How to run and/or install AppImage on Ubuntu

[d33p-dev]

My versions:
"electron": "^31.0.2",
"electron-builder": "^24.13.3",
"electron-vite": "^2.3.0",

Node version:
v18.19.1

Target:
Linux x64

ISSUE
When I run the AppImage (Ubuntu 24.04 KDE Plasma 5.27) I get the following error. I gave my user account rwx persmissions to the "appForLinux.AppImage" file.

[30783:0831/200557.279232:FATAL:setuid_sandbox_host.cc(158)] The SUID sandbox helper binary was found, but is not configured correctly. Rather than run without sandboxing I'm aborting now. You need to make sure that /tmp/.mount_deskto9XlUHg/chrome-sandbox is owned by root and has mode 4755.
Trace/breakpoint trap (core dumped)

Is this an error with my (limited) understanding of how to run an AppImage on Ubuntu or does this error indicate the packaging is bad/corrupt with Electron Builder?

I'm more of a Windows/Mac developer. Should I install the Snap or .deb version of the test app built I with Electron Builder? I thought it was straightforward to just run any AppImage on Ubuntu. But, maybe I should install the electron app some other way? If so, what would that command look like to install a Linux app built with Electron Builder?

I use "apt install" a lot... But, I'm new to Linux dev so I'm not sure what my other options are to test an Electron app on Linux. I can run the app just fine from VSCode on Ubuntu. And it works but how do I actually install it and run it?

Thanks

[d33p-dev]

This is what I get when I run with sudo:

[0831/201755.141164:FATAL:electron_main_delegate.cc(295)] Running as root without --no-sandbox is not supported. See https://crbug.com/638180. Trace/breakpoint trap

[sciencewhiz]

It's an issue with a security setting in Ubuntu 24.04 that affects pretty much all electron apps. See more details here: https://ubuntu.com/blog/ubuntu-23-10-restricted-unprivileged-user-namespaces

[d33p-dev]

I was able to install and run the .deb package on Ubuntu with apt install ./app.deb. It ran fine. I'll do more testing. But, I guess this limits me to only Debian and Ubuntu? As I learn more, I'll post again. Thanks for the link

[sciencewhiz]

When installing the deb which needs root, the chrome-sandbox is suid root, so it doesn't have that problem.

[Nantris]

This is really an Electron issue, but the maintainers haven't shown any interest in even commenting on it: electron/electron#42510

@mmaietta I wonder if you have any thoughts on how this might be approached? Is there anything we could do at build time? Otherwise, any thoughts on how a script might help to resolve this? The core problem is that even if you want to make an exception for a single AppImage in a safe way, the way they're mounted to the filesystem at random paths seemingly makes that impossible.

[xmedeko]

The problem is not in Electron itself, but apparmor in Ubuntu 24, see https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/2046844

Update: Proper solution is to add AppArmor profile, see #8635

---

Workaround is either to switch off

sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0` 

but it works untilt reboot only. To switch it off permanently see electron/electron#41066 (comment) Or set SUID

chmod 0755 '/opt/CustomApp/chrome-sandbox' 

The older older electron-builder set SUID always, however with electron-builder 25.1.8 I have a deb with postinst and code:

if ! { [[ -L /proc/self/ns/user ]] && unshare --user true; }; then
    # Use SUID chrome-sandbox only on systems without user namespaces:
    chmod 4755 '/opt/CustomApp/chrome-sandbox' || true
else
    chmod 0755 '/opt/CustomApp/chrome-sandbox' || true
fi

See also #8368 and templates/linux/after-install.tpl And it does not set SUID on Ubuntu 24.

Although the problem seems to be in Ubuntu 24, I would like to have some setting to switch of to the old electron-builder behaviour and set SUID always, so as the installation is reliable until Ubuntu 24 is fixed.

[mmaietta]

@xmedeko you could copy-paste the after-install.tpl into your own file, modify so that it always sets SUID, then supply the path to that custom file to electron-builder to use instead of its default template. You can provide this new after-install script via this config param: https://www.electron.build/app-builder-lib.interface.linuxtargetspecificoptions#afterinstall

[xmedeko]

@mmaietta Thanks for the advice, proper solution is to add AppArmor profile, see #8635 It's possible with afterInstall, too.