[Bug]: Failed to launch the browser process!\nmkdir: cannot create directory '//.local': Permission denied

[HansMusterWhatElse]

Minimal, reproducible example

const browser = await puppeteer.launch({
      headless: "new"
      executablePath: executablePath,  // /usr/bin/google-chrome
      userDataDir: userDataDirective,  // ./tmp
      args: DEFAULT_PUPPETEER_ARGS,
    });

 const page = await browser.newPage();

  await page.setContent(htmlTemplate, {
    waitUntil: "domcontentloaded",
  });
  
  await page.addStyleTag({ path: `${process.cwd()}/dist/src/styles.css` });

  const pdfBuffer = await page.pdf({
    format: "A4",
    printBackground: true,
  });

  return pdfBuffer;

const DEFAULT_PUPPETEER_ARGS = [
  "--disable-features=IsolateOrigins",
  "--disable-site-isolation-trials",
  "--autoplay-policy=user-gesture-required",
  "--disable-background-networking",
  "--disable-background-timer-throttling",
  "--disable-backgrounding-occluded-windows",
  "--disable-breakpad",
  "--disable-client-side-phishing-detection",
  "--disable-component-update",
  "--disable-default-apps",
  "--disable-dev-shm-usage",
  "--disable-domain-reliability",
  "--disable-extensions",
  "--disable-features=AudioServiceOutOfProcess",
  "--disable-gpu",
  "--disable-hang-monitor",
  "--disable-ipc-flooding-protection",
  "--disable-notifications",
  "--disable-offer-store-unmasked-wallet-cards",
  "--disable-popup-blocking",
  "--disable-print-preview",
  "--disable-prompt-on-repost",
  "--disable-renderer-backgrounding",
  "--disable-setuid-sandbox",
  "--disable-speech-api",
  "--disable-sync",
  "--hide-scrollbars",
  "--ignore-gpu-blacklist",
  "--metrics-recording-only",
  "--mute-audio",
  "--no-default-browser-check",
  "--no-first-run",
  "--no-pings",
  "--no-sandbox",
  "--no-zygote",
  "--password-store=basic",
  "--use-gl=swiftshader",
  "--use-mock-keychain",
];

Error string

Failed to launch the browser process!\nmkdir: cannot create directory '//.local': Permission denied\ntouch: cannot touch '//.local/share/applications/mimeapps.list': No such file or directory\nchrome_crashpad_handler: --database is required\nTry 'chrome_crashpad_handler --help' for more information.\n[56:56:0831/112902.177517:ERROR:socket.cc(120)] recvmsg: Connection reset by peer (104)\n\n\nTROUBLESHOOTING: https://pptr.dev/troubleshooting\n", "stackTrace": "Error: Failed to launch the browser process!\nmkdir: cannot create directory '//.local': Permission denied\ntouch: cannot touch '//.local/share/applications/mimeapps.list': No such file or directory\nchrome_crashpad_handler: --database is required\nTry 'chrome_crashpad_handler --help' for more information.\n[56:56:0831/112902.177517:ERROR:socket.cc(120)] recvmsg: Connection reset by peer (104)\n\n\nTROUBLESHOOTING: https://pptr.dev/troubleshooting\n\n at Interface.onClose (/node_modules/.pnpm/@puppeteer+browsers@1.7.0/node_modules/@puppeteer/browsers/lib/cjs/launch.js:277:24)\n at Interface.emit (node:events:526:35)\n at Interface.close (node:internal/readline/interface:527:10)\n at Socket.onend (node:internal/readline/interface:253:10)\n at Socket.emit (node:events:526:35)\n at endReadableNT (node:internal/streams/readable:1376:12)\n at process.processTicksAndRejections (node:internal/process/task_queues:82:21)

Bug behavior

• Flaky
• PDF

Background

Description

The code worked without any issues when running the container locally but once deployed to k8s it caused the aforementioned error . Various implemented workarounds did not solve the issues [1] [2] and later I discovered that the new headless flag was causing the issue.

Changing this to true instead solved the issue.

Dockerfile (Puppeteer relevant commands)

 RUN apt-get update && apt-get install gnupg wget -y && \
    wget --quiet --output-document=- https://dl-ssl.google.com/linux/linux_signing_key.pub | gpg --dearmor > /etc/apt/trusted.gpg.d/google-archive.gpg && \
    sh -c 'echo "deb [arch=amd64] http://dl.google.com/linux/chrome/deb/ stable main" >> /etc/apt/sources.list.d/google.list' && \
    apt-get update && \
    apt-get install google-chrome-stable -y --no-install-recommends && \
    rm -rf /var/lib/apt/lists/*

I would be surprised to if those information are enough for you to investigate the issue - please let me know what further information I can provide to help you troubleshoot the issue.

[1] chrome-php/chrome#106
[2] https://incolumitas.com/2021/01/23/run-xvfb-on-aws-lambda-container/

Expectation

Generate a pdf while applying an external CSS stylesheet.

Reality

The aforementioned error.

Puppeteer configuration file (if used)

No response

Puppeteer version

21.1.1

Node version

18.15.0

Package manager

pnpm

Package manager version

8.6.2

Operating system

Linux

[github-actions]

The issue has been labeled as confirmed by the automatic analyser.
Someone from the Puppeteer team will take a look soon!

---

Analyzer run

[OrKoN]

Can you start the binary without Puppeteer in that environment? Is the environment complete there? it looks like it might be missing some permissions and some typical directory structure?

[HansMusterWhatElse]

Can you start the binary without Puppeteer in that environment? Is the environment complete there? it looks like it might be missing some permissions and some typical directory structure?

I will try to figure that out. It runs in the exactly the same container on our dev environment as I did successfully on my local machine. For testing purposes I've also run the container under root permissions but without any success.

Funny enough I also do get a different font in the generated pdf file ...

Live environment (k8s):

Running the container locally:

I will investigate if this could also be related to the same problem. The fonts should be installed via the installation of Chrome ..

[OrKoN]

Font issue might be related to https://bugs.chromium.org/p/chromium/issues/detail?id=1470313

[OrKoN]

@HansMusterWhatElse is it possible that it runs in readonly mode in k8s? similar to #11023

[HansMusterWhatElse]

@HansMusterWhatElse is it possible that it runs in readonly mode in k8s? similar to #11023

Hi @OrKoN ,

Sorry for my late response - unfortunately I did not have time to follow up on your other proposal as well .. 😅

I am not sure that I can follow you regarding this particular proposal - does the behavior when running Puppeteer with the new flag change in any way when it comes to what files at what time are being written to the filesystem? Without the new flag everything works so I am not sure why adding a readonly mode which only restricts the container further would help here?

From what I understand a --user-data-dir is needed for both cases thus I assume that writing privileges should not be an issue? (it currently runs without a mounted volume and creates the user dir directly in the container)

[OrKoN]

@HansMusterWhatElse I am not suggesting turning on the readonly mode but turning it off if if it currently runs in that mode. It also needs access to $HOME/.config in addition to the user data dir. Note that the old headless is a technically different browser implementation compared to the regular Chrome (see https://developer.chrome.com/articles/new-headless/).

I am gonna close this issue as it is very likely related to specific limitations in the container infrastructure and not something we can fix in Puppeteer.