feat: Add Fluxbox toolbar removal and Firejail security enhancements

README.md

@@ -7,15 +7,15 @@ A Lightweight, Ready-to-Use Web Browsing Environment in Docker with VNC Access
 [![Docker Stars](https://img.shields.io/docker/stars/mrcolorrain/vnc-browser?style=flat-square)](https://hub.docker.com/r/mrcolorrain/vnc-browser)
 
 ## Info :information_source:
-VNC-Browser is a minimal, customizable, Linux-based Docker image designed to provide a lightweight environment for browsing the web via VNC.
-This Docker image encapsulates a lightweight, VNC-accessible web browsing environment built on top of Debian and Alpine Linux. It packages a VNC server, noVNC for browser-based VNC access, and the Chromium and Firefox web browsers, providing a compact solution for remotely browsing the web. Whether you're looking to browse securely or need a browsing environment within a containerized setup, VNC-Browser has you covered.
+RDP-Chromium is a minimal, secure, Linux-based Docker image designed to provide a hardened environment for browsing the web via RDP.
+This Docker image encapsulates a secure, RDP-accessible web browsing environment built on Debian Slim. It provides a Chromium web browser in a controlled environment with no shell access, making it ideal for secure browsing scenarios where terminal access must be completely eliminated.
 
 **Key Features ✨**
 
-- **VNC-Ready**: Ready for use with any VNC client or through a web browser using noVNC, offering a user-friendly interface.
-- **Lightweight**: Built on Alpine Linux and Debian Slim, ensuring minimal resource usage.
-- **Customizable**: Set VNC password, initial website URL, auto-start settings for the browser and xterm via environment variables.
-- **Accessible**: Access the VNC server directly or through a browser using noVNC.
+- **RDP-Ready**: Accessible via any RDP client with secure authentication
+- **Lightweight**: Built on Debian Slim, ensuring minimal resource usage
+- **Secure**: No terminal access - shell capabilities completely removed
+- **Browser-Focused**: Optimized specifically for web browsing without system access
 
 ## Available images 📦
 

base_entrypoint.sh

@@ -13,7 +13,6 @@ echo "Lang: ${LANG}"
 echo "LC All: ${LC_ALL}"
 echo "Customize active: ${CUSTOMIZE}"
 echo "Custom entrypoints dir: ${CUSTOM_ENTRYPOINTS_DIR}"
-echo "Autostart xterm: ${AUTO_START_XTERM}"
 echo "-----------------"
 
 # Start Supervisor

browser_conf/chromium.conf

@@ -1,5 +1,5 @@
 [program:chromium]
-command=/usr/bin/chromium --no-sandbox --disable-dev-shm-usage %(ENV_STARTING_WEBSITE_URL)s
+command=firejail --profile=/etc/firejail/chromium-secure.profile /usr/bin/chromium --no-sandbox --disable-dev-shm-usage --disable-background-networking --disable-background-timer-throttling --disable-backgrounding-occluded-windows --disable-renderer-backgrounding --disable-features=TranslateUI --disable-ipc-flooding-protection %(ENV_STARTING_WEBSITE_URL)s
 autostart=%(ENV_AUTO_START_BROWSER)s
 autorestart=true
 stdout_logfile=/var/log/chromium.log

chromium-secure.profile

@@ -0,0 +1,59 @@
+# Firejail profile for Chromium browser - Secure RDP Container
+# This profile provides enhanced security isolation for Chromium
+
+# Network access (remove 'net none' to allow internet access)
+# net none
+
+# Filesystem restrictions
+private-tmp
+private-dev
+private-cache
+private-etc passwd,group,hostname,hosts,nsswitch.conf,resolv.conf,xdg,pulse,fonts
+private-opt none
+private-srv none
+
+# Disable unnecessary features
+nodvd
+nocd
+notv
+nou2f
+novideo
+nosound
+
+# Security features
+seccomp
+caps.drop all
+noroot
+nogroups
+shell none
+disable-mnt
+
+# Block access to system directories
+blacklist /boot
+blacklist /media
+blacklist /mnt
+blacklist /opt
+blacklist /srv
+blacklist /sys
+
+# Allow only necessary directories
+whitelist /tmp/.X11-unix
+whitelist /usr/bin/chromium
+whitelist /usr/lib/chromium
+whitelist /usr/share
+whitelist /etc/fonts
+whitelist /etc/ssl
+whitelist /var/cache/fontconfig
+
+# Memory restrictions
+rlimit-as 2147483648  # 2GB
+rlimit-cpu 3600       # 1 hour
+rlimit-fsize 1073741824  # 1GB
+
+# Process restrictions
+rlimit-nofile 1024
+rlimit-nproc 1000
+
+# Additional security
+apparmor
+machine-id

