Details
-
Bug
-
Resolution: Fixed
-
Major
-
14.4.2, 14.6
-
None
-
Integration
-
Easy
-
N/A
-
N/A
-
Description
The reason is that by default Jetty runs using the jetty user which doesn't have access to the Docker socket so XWiki cannot manage the headless Chrome Docker container (create, start, stop). The Jetty Docker documentation mentions this:
By default, this image starts as user root and uses Jetty's setuid module to drop privileges to user jetty after initialization.
Running XWiki as root (in production) is risky, but it's a valid use case I think, so as long we keep the code to manage the Docker containers from within XWiki we should have a way to test it and for this we need to run the Jetty container as root.
Note that when using the Tomcat servlet engine XWiki runs as root so it has access to the Docker socket.