Docker中Puppeteer用RUN执行失败但CMD正常，原因何在？

问题概述 #

• 构建包含Puppeteer和Chrome的Docker镜像（参考官方文档）
• 计划在镜像发布前的单独阶段运行单元测试
• 使用RUN执行Puppeteer单元测试时失败
• 使用CMD在容器启动时运行Puppeteer则正常

使用RUN时的报错 #

执行后出现如下错误（已大量搜索解决方案）：

0.629   1) chrome
0.629        should start
0.629          load some page, then exit:
0.629      Error: Failed to launch the browser process!
0.629 [18:18:1129/161517.426236:FATAL:zygote_host_impl_linux.cc(127)] No usable sandbox! Update your kernel or see https://chromium.googlesource.com/chromium/src/+/main/docs/linux/suid_sandbox_development.md for more information on developing with the SUID sandbox. If you want to live dangerously and need an immediate workaround, you can try using --no-sandbox.
0.629 [1129/161517.432286:ERROR:file_io_posix.cc(144)] open /sys/devices/system/cpu/cpu0/cpufreq/scaling_cur_freq: No such file or directory (2)
0.629 [1129/161517.432534:ERROR:file_io_posix.cc(144)] open /sys/devices/system/cpu/cpu0/cpufreq/scaling_max_freq: No such file or directory (2)
0.629
0.629
0.629 TROUBLESHOOTING: https://pptr.dev/troubleshooting
0.629
0.629       at Interface.onClose (node_modules/@puppeteer/browsers/lib/cjs/launch.js:271:24)
0.629       at Interface.emit (node:events:529:35)
0.629       at Interface.close (node:internal/readline/interface:534:10)
0.629       at Socket.onend (node:internal/readline/interface:260:10)
0.629       at Socket.emit (node:events:529:35)
0.629       at endReadableNT (node:internal/streams/readable:1368:12)
0.629       at process.processTicksAndRejections (node:internal/process/task_queues:82:21)

使用CMD时的结果 #

执行docker run命令后测试通过：

chrome
    should start
      ✔ load some page, then exit (568ms)


  1 passing (573ms)

已尝试的解决操作 #

尽管不想使用--no-sandbox，但尝试后仍无效。无法理解RUN和CMD为何表现不同。针对“No usable sandbox! Update your kernel”提示，在Docker中添加了允许非特权用户创建命名空间的配置：

RUN echo 'kernel.unprivileged_userns_clone=1' > /etc/sysctl.d/00-local-userns.conf
RUN service procps restart

检查了命名空间，确认存在user命名空间，构建镜像时也存在，但可能对非特权用户创建命名空间的机制理解有误。此外尝试--disable-setuid-sandbox也无效果。

相关文件详情 #

Dockerfile #

FROM node:18-bookworm-slim as builder

RUN apt-get update \
    && apt-get install -y wget gnupg \
    && wget -q -O - https://dl-ssl.google.com/linux/linux_signing_key.pub | apt-key add - \
    && sh -c 'echo "deb [arch=amd64] http://dl.google.com/linux/chrome/deb/ stable main" >> /etc/apt/sources.list.d/google.list' \
    && apt-get update \
    && apt-get install -y google-chrome-stable fonts-ipafont-gothic fonts-wqy-zenhei fonts-thai-tlwg fonts-kacst fonts-freefont-ttf libxss1 \
      --no-install-recommends \
    && rm -rf /var/lib/apt/lists/*

WORKDIR /usr/chromeservice

COPY package*.json .
COPY .puppeteerrc.cjs .

RUN npm install

ADD https://github.com/Yelp/dumb-init/releases/download/v1.2.2/dumb-init_1.2.2_x86_64 /usr/local/bin/dumb-init
RUN chmod +x /usr/local/bin/dumb-init

RUN echo 'kernel.unprivileged_userns_clone=1' > /etc/sysctl.d/00-local-userns.conf
RUN service procps restart

RUN groupadd -r pptruser && useradd -r -g pptruser -G audio,video pptruser
RUN chown -R pptruser:pptruser .
RUN mkdir -p /home/pptruser/Downloads
RUN chown -R pptruser:pptruser /home/pptruser
USER pptruser

COPY --chown=pptruser:pptruser test.js .

FROM builder as test-stage

# Run tests, then get next version, and install only production
ENV NODE_PATH=.

# This fails
#RUN dumb-init -- node node_modules/mocha/bin/mocha

CMD dumb-init -- node node_modules/mocha/bin/mocha

测试文件test.js #

var assert = require('assert');
var puppeteer = require('puppeteer');

describe('chrome', function () {
  describe('should start', function () {
    it('load some page, then exit', async function () {
        
        let browser = await puppeteer.launch(
            { 
                headless: 'new',
                ignoreDefaultArgs: ['--hide-scrollbars']
            });

        await browser.close();

    });
  });
});

内容的提问来源于stack exchange，提问作者Samuel