Run as non-root user and add optional no-sandbox flag

puppet/.dockerignore

@@ -0,0 +1 @@
+node_modules

puppet/Dockerfile

@@ -6,7 +6,10 @@ RUN echo $'\
 @edge http://dl-cdn.alpinelinux.org/alpine/edge/community' >> /etc/apk/repositories
 
 RUN apk add --no-cache chromium@edge
+
 WORKDIR /opt/mautrix-amp/puppet
+RUN chown node:node /opt/mautrix-amp/puppet
+USER node
 COPY package.json yarn.lock ./
 RUN yarn --production && rm -rf node_modules/puppeteer/.local-chromium
 

puppet/src/main.js

@@ -24,12 +24,14 @@ import MessagesPuppeteer from "./puppet.js"
 const args = arg({
 	"--config": String,
 	"--browser": String,
+	"--no-sandbox": Boolean,
 	"-c": "--config",
 	"-b": "--browser",
 })
 
 const configPath = args["--config"] || "config.json"
 MessagesPuppeteer.executablePath = args["--browser"] || MessagesPuppeteer.executablePath
+MessagesPuppeteer.noSandbox = args["--no-sandbox"]
 
 console.log("Reading config from", configPath)
 const config = JSON.parse(fs.readFileSync(configPath).toString())

puppet/src/puppet.js

@@ -26,6 +26,7 @@ export default class MessagesPuppeteer {
 	static profileDir = "./profiles"
 	static executablePath = undefined
 	static disableDebug = false
+	static noSandbox = false
 	static viewport = { width: 1920, height: 1080 }
 	static url = "https://messages.google.com/web/"
 
@@ -64,6 +65,7 @@ export default class MessagesPuppeteer {
 		this.browser = await puppeteer.launch({
 			executablePath: MessagesPuppeteer.executablePath,
 			userDataDir: this.profilePath,
+			args: MessagesPuppeteer.noSandbox ? ["--no-sandbox"] : undefined,
 			headless: MessagesPuppeteer.disableDebug || !debug,
 			defaultViewport: MessagesPuppeteer.viewport,
 		})
@@ -133,8 +135,12 @@ export default class MessagesPuppeteer {
 	 */
 	async stop() {
 		this.taskQueue.stop()
-		await this.page.close()
-		await this.browser.close()
+		if (this.page) {
+			await this.page.close()
+		}
+		if (this.browser) {
+			await this.browser.close()
+		}
 		this.log("Everything stopped")
 	}