misc: add official lighthouse-docker goodies

[paulirish]

Fixes #3715

AFAIK, It is NOT yet on dockerhub. (and so any readme mentions assuming that don't work yet)

---

This is a new PR for #4864, redone for easier conversation and review.

[paulirish]

@devnook i've merged master back into this branch, as it was otherwise 5mo stale. I think now this branch should serve as good base for experimenting.

I've noticed some odd things already. Let's both try using it and I'm sure we'll run into some changes we want to make. Feel free to push changes right to the branch. I figure it's ~a week out from being ready to review in its entirety.

[justinribeiro]

A few notes/things:

1. If the target is to publish on DockerHub, then making sure that the tagging is either version specific or channel specific may be helpful (I get this request a lot).

2. The use of dumb-init within the container shouldn't be required with any recent docker version (1.13+); you can forward/reap processes via passing the --init flag to docker run to the same effect (they merged tini a while back). See docs.

3. The reliance on CAP_SYS_ADMIN in the docs to run the container continues to bother me; it's effectively equivalent to running root. We can't use the default seccomp profile that docker ships since Chrome uses things like unshare cap among others, but we could either include a seccomp profile we generate via strace or utilize Jess' version and make note of it in the docs.

4. The README should cover the RHEL/CentOS user namespace issue (this came up a lot on the Rendertron repo and other Chrome-related containers).

Willing to help make updates as needed.

[ebidel]

FWIW, Google's OS team asks that official Google containers get published to http://gcr.io/ rather than dockerhub.

[justinribeiro]

@ebidel Would that publish be specific to public google-containers on GCR (ala https://console.cloud.google.com/gcr/images/google-containers/GLOBAL)? Hard to find unless you know where to look; how do they feel about GCR > DockerHub mirrors? ;-)

GCR has the same concept in terms of tagging in terms of versioning, so that shouldn't be problematic (if that's a feature chosen for those images in terms of release channels).

[ebidel]

@justinribeiro I don't see anything in the guidance that suggests we can mirror to Dockerhub. I brought up the gcr.io search+discoverability issues with them in the past and they told me others had mentioned the same. I think we should be in as many places as possible :)

[paulirish]

Much like the headful folder has everything INSIDE the image self-contained.. let's do the same with the headless case. Create a headless folder and move this and the entrypoint.sh inside of it?

[justinribeiro]

Would be easier to manage over time. That change would also require the docker_build.sh to be updated as well (since the path will have changed).

[ebidel]

Get rid of this here too.

[ebidel]

Newline

[brendankenny]

this is unmaintained right now and has no owner. Let's close and reopen when there's a sufficient need for something like this in Lighthouse core (vs existing external sources).