debian.dockerfile

@@ -9,7 +9,6 @@ ARG DEF_LC_ALL=C.UTF-8
 ARG DEF_CUSTOMIZE=false
 ARG DEF_CUSTOM_ENTRYPOINTS_DIR=/app/custom_entrypoints_scripts
 ARG DEF_AUTO_START_BROWSER=true
-ARG DEF_AUTO_START_XTERM=true
 ARG DEF_DEBIAN_FRONTEND=noninteractive
 ARG DEF_XRDP_USER=rdpuser
 ARG DEF_XRDP_PASSWORD=money4band
@@ -23,7 +22,6 @@ ENV \
     CUSTOMIZE=${DEF_CUSTOMIZE} \
     CUSTOM_ENTRYPOINTS_DIR=${DEF_CUSTOM_ENTRYPOINTS_DIR} \
     AUTO_START_BROWSER=${DEF_AUTO_START_BROWSER} \
-    AUTO_START_XTERM=${DEF_AUTO_START_XTERM} \
     DEBIAN_FRONTEND=${DEF_DEBIAN_FRONTEND} \
     XRDP_PORT=${DEF_XRDP_PORT}
 
@@ -37,45 +35,50 @@ RUN set -e; \
       bash \
       xrdp \
       fluxbox \
-      xterm \
       nano \
       chromium \
       dbus-x11 \
       xvfb \
-      x11-xserver-utils && \
+      x11-xserver-utils \
+      firejail && \
     useradd -m -s /bin/bash "${XRDP_USER}" && \
     echo "${XRDP_USER}:${XRDP_PASSWORD}" | chpasswd && \
+    # create fluxbox directory and secure menu
+    mkdir -p /home/${XRDP_USER}/.fluxbox && \
     # create an .xsession so xrdp will launch Chromium on session start
     echo '#!/bin/sh' > /home/${XRDP_USER}/.xsession && \
-    echo 'exec fluxbox &' >> /home/${XRDP_USER}/.xsession && \
-    echo 'sleep 1' >> /home/${XRDP_USER}/.xsession && \
-    echo '/usr/bin/chromium --no-sandbox --disable-dev-shm-usage --start-maximized "${STARTING_WEBSITE_URL}" &' >> /home/${XRDP_USER}/.xsession && \
-    echo 'if [ "${AUTO_START_XTERM}" = "true" ]; then' >> /home/${XRDP_USER}/.xsession && \
-    echo '  xterm &' >> /home/${XRDP_USER}/.xsession && \
-    echo 'fi' >> /home/${XRDP_USER}/.xsession && \
+    echo 'exec /usr/local/bin/fluxbox-startup &' >> /home/${XRDP_USER}/.xsession && \
+    echo 'sleep 3' >> /home/${XRDP_USER}/.xsession && \
+    echo 'firejail --profile=/etc/firejail/chromium-secure.profile /usr/bin/chromium --no-sandbox --disable-dev-shm-usage --start-maximized --disable-background-networking --disable-background-timer-throttling --disable-backgrounding-occluded-windows --disable-renderer-backgrounding --disable-features=TranslateUI --disable-ipc-flooding-protection "${STARTING_WEBSITE_URL}" &' >> /home/${XRDP_USER}/.xsession && \
     echo '# Keep the session alive' >> /home/${XRDP_USER}/.xsession && \
     echo 'while true; do' >> /home/${XRDP_USER}/.xsession && \
     echo '  sleep 86400' >> /home/${XRDP_USER}/.xsession && \
     echo 'done' >> /home/${XRDP_USER}/.xsession && \
-    chown ${XRDP_USER}:${XRDP_USER} /home/${XRDP_USER}/.xsession && \
-    chmod +x /home/${XRDP_USER}/.xsession && \
     apt autoremove --purge -y && \
     apt clean && \
     rm -rf /var/lib/apt/lists/*
 
+# Fix ownership and permissions after copying all files
+RUN chown -R ${DEF_XRDP_USER}:${DEF_XRDP_USER} /home/${DEF_XRDP_USER}/.fluxbox /home/${DEF_XRDP_USER}/.xsession && \
+    chmod +x /home/${DEF_XRDP_USER}/.xsession
+
 # Create necessary directories for supervisor and custom entrypoints
 RUN mkdir -p /etc/supervisor.d /app/conf.d ${DEF_CUSTOM_ENTRYPOINTS_DIR}
 RUN mkdir -p /var/log/supervisor
 
 # Copy configuration files
 COPY supervisord.conf /etc/supervisor.d/supervisord.conf
-# only bring in xrdp (and xterm) programs, drop VNC configs
-COPY conf.d/xrdp.conf conf.d/xterm.conf conf.d/xvfb.conf /app/conf.d/
+# only bring in xrdp programs, drop VNC and xterm configs
+COPY conf.d/xrdp.conf conf.d/xvfb.conf /app/conf.d/
 COPY base_entrypoint.sh customizable_entrypoint.sh /usr/local/bin/
 COPY browser_conf/chromium.conf /app/conf.d/
+COPY fluxbox-menu /home/${DEF_XRDP_USER}/.fluxbox/menu
+COPY fluxbox-init /home/${DEF_XRDP_USER}/.fluxbox/init
+COPY fluxbox-startup /usr/local/bin/fluxbox-startup
+COPY chromium-secure.profile /etc/firejail/chromium-secure.profile
 
