Enable browsing on remote cluster

firefox-on-freya.md

Internet Browsing on the MPCDF Cluster (Firefox Fix)

Problem

Firefox opens but all pages fail to load. The browser shows connection errors for every URL, even though the cluster node has full internet connectivity (e.g. curl https://www.google.com returns HTTP 200).

Root Cause

Cluster nodes are configured with:

/proc/sys/user/max_net_namespaces = 0

This kernel setting disallows the creation of network namespaces by unprivileged users. Firefox's content-process sandbox (inherited from Chromium's IPC layer) calls clone(CLONE_NEWNET | ...) when spawning each tab's renderer process. With max_net_namespaces=0, that call fails immediately with ENOSPC (errno 28, "No space left on device"), so no tab subprocess can ever start.

You can confirm the error by running Firefox from a terminal:

$ firefox https://www.google.com
[Parent ..., IPC Launch] WARNING: fork() failed: No space left on device: \
    file .../ipc/chromium/src/base/process_util_linux.cc:98
[Parent ..., IPC I/O Parent] WARNING: Failed to launch tab subprocess @fork (Error:28): \
    file .../ipc/glue/GeckoChildProcessHost.cpp:804

And you can verify the kernel parameter:

$ cat /proc/sys/user/max_net_namespaces
0

Changing this value requires root/sudo — which is not available on the cluster. The fix below works entirely in user space.

---

Fix (no sudo required)

Two complementary changes are applied: a Firefox preference override (user.js) and a launcher wrapper script (~/bin/firefox). Either one alone is sufficient, but using both is belt-and-suspenders.

1. Firefox profile: user.js

The file ~/.mozilla/firefox/<profile>/user.js lets you override Firefox preferences that are applied every time Firefox starts. The following settings disable the sandbox subsystems that require network namespaces:

File location:

~/.mozilla/firefox/a45467jc.default-1767094553394/user.js

Contents (already created):

// Disable content-process (renderer) sandbox — level 0 = off
user_pref("security.sandbox.content.level", 0);

// Disable GPU process sandbox
user_pref("security.sandbox.gpu.level", 0);

// Disable RDD (Remote Data Decoder) process sandbox
user_pref("security.sandbox.rdd.level", 0);

// Disable socket process sandboxing
user_pref("security.sandbox.socket.process.enabled", false);

Note: Firefox may overwrite prefs.js on exit, but user.js is always re-applied on the next launch, so the fix persists.

2. Wrapper script: ~/bin/firefox

A thin shell wrapper at ~/bin/firefox (which appears in $PATH before /usr/bin/firefox) sets the environment variable MOZ_DISABLE_CONTENT_SANDBOX=1 before launching the real Firefox binary:

File: ~/bin/firefox (already created, already executable)

#!/usr/bin/env bash
export MOZ_DISABLE_CONTENT_SANDBOX=1
exec /usr/bin/firefox "$@"

Because ~/bin is in your $PATH, typing firefox in a terminal or launching it from a desktop environment will automatically use this wrapper.

3. Verify the fix

Run Firefox headlessly to confirm it can now load a page:

MOZ_DISABLE_CONTENT_SANDBOX=1 firefox --headless --screenshot /tmp/test.png https://www.google.com
ls -lh /tmp/test.png   # should show a non-empty PNG file

Or simply open Firefox normally — all pages should load.

---

If You Create a New Firefox Profile

The user.js fix is tied to a specific profile directory. If you create a new profile, copy user.js into it:

# Find your new profile directory
ls ~/.mozilla/firefox/

# Copy user.js into the new profile
cp ~/.mozilla/firefox/a45467jc.default-1767094553394/user.js \
   ~/.mozilla/firefox/<new-profile>/user.js

The wrapper script (~/bin/firefox) does not depend on any specific profile and works automatically for all profiles.

---

Setting Up Firefox for the First Time on This Cluster

If you are a new user on the cluster and Firefox has never been launched before, follow these steps:

Step 1 — Create the wrapper script

mkdir -p ~/bin
cat > ~/bin/firefox << 'EOF'
#!/usr/bin/env bash
# Wrapper: disable Firefox content sandbox (cluster has max_net_namespaces=0)
export MOZ_DISABLE_CONTENT_SANDBOX=1
exec /usr/bin/firefox "$@"
EOF
chmod +x ~/bin/firefox

Step 2 — Ensure ~/bin is in your PATH

Check:

echo $PATH | grep -q "$HOME/bin" && echo "~/bin is in PATH" || echo "~/bin is NOT in PATH"

If it is not, add it to your shell startup file:

# For bash:
echo 'export PATH="$HOME/bin:$PATH"' >> ~/.bashrc
source ~/.bashrc

# For zsh:
echo 'export PATH="$HOME/bin:$PATH"' >> ~/.zshrc
source ~/.zshrc

Step 3 — Launch Firefox once to create the profile

firefox &

Close Firefox after it opens.

Step 4 — Add user.js to your profile

# Find the newly created profile directory
PROFILE=$(ls -td ~/.mozilla/firefox/*.default* 2>/dev/null | head -1)
echo "Profile: $PROFILE"

# Write the user.js fix
cat > "$PROFILE/user.js" << 'EOF'
// Cluster fix: disable sandboxes that require network namespaces
user_pref("security.sandbox.content.level", 0);
user_pref("security.sandbox.gpu.level", 0);
user_pref("security.sandbox.rdd.level", 0);
user_pref("security.sandbox.socket.process.enabled", false);
EOF

Step 5 — Launch Firefox again

firefox

Pages should now load normally.

---

Using a VNC Session (Recommended for GUI Applications on the Cluster)

On MPCDF clusters, GUI applications like Firefox are best run inside a VNC session (rather than over X11 forwarding), which gives much better performance.

Start a VNC session

# Load the VNC module if available
module load turbovnc   # or: module load vncsetup

# Start a VNC server
vncserver :1           # or use 'vncsetup' if provided by the cluster

Connect from your local machine

Use a VNC client (e.g. TigerVNC Viewer, TurboVNC Viewer, Remmina) to connect to:

<cluster-login-node>:5901

(Port = 5900 + display number)

Inside the VNC session, open a terminal and run:

firefox

Stop the VNC session

vncserver -kill :1

---

Background: Why This Cluster Setting Exists

HPC cluster administrators set max_net_namespaces=0 (and similarly restrict other namespace types) to:

• Prevent users from creating virtual network interfaces that could interfere with the high-performance interconnect (InfiniBand, Omni-Path, etc.)
• Limit container escape vectors in multi-tenant environments
• Reduce kernel resource usage on shared login nodes

The Firefox sandbox is a security feature designed for personal/desktop use where these kernel resources are available. On HPC clusters it must be disabled. The security trade-off is acceptable because:

• You are running as an unprivileged user on a managed system
• The cluster itself is behind institutional firewalls
• The sandbox primarily protects against malicious web content escaping to compromise your OS; on a cluster your home directory is network-mounted (NFS/GPFS) and the session is transient anyway

---

Summary of Files Modified/Created

File	Purpose
~/.mozilla/firefox/a45467jc.default-1767094553394/user.js	Disables Firefox sandbox prefs on every launch
~/bin/firefox	Wrapper script that sets MOZ_DISABLE_CONTENT_SANDBOX=1

Both changes are non-destructive and entirely within your home directory. No system files are modified and no sudo is required.