selenium/node-firefox pod error

[heeyeonwiz]

Hi,
You did a awesome job. I got a problem when I was following your instruction.
Firefox say some messages, after run test from remote via Selenium Hub. And I can see Firefox process in the process list. However, chrome Pod works great.
How can I resolve my problem?

08:01:38.487 INFO - /status: Executing GET on /status (handler: Status)
  | (firefox:246): dconf-CRITICAL **: unable to create directory '/.cache/dconf': Permission denied. dconf will not work properly.
  | (firefox:246): dconf-CRITICAL **: unable to create directory '/.cache/dconf': Permission denied. dconf will not work properly.

OpenShift Origin:

• OpenShift Master: v3.6.0+c4dd4cf
• Kubernetes Master: v1.6.1+5115d708d7

Selenium:
RemoteProxy v3.5.2
WebDeriver v:55.0.3

[ddavison]

perhaps it's another edge case when using openshift and docker. OpenShift puts some built-in security measures that the containers have to abide by. in this case, it looks like firefox can't do its thing.

more research is required

[heeyeonwiz]

Thank you for your comment.
You are right. According to OpenShift's document, Openshift runs in ramdon user id (numeric, ex-10006000) and ignores user name (such as "seluser"). As the result the home directory of the user is "/" and firefox can't load default profile and create ".cache" folder.
I could resolve my problem by matching the user id of seluser in selenium/node-firefox and the user id openshift give at run-time.

Reference: https://docs.openshift.com/enterprise/3.2/creating_images/guidelines.html "Support Arbitrary User IDs" section

[ddavison]

well this particular bit you're probably referring to is SeleniumHQ/docker-selenium#529 which i merged in earlier today. perhaps that would fix it

[moortimis]

Deploying the Openshift templates today has resulted in the same issues. As commit#529 doesn't appear to address the named user issues, this container images still requires the "RunAsAny" policy to be enabled to work.

oc adm policy add-scc-to-user anyuid -z default

In OpenShift there is no concept of USERS so the use of SELUSER in the Dockerfile is redundant in this sense. Instead, the PID is being run as uid=1000150000 which as described in OpenShift Documentation has limited access despite being a member of the root group.

The following demonstrates that the uid=1000150000 doesn't have a user alias and also doesn't have the rights to write or create '/.cache/dconf'

echo $USER

$ 
$ id 
uid=1000150000 gid=0(root) groups=0(root),1000150000
$ pwd
/
$ ls -la
total 12
drwxr-xr-x.  21 root root  242 Sep 17 23:51 .
drwxr-xr-x.  21 root root  242 Sep 17 23:51 ..
-rwxr-xr-x.   1 root root    0 Sep 17 23:51 .dockerenv
drwxr-xr-x.   2 root root 4096 Sep  6 17:32 bin
drwxr-xr-x.   2 root root    6 Apr 12  2016 boot
drwxr-xr-x.   5 root root  380 Sep 17 23:51 dev
drwxr-xr-x.  56 root root 4096 Sep 17 23:51 etc
drwxr-xr-x.   3 root root   21 Sep  6 18:13 home
drwxr-xr-x.   8 root root   96 Sep  6 18:12 lib
drwxr-xr-x.   2 root root   34 Aug  2 14:09 lib64
drwxr-xr-x.   2 root root    6 Aug  2 14:09 media
drwxr-xr-x.   2 root root    6 Aug  2 14:09 mnt
drwxr-xr-x.   5 root root   81 Sep  6 18:13 opt
dr-xr-xr-x. 491 root root    0 Sep 17 23:51 proc
drwx------.   2 root root   55 Sep  6 18:13 root
drwxr-xr-x.   6 root root  126 Sep 17 23:51 run
drwxr-xr-x.   2 root root 4096 Aug 10 20:13 sbin
drwxr-xr-x.   2 root root    6 Aug  2 14:09 srv
dr-xr-xr-x.  13 root root    0 Sep  2 10:55 sys
drwxrwxrwt.   7 root root  138 Sep 18 00:31 tmp
drwxr-xr-x.  10 root root  105 Sep  6 18:13 usr
drwxr-xr-x.  11 root root  139 Sep  6 18:12 var

To fix this issue the following changes are needed.

• Define WORKDIR in container image to execute entrypoint from
• Grant the root group write access to this location so as firefox can write it's cached files.

Output from last run.