 # Make the entrypoint scripts executable
-RUN chmod +x /usr/local/bin/base_entrypoint.sh /usr/local/bin/customizable_entrypoint.sh
+RUN chmod +x /usr/local/bin/base_entrypoint.sh /usr/local/bin/customizable_entrypoint.sh /usr/local/bin/fluxbox-startup
 
 # Expose the XRDP port
 EXPOSE ${XRDP_PORT}

fluxbox-init

@@ -0,0 +1,47 @@
+# Fluxbox init file - Secure RDP Container Configuration
+# This file configures Fluxbox for a clean, minimal desktop environment
+
+# Hide the toolbar (status bar/taskbar)
+session.screen0.toolbar.visible: false
+
+# Additional toolbar settings (in case toolbar is enabled later)
+session.screen0.toolbar.placement: TopCenter
+session.screen0.toolbar.height: 0
+session.screen0.toolbar.autoHide: true
+
+# Window placement and behavior
+session.screen0.windowPlacement: RowSmartPlacement
+session.screen0.focusModel: ClickToFocus
+session.screen0.workspaces: 1
+session.screen0.workspaceNames: Desktop
+
+# Disable desktop icons and background
+session.screen0.rootCommand: 
+session.screen0.strftimeFormat: %k:%M
+
+# Menu settings
+session.menuFile: ~/.fluxbox/menu
+session.keyFile: ~/.fluxbox/keys
+
+# Appearance
+session.screen0.titlebar.left: Shade Minimize Maximize Close 
+session.screen0.titlebar.right: 
+
+# Window decorations - minimal
+session.screen0.decorateTransient: false
+session.screen0.defaultDeco: NORMAL
+
+# Disable tab decorations for cleaner look
+session.tabsAttachArea: Titlebar
+session.screen0.tab.placement: TopLeft
+session.screen0.tab.width: 64
+
+# Focus and window behavior
+session.screen0.focusNewWindows: true
+session.screen0.maxIgnoreIncrement: true
+session.screen0.maxDisableMove: false
+session.screen0.maxDisableResize: false
+
+# Disable desktop menu on right-click for security
+# (menu is still accessible via custom menu file)
+session.screen0.clickRaises: true

fluxbox-menu

@@ -0,0 +1,15 @@
+[begin] (Secure RDP Environment)
+[exec] (Chromium) {/usr/bin/chromium --no-sandbox --disable-dev-shm-usage}
+[separator]
+[submenu] (Utilities)
+  # Removed File Manager entry as Nautilus is not installed
+  [exec] (Text Editor) {/usr/bin/nano}
+[end]
+[separator]
+[submenu] (System)
+  [exec] (Refresh Desktop) {/usr/bin/xrefresh}
+  [restart] (Restart Fluxbox)
+[end]
+[separator]
+[exit] (Exit)
+[end]

fluxbox-startup

@@ -0,0 +1,22 @@
+#!/bin/sh
+# Fluxbox startup script to ensure clean desktop environment
+
+# Start fluxbox in background
+fluxbox &
+FLUXBOX_PID=$!
+
+# Wait for fluxbox to fully initialize
+sleep 3
+
+# Hide toolbar by directly editing the init file
+sleep 1
+
+# Alternative method: directly edit the init file to disable toolbar
+grep -q "^session.screen0.toolbar.visible: false" ~/.fluxbox/init || echo "session.screen0.toolbar.visible: false" >> ~/.fluxbox/init
+grep -q "^session.screen0.toolbar.autoHide: true" ~/.fluxbox/init || echo "session.screen0.toolbar.autoHide: true" >> ~/.fluxbox/init
+
+# Restart fluxbox to apply changes
+fluxbox-remote "Restart" 2>/dev/null || true
+
+# Wait for fluxbox to stay running
+wait $FLUXBOX_PID

xorg.conf

@@ -0,0 +1,33 @@
+Section "Module"
+    Load "dbe"
+    Load "glx"
+    Load "xorgxrdp"
+    Load "fb"
+EndSection
+
+Section "Device"
+    Identifier "Xorg"
+    Driver "xorgxrdp"
+EndSection
+
+Section "InputDevice"
+    Identifier "xrdpMouse"
+    Driver "xrdpMouse"
+EndSection
+
+Section "InputDevice"
+    Identifier "xrdpKeyboard"
+    Driver "xrdpKeyboard"
+EndSection
+
+Section "Screen"
+    Identifier "screen1"
+    Device "Xorg"
+EndSection
+
+Section "ServerLayout"
+    Identifier "Primary Layout"
+    Screen "screen1"
+    InputDevice "xrdpKeyboard" "CoreKeyboard"
+    InputDevice "xrdpMouse" "CorePointer"
+EndSection