3

I have a program written in go using go-rod that launches a headless chromium and connects to the debug port to perform some web related operation. The usage pattern is equivalent to selenium or puppeteer in python.

It works when I run the program from the command line in an ssh session.

I now need to execute this program nightly. Unfortunately, running it as a cron job doesn't work. The error message is Failed to get the debug url: /system.slice/cron.service is not a snap cgroup.

The security provided by snap is a good thing and I want to preserve it.

How would it be possible to run my program nightly with snap chromium ?

Edit: following the suggestion of noisefloor, I have setup a systemd timer to run my program as a user service. It works, even if I’m logged out and after a reboot. Here is the recipe.

  1. mkdir -p ~/.config/systemd/user

  2. loginctl enable-linger <user> : tells systemd that <user> has some systemd services and timers stored in ~/.config/systemd/user. <user> is to be replaced with your account name.

  3. create the service file ~/.config/systemd/user/myservice.service containing

[Unit]
Description=My service

[Service]
ExecStart=<cmd args>

[Install]
WantedBy=multi-user.target
  1. create the timer file named ~/.config/systemd/user/myservice.timer containing
[Unit]
Description=Timer for my service

[Timer]
# start myservice every night at 05:00:00 in the morning
OnCalendar=*-*-* 5:00:00
Persistent=true

[Install]
WantedBy=timers.target
  1. systemctl --user start myservice.timer

  2. to check that the timer is running: systemctl --user list-timers

  3. to enable the timer after a reboot systemctl --user enable myservice.timer

It is a bit more tedious than adding a crontab line, but we benefit from the cgroup sandboxing protection.

Note: the systemctl commands don't have to be executed with sudo or as root.

3
  • Please edit your question and add the line you add to cron which runs you program.
    – noisefloor
    Commented May 24 at 7:02
  • @noisefloor I didn’t start chromium directly from cron. I start a program I wrote in Go that uses the go-rod module and its launcher who launches chromium. If chromium needs special environment variables to be set, I can take care to do it. I just need to know what chromium snap needs.
    – chmike
    Commented May 24 at 10:08
  • Glad to see it works :-) Yes, it is a bit more tedious than adding a crontab line, but you have way more control on what the units do when and where.
    – noisefloor
    Commented May 24 at 17:33

1 Answer 1

3

Everything started by systemd, which includes the user session as well as cron jobs, runs within a slice Unit. slice Units use in the background the Linux Kernel feature named cgroups to group and separate resources assigned to processes / process groups from each use. Processes from cgroup A cannot access resources from cgroup B.

cron runs inside the system.slice while the Chromium snap runs typically within the user1xxx.slice (whereas 1xxx is the user number assigned by the system) which runs within the user.slice. Thus, the Go program is started by cron cannot access resources of Chromium, as they run in different slices / cgroups.

The hierarchical order and grouping of slices can be output in the terminal by running the command systemd-cgls.

A possible solution for the problem may be to start the Go program not via cron, but start it via a systemd Timer Unit which is run as the same user which runs the Chromium snap. This will move the execution of the Go program into the user1xxx.slice, thus it is within the same slice as Chromium.

2
  • Thank you very much for the explanation. Would the systemd Timer Unit method work even if the user does not have an open session ?
    – chmike
    Commented May 24 at 13:56
  • 1
    Timer Units start a Service Unit and within the Service Unit the directive User=USERNAME is available, which runs the service unit as the named user (instead of root, the default for service units).
    – noisefloor
    Commented May 24 at 14:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .