Hacktoberfest 2026：维护者为十月标记出来的 issue，仍然开放、适合新手。 浏览 Hacktoberfest issue

[Bug]: CRAWL4AI_CHROMIUM_SANDBOX=true does not remove --no-sandbox (v0.9.4 Docker image)

已关闭
  • 哪里不对？
#2,371 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 2 天内回复

还没有人认领这个 Issue。

评估

难度
3/5
预计耗时
1-2 天
新手友好度
50/100
Issue 类型
缺陷
描述清晰度
描述清楚
活跃度
活跃
技术栈
docker, playwright, python
领域
backend, security

调研方向

Start in crawl4ai/browser_manager.py, where _build_browser_args and ManagedBrowser.build_browser_flags unconditionally add --no-sandbox, then check api.py at the three sites that build BrowserConfig from extra_args. Confirm that chromium_sandbox is never passed to Playwright. Done means that with CRAWL4AI_CHROMIUM_SANDBOX=true the flag is absent from the launched Chromium command line, while the default behaviour is unchanged. Verify by listing the process args inside the container after calling /html.

由索引模型根据 Issue 内容生成。

描述

crawl4ai version

0.9.4 (Docker image unclecode/crawl4ai:0.9.4)

Expected Behavior

With CRAWL4AI_CHROMIUM_SANDBOX=true, Chromium should start without --no-sandbox, so that Chromium's own sandbox is on.

Current Behavior

Every Chromium process in the container still has --no-sandbox on its command line: the permanent browser started at boot, and the browsers started by /html, /md and /crawl. The result is the same under Docker's default confinement and with AppArmor unconfined.

From reading the source, the flag is added after the switch is applied:

  • crawl4ai/browser_manager.py, _build_browser_args (about line 1092), and ManagedBrowser.build_browser_flags add --no-sandbox unconditionally. The server's _browser_extra_args() filter only removes the flag from its own extra_args, so it cannot remove the one the library adds.
  • chromium_sandbox is never passed to Playwright.
  • api.py builds BrowserConfig from the config file's extra_args at three sites without applying the switch.
Is this reproducible?

Yes

Inputs Causing the Bug
- URL(s): any (a local page is enough)
- Settings used: -e CRAWL4AI_CHROMIUM_SANDBOX=true, plus an API token
- Input data (if applicable): none
Steps to Reproduce
1. Run the 0.9.4 image with CRAWL4AI_CHROMIUM_SANDBOX=true.
2. Call /html, /md and /crawl once each.
3. In the container, list Chromium's command lines (ps -eo args | grep chrom).
4. Every line contains --no-sandbox.
Code snippets
# No client code is involved; the flag is on the browser's own command line.

Supporting Information

OS

Linux (Ubuntu 24.04 host, Docker 29.9.0, container with cap_drop: ALL, no-new-privileges, read-only root)

Python version

Not recorded (the one in the Docker image).

Browser

Chromium, as installed in the Docker image.

Browser version

Not recorded.

Error logs & Screenshots (if applicable)

None. Nothing is logged: the switch is accepted and has no effect.

Additional context

Chromium can start sandboxed in this container: through Playwright with chromium_sandbox=True, it works once Docker's default seccomp profile is extended to allow chroot, clone, setns and unshare. So the missing piece is on the Crawl4AI side. If the switch is meant to be a no-op, the docs could say so.

主要语言
Python
星标
85.9k
派生
8.9k
平均合并
4 天 20 分钟
30 天内合并 PR
19

环境准备

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

unclecode/crawl4ai 的其他 Issue

查看 unclecode/crawl4ai 的全部 Issue

相似的 Issue

更多 Python Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。