23:51:45.524 INFO - Selenium build info: version: '3.5.3', revision: 'a88d25fe6b'
23:51:45.526 INFO - Launching a Selenium Grid node
2017-09-17 23:51:51.134:INFO::main: Logging initialized @9299ms to org.seleniumhq.jetty9.util.log.StdErrLog
23:51:51.715 INFO - Driver class not found: com.opera.core.systems.OperaDriver
23:51:52.119 INFO - Driver provider class org.openqa.selenium.ie.InternetExplorerDriver registration is skipped:
 registration capabilities Capabilities [{ensureCleanSession=true, browserName=internet explorer, version=, platform=WINDOWS}] does not match the current platform LINUX
23:51:52.119 INFO - Driver provider class org.openqa.selenium.edge.EdgeDriver registration is skipped:
 registration capabilities Capabilities [{browserName=MicrosoftEdge, version=, platform=WINDOWS}] does not match the current platform LINUX
23:51:52.120 INFO - Driver provider class org.openqa.selenium.safari.SafariDriver registration is skipped:
 registration capabilities Capabilities [{browserName=safari, version=, platform=MAC}] does not match the current platform LINUX
23:51:52.426 INFO - Using the passthrough mode handler
2017-09-17 23:51:52.723:INFO:osjs.Server:main: jetty-9.4.5.v20170502
2017-09-17 23:51:53.016:WARN:osjs.SecurityHandler:main: ServletContext@o.s.j.s.ServletContextHandler@6f1de4c7{/,null,STARTING} has uncovered http methods for path: /
2017-09-17 23:51:53.021:INFO:osjsh.ContextHandler:main: Started o.s.j.s.ServletContextHandler@6f1de4c7{/,null,AVAILABLE}
2017-09-17 23:51:53.232:INFO:osjs.AbstractConnector:main: Started ServerConnector@557caf28{HTTP/1.1,[http/1.1]}{0.0.0.0:5555}
2017-09-17 23:51:53.232:INFO:osjs.Server:main: Started @11397ms
23:51:53.232 INFO - Selenium Grid node is up and ready to register to the hub
23:51:53.423 INFO - Starting auto registration thread. Will try to register every 5000 ms.
23:51:53.423 INFO - Registering the node to the hub: http://hub-selenium.anapp.cloud:80/grid/register
23:51:53.815 INFO - The node is registered to the hub and ready to use
2017-09-18 00:16:44.134:INFO:osjshC.ROOT:qtp211968962-14: org.openqa.selenium.remote.server.WebDriverServlet-479d31f3: Initialising WebDriverServlet
00:16:44.418 INFO - Binding default provider to: org.openqa.selenium.chrome.ChromeDriverService
00:16:44.419 INFO - Found handler: org.openqa.selenium.remote.server.BeginSession@4dfa9ebe
00:16:44.427 INFO - /session: Executing POST on /session (handler: BeginSession)
00:16:44.915 INFO - Mismatched capabilities. Creating a synthetic w3c capability.
00:16:44.921 INFO - Capabilities are: Capabilities {rotatable=false, nativeEvents=false, browserName=firefox, takesScreenshot=true, javascriptEnabled=true, platformName=ANY, version=, platform=ANY, cssSelectorsEnabled=true, }
00:16:44.929 INFO - Capabilities {rotatable=false, nativeEvents=false, browserName=firefox, takesScreenshot=true, javascriptEnabled=true, platformName=ANY, version=, platform=ANY, cssSelectorsEnabled=true, } matched class org.openqa.selenium.remote.server.ServicedSession$Factory (provider: org.openqa.selenium.firefox.GeckoDriverService)
00:16:44.929 INFO - Capabilities {rotatable=false, nativeEvents=false, browserName=firefox, takesScreenshot=true, javascriptEnabled=true, platformName=ANY, version=, platform=ANY, cssSelectorsEnabled=true, } matched class org.openqa.selenium.remote.server.ServicedSession$Factory (provider: org.openqa.selenium.chrome.ChromeDriverService)
1505693805419	geckodriver	INFO	geckodriver 0.18.0
1505693805424	geckodriver	INFO	Listening on 127.0.0.1:5691
1505693806724	geckodriver::marionette	INFO	Starting browser /usr/bin/firefox with args ["-marionette"]
(firefox:58): dconf-CRITICAL **: unable to create directory '/.cache/dconf': Permission denied.  dconf will not work properly.

[jr00n]

@moortimis Thanks for your suggestions...and i've made a working solution in OpenShift without changing the original images. Just made a buildconfig + Dockerfile which changed the file and directory permissions, added a WORKDIR...now it's supporting the OpenShift Arbitrary User IDs.
Take a look at: https://github.com/jr00n/selenium-os
The grid template starts the hub and builds the firefox and chrome node and starts both connecting to the hub. You can also use the separate templates for just FireFox and Chrome node builds and deploy. Please let me know if it's working for You ;)

[jr00n]

Changes supplied in #5