This issue has been created
There are 8 updates, 2 comments.
 
 
XWiki Platform / cid:jira-generated-image-avatar-bb54b551-c2bd-4b8e-9026-49e86c0c2515 XWIKI-23703 Open

PDF export using the headless Chrome Docker container doesn't work anymore

 
View issue   ยท   Add comment
 

Issue created

 
cid:jira-generated-image-avatar-1ad1baff-7218-4f39-b2d7-ac084b7a2f6f Marius Dumitru Florea created this issue on 10/Nov/25 11:24
 
Summary: PDF export using the headless Chrome Docker container doesn't work anymore
Issue Type: cid:jira-generated-image-avatar-bb54b551-c2bd-4b8e-9026-49e86c0c2515 Bug
Affects Versions: 16.10.14, 17.4.7, 17.9.0
Assignee: Unassigned
Components: Export - PDF
Created: 10/Nov/25 11:24
Environment: Linux (Ubuntu 25.10)
Labels: regression
Priority: cid:jira-generated-image-static-blocker-e387b6eb-cbaf-424e-8dab-ea7d5cf67394 Blocker
Reporter: Marius Dumitru Florea
Description:

Follow these steps to reproduce:

  • Delete the cached Docker image:
    docker image rm zenika/alpine-chrome:124
    
  • Start a clean XWiki 17.9.0
  • Login as Admin and go to Wiki Administration
  • From the PDF Export administration section set the Generator to "Chrome Docker Container"
  • Save

Expected: the generator should be available in the Status section (at the top of the administration section)
Actual: the generator is not available. The following error can be seen in the logs:

docker: Error response from daemon: failed to create task for container: failed to create shim task: OCI runtime create failed: runc create failed: unable to start container process: error during container init: error closing exec fds: get handle to /proc/thread-self/fd: unsafe procfs detected: openat2 fsmount:fscontext:proc/thread-self/fd/: function not implemented: unknown
 
 

8 updates

 
cid:jira-generated-image-avatar-1ad1baff-7218-4f39-b2d7-ac084b7a2f6f Changes by Marius Dumitru Florea on 10/Nov/25 11:33
 
Fix Version: 17.10.0-rc-1
Fix Version: 16.10.15
Fix Version: 17.4.8
Development Priority: High
Documentation: N/A
Documentation in Release Notes: N/A
Assignee: Marius Dumitru Florea
Tests: Integration
 
 

2 comments

 
cid:jira-generated-image-avatar-1ad1baff-7218-4f39-b2d7-ac084b7a2f6f Marius Dumitru Florea on 10/Nov/25 11:27
 

I thought that using the zenika/alpine-chrome:124 tag ensures a stable behavior, but it seems this tag is regularly updated. Although I did the upgrade XWIKI-22883 at the start of the year, the tag https://hub.docker.com/r/zenika/alpine-chrome/tags was last updated a few days ago. This means that depending on the cached Docker image you have, you may get a different behavior.

 
cid:jira-generated-image-avatar-1ad1baff-7218-4f39-b2d7-ac084b7a2f6f Marius Dumitru Florea on 10/Nov/25 11:31
 

It looks like the latest version of Chrome 124.x uses some system calls that are not included in the seccomp profile we're using, and thus are forbidden, preventing Chrome from starting. Or maybe those system calls were activated by a recent update of the Linux kernel, i.e. the same version of Chrome is using more recent / modern system calls when the kernel supports them.