Upgrade to debian trixie (#581)

* move flavored bookworm dockerfile to a new trixie dockerfile.

* fix opera openbox selector.

* fix remmina dependencies.

* remove chromium explicit bookworm source.

* Update apps to work with trixie (#624)

Co-authored-by: yesBad <me@bad.cash>

* remove SYS_ADMIN capability requirement for Chromium-based Docker images and update documentation accordingly.

* fix chromium package.

* change uBlock Origin to uBlock Origin Lite.

* restore waterfox in build matrix for GHCR workflows.

---------

Co-authored-by: Bad <87938689+yesBad@users.noreply.github.com>
Co-authored-by: yesBad <me@bad.cash>

webpage/docs/customization/browsers.md

@@ -213,16 +213,16 @@ By default, the browsers in Neko do not allow installing extensions except for t
 - `ExtensionInstallAllowlist`: These extensions can be installed by the user when needed; they are not pre-installed.
 - `ExtensionInstallBlocklist`: These extensions cannot be installed by the user, which is `*` (all extensions) by default.
 
-The ID of the extension can be found in the URL of the extension in the Chrome Web Store. For example, the ID of the [uBlock Origin](https://chromewebstore.google.com/detail/ublock-origin/cjpalhdlnbpafiamejdnhcphjbkeiagm) extension is `cjpalhdlnbpafiamejdnhcphjbkeiagm`.
+The ID of the extension can be found in the URL of the extension in the Chrome Web Store. For example, the ID of the [uBlock Origin Lite](https://chromewebstore.google.com/detail/ublock-origin-lite/ddkjiahejlhfcafbddmgiahcphecmpfh) extension is `ddkjiahejlhfcafbddmgiahcphecmpfh`.
 
 ```json title="policy.json"
 {
   "ExtensionInstallForcelist": [
-    "cjpalhdlnbpafiamejdnhcphjbkeiagm;https://clients2.google.com/service/update2/crx",
+    "ddkjiahejlhfcafbddmgiahcphecmpfh;https://clients2.google.com/service/update2/crx",
     "mnjggcdmjocbbbhaepdhchncahnbgone;https://clients2.google.com/service/update2/crx"
   ],
   "ExtensionInstallAllowlist": [
-    "cjpalhdlnbpafiamejdnhcphjbkeiagm",
+    "ddkjiahejlhfcafbddmgiahcphecmpfh",
     "mnjggcdmjocbbbhaepdhchncahnbgone"
   ],
   "ExtensionInstallBlocklist": [

webpage/docs/installation/docker-images.md

@@ -85,7 +85,9 @@ Check the [Firefox-based browsers customization guide](/docs/v3/customization/br
 
 There are multiple flavors of Chromium-based browsers available as Neko Docker images.
 
-They need `--cap-add=SYS_ADMIN` (see [security implications](https://www.redhat.com/en/blog/container-tidbits-adding-capabilities-container) for more information) and extended shared memory size (`--shm-size=2g`) to work properly.
+Chromium is running with `--no-sandbox` flag, which is required to run it in a container without additional configuration. You can read more about it in [Quick introduction](https://www.google.com/googlebooks/chrome/med_26.html) to Chrome's sandbox. More in-depth [design document](https://chromium.googlesource.com/chromium/src/+/refs/heads/main/docs/design/sandbox.md), with internal links to FAQ, etc.
+
+Additionally, chromium-based browsers require `--shm-size=2g` (or more) to work properly. This is because the default shared memory size for Docker containers is too small for Chromium-based browsers, which can lead to crashes and other issues. 
 
 import Tabs from '@theme/Tabs';
 import TabItem from '@theme/TabItem';
@@ -95,7 +97,6 @@ import TabItem from '@theme/TabItem';
 
     ```bash
     docker run \
-      --cap-add=SYS_ADMIN \
       --shm-size=2g \
       ghcr.io/m1k1o/neko/chromium
     ```
@@ -105,8 +106,6 @@ import TabItem from '@theme/TabItem';
   <TabItem value="docker-compose" label="Docker Compose configuration">
 
     ```yaml title="docker-compose.yaml"
-    cap_add:
-    - SYS_ADMIN
     shm_size: 2g
     ```
 

webpage/docs/installation/examples.md

@@ -36,8 +36,6 @@ services:
     image: "ghcr.io/m1k1o/neko/chromium:latest"
     restart: "unless-stopped"
     shm_size: "2gb"
-    cap_add:
-      - SYS_ADMIN
     ports:
       - "8080:8080"
       - "52000-52100:52000-52100/udp"
@@ -60,8 +58,6 @@ services:
     image: "ghcr.io/m1k1o/neko/vlc:latest"
     restart: "unless-stopped"
     shm_size: "2gb"
-    cap_add:
-      - SYS_ADMIN
     volumes:
       - "<your-video-folder>:/video" # mount your video folder
     ports:

webpage/docs/troubleshooting.md

@@ -163,16 +163,12 @@ If you put a local IP as `NEKO_WEBRTC_NAT1TO1`, external clients try to connect
 
 ### Getting a black screen with a cursor, but no browser for Chromium-based browsers {#black-screen-with-cursor}
 
-Check if you did not forget to add `cap_add` to your `docker-compose.yaml` file. Make sure that the `shm_size` is set to `2gb` or higher.
+Make sure that the `shm_size` is set to `2gb` or higher.
 
 ```yaml title="docker-compose.yaml"
 services:
   neko:
     image: "ghcr.io/m1k1o/neko/chromium:latest"
-    # highlight-start
-    cap_add:
-    - SYS_ADMIN
-    # highlight-end
     restart: "unless-stopped"
     # highlight-start
     shm_size: "2gb"
@@ -202,8 +198,6 @@ services:
     - 1.1.1.1
     - 8.8.8.8
     # highlight-end
-    cap_add:
-    - SYS_ADMIN
     restart: "unless-stopped"
     shm_size: "2gb"
     # ...