Chrome refuses to run as root without --no-sandbox regardless of container
privilege level. Patch the .desktop file, add a CLI wrapper, and flag the
dashboard shortcut.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
These components crash in an LXC container since there's no real hardware
power management. Disable them via autostart Hidden=true entries.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Add dbus-launch --exit-with-session to VNC xstartup and restore dbus-x11
package so DBus is properly initialized before LXQt starts.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Replace unprivileged LXC/XFCE/Chromium setup with privileged LXC, LXQt
desktop, and Google Chrome to support the OpenClaw browser extension
(developer mode). Removes --no-sandbox workaround and XFCE desktop icon
trust mechanism, adds Chrome .deb install and browser extension setup.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Configures update-alternatives, xdg-settings, and XFCE helpers.rc
so clicking links in terminal opens Chromium with --no-sandbox.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Patches ui.js to initialize resize mode as 'scale' instead of 'off'
so the VNC display auto-fits the browser window without manual config.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Installs Homebrew via a non-root user (required by installer),
then symlinks brew to /usr/local/bin and adds it to root's bashrc
so it's available system-wide.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
gio metadata requires a DBUS session which only exists after XFCE
starts via VNC. Created a one-shot systemd service that runs once
after vncserver, finds the DBUS socket, marks all .desktop files
as trusted, then disables itself.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
OpenClaw CLI uses emoji characters (checkmarks, icons) that render
as ??? without a proper emoji font installed.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Sets xfce-exe-checksum metadata on .desktop files so XFCE
doesn't show the "Untrusted application launcher" dialog.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Configure locales (en_US.UTF-8) before installing packages
- Filter out udev "Permission denied" and pulseaudio reload warnings
- These are normal in unprivileged containers but look alarming
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Use ~/.config/tigervnc/ instead of ~/.vnc/ (Debian 13 migration issue)
- Add Environment=HOME=/root to vncserver systemd service
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Automated single-script setup that creates a Debian 13 LXC container
with OpenClaw AI gateway, XFCE desktop, VNC/noVNC remote access,
and Chromium browser — all configured with systemd services.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
