** ![doriansmiley](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/doriansmiley/32/958_2.png) [@doriansmiley](https://community.fly.io/u/doriansmiley)\
**Post date:** [December 11, 2021, 9:07pm UTC](https://community.fly.io/t/passing-params-to-docker-run/2016/21 "2021-12-11T21:07:21Z")

</div>

I may have made a breakthrough. I just changed the command to `CMD ["npm", "start"]`. This removes the need for me to pass `node -e \"cat server.js\"` in `docker run`. I’m deploying now. Is there a way to specify port mappings in fly? I default to port 3000 and want to map `443:3000`

[Next page](https://community.fly.io/t/passing-params-to-docker-run/2016.md?page=2)