From d59b7e1dffb3d3c8360a9d895a6fb69bcf0a7c3a Mon Sep 17 00:00:00 2001 From: Duc-Tam Nguyen Date: Mon, 15 Jun 2026 12:30:07 +0700 Subject: [PATCH] Set IN_DOCKER on the Ubuntu CI test job The GitHub Ubuntu runner disables unprivileged user namespaces with AppArmor, so Chrome's sandbox cannot initialize and the new secure default (sandbox on) makes Chrome refuse to start. IN_DOCKER is the documented escape hatch for that case, so set it on the Ubuntu leg of the test job. It also exercises the container code path. macOS does not need the flag, so it stays empty there. --- .github/workflows/ci.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 28289b7..1905f04 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -48,9 +48,15 @@ jobs: run: go vet ./... - name: build run: go build ./... + # The GitHub Ubuntu runner disables unprivileged user namespaces (AppArmor), + # so Chrome's sandbox cannot initialize there and the secure default would + # make it refuse to start. IN_DOCKER is kage's documented escape hatch for + # exactly that case, and setting it here also exercises the container path. + # macOS does not need it, so it stays empty on that leg. - name: test env: KAGE_CHROME: ${{ steps.chrome.outputs.chrome-path }} + IN_DOCKER: ${{ matrix.os == 'ubuntu-latest' && '1' || '' }} run: go test -race -count=1 -coverprofile=coverage.out ./... - name: coverage summary if: matrix.os == 'ubuntu-latest'