The browser on your own Linux server

This page is for a Linux server of your own that you added to Brainwrite (see Add your own server). It does not apply to Brainwrite Cloud: if you see this message on your Cloud, contact support.

What you see

A bot's browser does not start, and the app says:

This host blocks the sandbox the browser runs in (AppArmor on Ubuntu 23.10+).

Ubuntu 23.10 and later, including 24.04, stop programs from creating the kind of sandbox Chrome uses unless an AppArmor profile allows that program. Brainwrite never turns Chrome's sandbox off by itself, so the browser stops instead.

Do not work around it by turning the sandbox off, or by turning off Ubuntu's restriction for the whole server (kernel.apparmor_restrict_unprivileged_userns). Both leave every page a bot opens less contained.

Allow it for one copy of Chrome

An administrator with sudo on the server allows the sandbox for one copy of Chrome that only root can change. Run these as the administrator, replacing brainwrite with the user Brainwrite runs as, and VERSION with the folder name find shows.

1. Find the Chrome that Brainwrite downloaded:

   sudo find /home/brainwrite/.agent-browser/browsers -type f -name chrome -executable

2. Copy its whole folder, libraries included, to a place only root can write:

   sudo install -d -o root -g root -m 0755 /opt/brainwrite-browser
   sudo cp -R /home/brainwrite/.agent-browser/browsers/chrome-VERSION /opt/brainwrite-browser/
   sudo chown -R root:root /opt/brainwrite-browser/chrome-VERSION
   sudo chmod -R go-w /opt/brainwrite-browser/chrome-VERSION

3. Save this as /etc/apparmor.d/brainwrite-chrome, with the same VERSION. Keep the exact path to chrome: a pattern, or a path the Brainwrite user can write, would let other programs claim the same exemption.

   abi <abi/4.0>,
   include <tunables/global>
   
   profile brainwrite-chrome /opt/brainwrite-browser/chrome-VERSION/chrome flags=(unconfined) {
     userns,
   
     include if exists <local/brainwrite-chrome>
   }

4. Load the profile:

   sudo apparmor_parser -r /etc/apparmor.d/brainwrite-chrome

5. Point Brainwrite at that copy: add AGENT_BROWSER_EXECUTABLE_PATH=/opt/brainwrite-browser/chrome-VERSION/chrome to the environment Brainwrite's service starts with, then restart the service.

Then ask the bot to open its browser again.

When Chrome updates

The profile names one exact copy, so a newer Chrome that Brainwrite downloads later is not covered and is not used: Brainwrite keeps using the copy in /opt. To move to a newer Chrome, repeat the steps with its folder and update AGENT_BROWSER_EXECUTABLE_PATH.

Missing libraries

If the message instead says the server is missing libraries the browser needs, run the command it shows (sudo brainwritebot browser install --with-deps) on the server, then try again.