feat: Add Fluxbox toolbar removal and Firejail security enhancements

[sanjay7178]

This PR implements comprehensive toolbar removal for Fluxbox window manager and adds Firejail security enhancements for the Chromium browser.

Changes Made

Fluxbox Toolbar Removal

• Custom Fluxbox Configuration: Added file with and
• Custom Startup Script: Created script that uses multiple methods to hide the toolbar:
  • Uses commands to toggle toolbar visibility
  • Dynamically appends toolbar hiding settings to the init file
  • Restarts Fluxbox to ensure settings are applied
• Modified X Session: Updated to use the custom startup script instead of direct Fluxbox execution

Firejail Security Enhancements

• Secure Browser Profile: Added with comprehensive security restrictions:
  • Filesystem isolation with private tmp, dev, and cache
  • Restricted access to system directories
  • Memory and process limits (2GB RAM, 1 hour CPU, 1GB file size)
  • Disabled unnecessary features (DVD, CD, TV, video, sound)
  • Security features enabled (seccomp, capability dropping, no root access)

Container Improvements

• Enhanced Dockerfile: Updated to copy and properly configure all new files
• Proper Permissions: Set executable permissions on startup scripts
• File Ownership: Ensured proper ownership of Fluxbox configuration files

Testing

• Successfully built and tested container images
• Verified clean desktop environment without visible toolbar
• Confirmed RDP access functionality maintained

Security Benefits

• Reduced attack surface through Firejail sandboxing
• Resource usage controls prevent resource exhaustion
• Minimal file system access reduces data exposure risk
• Clean desktop interface improves user experience

The changes provide a more secure and user-friendly RDP environment while maintaining full browser functionality.

[sanjay7178]

Pull Request Overview

This PR adds a custom Fluxbox configuration and startup script to remove the toolbar, and strengthens Chromium security by sandboxing it with Firejail.

* Introduces Fluxbox init/menu files and a startup script to hide the toolbar

* Builds and installs a Firejail profile for Chromium and updates Dockerfile to launch the browser under the sandbox

* Removes xterm support and updates documentation to reflect RDP-only use case

Reviewed Changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 3 comments.
Show a summary per file

Comments suppressed due to low confidence (3)

@surya-d-naidu once check this copilot review

[Copilot]

Pull Request Overview

This PR enhances the RDP container by removing the Fluxbox toolbar for a cleaner desktop and sandboxing Chromium with Firejail for improved security.

• Introduces Fluxbox configuration, menu, and startup scripts to automatically hide and disable the toolbar
• Updates the Dockerfile to install and configure Firejail, integrate the new Fluxbox scripts, and remove xterm
• Adds a Firejail profile and updates supervisor/entrypoint configurations to launch Chromium under the sandbox

Reviewed Changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
xorg.conf	Adds Xorg modules for xrdp and Fluxbox
fluxbox-startup	New startup script to launch Fluxbox and hide toolbar
fluxbox-menu	Custom Fluxbox menu for secure RDP environment
fluxbox-init	Minimal Fluxbox init settings (toolbar disabled)
debian.dockerfile	Installs Firejail, removes xterm, integrates scripts
conf.d/xterm.conf	Removes xterm supervisor config
chromium-secure.profile	Firejail profile locking down Chromium
browser_conf/chromium.conf	Updates supervisor command to use Firejail
base_entrypoint.sh	Drops obsolete AUTO_START_XTERM echo
README.md	Updates README for RDP-focused, secure Chromium image

Comments suppressed due to low confidence (2)

debian.dockerfile:12

• Embedding a default password in the Dockerfile is insecure. Consider requiring the password to be provided at runtime or sourced from a secret manager.

ARG DEF_XRDP_PASSWORD=money4band

README.md:15

• The leading +- looks like a leftover diff marker. Update to a standard list item (- **RDP-Ready**) for correct Markdown rendering.

+- **RDP-Ready**: Accessible via any RDP client with secure authentication

[Copilot]

The .xsession script uses ${STARTING_WEBSITE_URL}, but elsewhere supervisor uses ENV_STARTING_WEBSITE_URL. Align the environment variable names or document the mapping to ensure the URL is passed correctly.

Suggested change

echo 'firejail --profile=/etc/firejail/chromium-secure.profile /usr/bin/chromium --no-sandbox --disable-dev-shm-usage --start-maximized --disable-background-networking --disable-background-timer-throttling --disable-backgrounding-occluded-windows --disable-renderer-backgrounding --disable-features=TranslateUI --disable-ipc-flooding-protection "${STARTING_WEBSITE_URL}" &' >> /home/${XRDP_USER}/.xsession && \

echo 'firejail --profile=/etc/firejail/chromium-secure.profile /usr/bin/chromium --no-sandbox --disable-dev-shm-usage --start-maximized --disable-background-networking --disable-background-timer-throttling --disable-backgrounding-occluded-windows --disable-renderer-backgrounding --disable-features=TranslateUI --disable-ipc-flooding-protection "${ENV_STARTING_WEBSITE_URL}" &' >> /home/${XRDP_USER}/.xsession && \

[Copilot]

[nitpick] An empty rootCommand could be confusing; either remove this line or add a comment explaining why it’s intentionally blank.

Suggested change

	# Disable desktop icons and background
	# Disable desktop icons and background
	# Intentionally left blank to disable desktop icons and background