[GH-ISSUE #75] Explanation for --cap-add for Docker #35

New Issue

2026-02-23T17:18:17-05:00

yindo commented

2026-02-23 17:18:17 -05:00

Originally created by @paulgear on GitHub (Jul 31, 2024).
Original GitHub issue: https://github.com/Mintplex-Labs/anythingllm-docs/issues/75

Originally assigned to: @timothycarambat on GitHub.

Re: https://docs.useanything.com/installation/desktop/linux#install-using-docker

...
 docker run -d -p 3001:3001 \
 --cap-add SYS_ADMIN \
 ...

Can there be an explanation added as to why anythingllm needs the SYS_ADMIN capability, please?

Originally created by @paulgear on GitHub (Jul 31, 2024). Original GitHub issue: https://github.com/Mintplex-Labs/anythingllm-docs/issues/75 Originally assigned to: @timothycarambat on GitHub. Re: https://docs.useanything.com/installation/desktop/linux#install-using-docker ``` ... docker run -d -p 3001:3001 \ --cap-add SYS_ADMIN \ ... ``` Can there be an explanation added as to why anythingllm needs the SYS_ADMIN capability, please?

yindo closed this issue

2026-02-23 17:18:17 -05:00

yindo commented

2026-02-23 17:18:17 -05:00

@timothycarambat commented on GitHub (Jul 31, 2024):

It is for Puppeteer so you can scrape websites while still using the sandbox container for chromium. You would think it would be easier but it isn't without running --no-sandbox, which is less secure and since we dont know what websites people might scrape we should always sandbox

--cap-add=SYS_ADMIN capability is needed to enable Chrome sandbox that makes the browser more secure. Alternatively, it should be possible to start the browser binary with the --no-sandbox flag.

@timothycarambat commented on GitHub (Jul 31, 2024): It is for Puppeteer so you can scrape websites while still using the `sandbox` container for chromium. You would think it would be easier but it isn't without running `--no-sandbox`, which is less secure and since we dont know what websites people might scrape we should always sandbox > --cap-add=SYS_ADMIN capability is needed to enable Chrome sandbox that makes the browser more secure. Alternatively, it should be possible to start the browser binary with the --no-sandbox flag.

yindo commented

2026-02-23 17:18:17 -05:00

@paulgear commented on GitHub (Aug 5, 2024):

@timothycarambat Thanks for the prompt response. Can you confirm: this is for running a headless chromium inside the Docker container? What is that used for?

@paulgear commented on GitHub (Aug 5, 2024): @timothycarambat Thanks for the prompt response. Can you confirm: this is for running a headless chromium inside the Docker container? What is that used for?

yindo commented

2026-02-23 17:18:17 -05:00

@timothycarambat commented on GitHub (Aug 6, 2024):

When you scrape any links, this enables us to scrape the content from JS-rendered pages, which is the majority of web pages nowadays. To do this we use Puppeteer, which can use Chromium and it is unsafe to run outside of a sandbox. --cap-add allows us to run with sandboxing

@timothycarambat commented on GitHub (Aug 6, 2024): When you scrape any links, this enables us to scrape the content from JS-rendered pages, which is the majority of web pages nowadays. To do this we use Puppeteer, which can use Chromium and it is unsafe to run outside of a sandbox. --cap-add allows us to run with sandboxing

yindo referenced this issue

2026-02-23 17:19:39 -05:00

[PR #47] [MERGED] update agent screenshots/copy #92

yindo referenced this issue

2026-06-05 15:21:55 -04:00

[GH-ISSUE #35] Add documentation for SQL agents and update screenshots for agent config #20

yindo changed title from ~~Explanation for `--cap-add` for Docker~~ to [GH-ISSUE #75] Explanation for `--cap-add` for Docker

2026-06-05 15:22:00 -04:00

Sign in to join this conversation.