Increasing Shared Memory Size

Increasing Shared Memory Size To prevent crashes from happening when running {{ defs.app.friendly_name }} inside a Docker container, the size of the shared memory located at `/dev/shm` must be increased. The issue is documented [here]. By default, the size is 64MB, which is not enough. It is recommended to use a size of 2GB. This value is arbitrary, but known to work well. Setting the size of `/dev/shm` can be done via two method: - By adding the `--shm-size 2g` parameter to the `docker run` command. See the [Usage](#usage) section for more details. - By using shared memory of the host, by mapping `/dev/shm` via the parameter `-v /dev/shm:/dev/shm` of the `docker run` command.

Allowing the membarrier System Call To properly work, recent versions of {{ defs.app.friendly_name }} need the `membarrier` system call. Without it, tabs would frequently crash. Docker uses [seccomp profile] to restrict system calls available to the container. Before Docker version `20.03.0`, the `membarrier` system call was not allowed in the default profile. If you run a such version, you can use one of the following solutions, from the most to the least secure, to provide the container permission to use this sytem call: 1. Run the container with a custom seccomp profile allowing the `membarrier` system call. The [latest official seccomp profile] can be used. Download the file and then add the following parameter when creating the container: `--security-opt seccomp=/path/to/seccomp_profile.json`. 2. Run the container without the default seccomp profile (thus allowing all system calls). Use the following parameter when creating the container: `--security-opt seccomp=unconfined`. 3. Run the container in privileged mode. This effectively disables usage of seccomp. Add the `--privileged` parameter when creating the container.

Sound Support For {{ defs.app.friendly_name }} to be able to use the audio device available on the host, `/dev/snd` must be exposed to the container by adding the `--device /dev/snd` parameter to the `docker run` command.

Setting {{ defs.app.friendly_name }} Preferences Via Environment Variables {{ defs.app.friendly_name }} preferences can be set via environment variables passed to the container. During the startup, a script process all these variables and modify the preference file accordingly. The name of the environment variable must start with `FF_PREF_`, followed by a string of your choice. For example, `FF_PREF_MY_PREF` is a valid name. The content of the variable should be in the format `NAME=VAL`, where `NAME` is the name of the preference (as found in the `about:config` page) and `VAL` is its value. A value can be one of the following types: - string - integer - boolean It is important to note that a value of type `string` should be surrounded by double quotes. Other types don't need them. For example, to set the `network.proxy.http` preference, one would pass the environment variable to the container by adding the following argument to the `docker run` command: ``` -e "FF_PREF_HTTP_PROXY=network.proxy.http=\"proxy.example.com\"" ``` If a preference needs to be *removed*, its value should be set to `UNSET`. For example: ``` -e "FF_PREF_HTTP_PROXY=network.proxy.http=UNSET" ``` **NOTE**: This is an advanced usage and it is recommended to set preferences via {{ defs.app.friendly_name }} directly.

Troubleshooting

Crashes If {{ defs.app.friendly_name }} is crashing frequently, make sure that: - The size of the shared memory located at `/dev/shm` has been increased. See the [Increasing Shared Memory Size](#increasing-shared-memory-size) section for more details. - The `membarrier` system call is not blocked by Docker. See the [Allowing the membarrier System Call](#allowing-the-membarrier-system-call) for more details. - Make sure the kernel of your Linux distribution is up-to-date.

here https://bugzilla.mozilla.org/show_bug.cgi?id=1338771#c10 seccomp profile https://docs.docker.com/engine/security/seccomp/ latest official seccomp profile https://github.com/moby/moby/blob/master/profiles/seccomp/default.json