Does not start on Ubuntu 24.04+ due to Electron issue with sandboxing

[Hellgartner]

Describe the bug
OpossumUI AppImage does not start on Ubuntu 24.04+

To Reproduce
Steps to reproduce the behavior:

1. Open any machine (or VM) running Ubuntu 24.04
2. Download the most recent release (the AppImage version)
3. Try to open the AppImage via double clicking
4. Confirm sandbox access
5. AppImage does not open
6. Opening the AppImage via command line yields

hellgartner@dominikus-metavm:~/programs/opossumUI$ ./OpossumUI-for-linux.AppImage 
[5523:0108/081918.385987:FATAL:setuid_sandbox_host.cc(163)] The SUID sandbox helper binary was found, but is not configured correctly. Rather than run without sandboxing I'm aborting now. You need to make sure that /tmp/.mount_Opossu8S9j6E/chrome-sandbox is owned by root and has mode 4755.
Trace/breakpoint trap (core dumped)

Expected behavior
App image does open

Screenshots

Desktop (please complete the following information):

• OS:

lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description:    Ubuntu 24.04.1 LTS
Release:        24.04
Codename:       noble

The test system is a KUbuntu system but given the links in the additional context as well as the failures for the e2e tests observed in #2704 this should be observable for all Ubuntu 24.04+ systems.

Additional context

• Opening the AppImage works if you deactivate the sandbox:

  ./OpossumUI-for-linux_test.AppImage --no-sandbox
• This is an issue with Electron AppImages conflicting with the new Ubuntu sandboxing of AppImage. Corresponding issue from Electron
  [Bug]: All versions of Electron (chromium upstream bug) fail to open on Ubuntu 24.04+ due to kernel.apparmor_restrict_unprivileged_userns=1 by default electron/electron#41066
• Electron-builder managed to solve this for installation via .deb but this remains unresolved for AppImages as the path to an AppImage is not defined, see Add apparmor profile electron-userland/electron-builder#8635 (comment)

[Hellgartner]

Ideas/Thoughts

• Waiting for Electron is possibly difficult as this is already open since 01/2024 --> no quick fix expected
• Alternative solution:
  • Switch to another deployment variant for linux
  • electron-builder supports e.g. snap
  • This would mean
    • Change the configuration
    • Adapt e2e test instructions and pipelines

[Hellgartner]

When fixed, please also make sure to remove the exception for renovate bot
#2708

[abraemer]

I just tried to reproduce this locally and interestingly it just works when you execute the AppImage from the terminal inside VSCode. I have no idea what difference that could possible make...
I thought I note it down here in case anyone tries reproducing this locally and happens to use VSCode.

[mstykow]

Once fixed, also see if you can use the arm runner: https://github.blog/changelog/2025-01-16-linux-arm64-hosted-runners-now-available-for-free-in-public-repositories-public-preview/

[Hellgartner]

First attempt looking into distribution via snap

• Build works without issues out of the box
• resulting into a .snap file
• Installation requires setting the --dangerous flag

  user@host$ sudo snap install ./OpossumUI-for-linux.snap
  error: cannot find signatures with metadata for snap "./OpossumUI-for-linux.snap"
  user@host$ sudo snap install ./OpossumUI-for-linux.snap --dangerous
  opossum-ui 0.1.0 installed
  Which would be equivalent using the old AppImage with the --no-sandbox option
  Note that installing via double clicking the .snap file in the explorer is not possible.
• Then this turns into just a normal snap

   user@host$ snap list
   Name               Version                     Rev    Tracking         Publisher   Notes
   ...
   opossum-ui         0.1.0                       x1     -                -           -
   ...
  Note: The version is shown here this should be set more consistently
• OpossumUI can now be used via

  • command line

    opossum-ui

  • start menu entry
    

  • Tested on ubuntu 20.04 and 24.04

• One version to improve the situation would be to publish into the snap app store. Question is whether we do want to go down that road.

[abraemer]

Did you verify that the app starts and works as expected? For me the build process went just fine but when starting the app there were a lot of graphical issues

[Hellgartner]

Did you verify that the app starts and works as expected? For me the build process went just fine but when starting the app there were a lot of graphical issues

• The command line reports a lot of garbage about problems with opnGL
• But no visible glitches