# Newbie: Q: custom seccomp profile (flatpak-builder) **URL:** \ **Category:** Drone Support\ **Created:** [February 25, 2021, 12:56pm UTC](https://drone.discourse.group/t/newbie-q-custom-seccomp-profile-flatpak-builder/9834 "2021-02-25T12:56:15Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![leamas](https://yyz1.discourse-cdn.com/flex003/user_avatar/drone.discourse.group/leamas/32/2586_2.png) [@leamas](https://drone.discourse.group/u/leamas)\ **Post date:** [February 25, 2021, 12:56pm UTC](https://drone.discourse.group/t/newbie-q-custom-seccomp-profile-flatpak-builder/9834/1 "2021-02-25T12:56:15Z")
After porting some build scripts into drone I’m facing the problem to build flatpak extensions. It boils down to running the flatpak-builder tool. flatpak, being a sandbox environment, does some odd things. In the end, it needs a custom seccomp profile. The profile is derived from the [default](https://github.com/moby/moby/blob/master/profiles/seccomp/default.json), with two added syscalls: clone and pivot\_root. Is it possible to apply a custom seccomp profile on a docker instance on [drone.io](http://drone.io) somehow? ---
**Author:** ![H-o-l](https://yyz1.discourse-cdn.com/flex003/user_avatar/drone.discourse.group/h-o-l/32/3183_2.png) [@H-o-l](https://drone.discourse.group/u/H-o-l)\ **Post date:** [March 26, 2021, 11:25am UTC](https://drone.discourse.group/t/newbie-q-custom-seccomp-profile-flatpak-builder/9834/2 "2021-03-26T11:25:51Z")
Hi @leamas, I have the same issue, I want to use a custom seccomp profile to be able to run Chromium headless inside Drone. Did you find a solution on your side? ---
**Author:** ![leamas](https://yyz1.discourse-cdn.com/flex003/user_avatar/drone.discourse.group/leamas/32/2586_2.png) [@leamas](https://drone.discourse.group/u/leamas)\ **Post date:** [March 26, 2021, 11:38am UTC](https://drone.discourse.group/t/newbie-q-custom-seccomp-profile-flatpak-builder/9834/3 "2021-03-26T11:38:12Z")
No. I have given up the attempts to run flatpak-builder inside drone. ---
**Author:** ![H-o-l](https://yyz1.discourse-cdn.com/flex003/user_avatar/drone.discourse.group/h-o-l/32/3183_2.png) [@H-o-l](https://drone.discourse.group/u/H-o-l)\ **Post date:** [March 26, 2021, 2:09pm UTC](https://drone.discourse.group/t/newbie-q-custom-seccomp-profile-flatpak-builder/9834/4 "2021-03-26T14:09:32Z")
OK, thanks for the answer! ---
**Author:** ![bradrydzewski](https://yyz1.discourse-cdn.com/flex003/user_avatar/drone.discourse.group/bradrydzewski/32/3513_2.png) [@bradrydzewski](https://drone.discourse.group/u/bradrydzewski)\ **Post date:** [March 26, 2021, 2:25pm UTC](https://drone.discourse.group/t/newbie-q-custom-seccomp-profile-flatpak-builder/9834/5 "2021-03-26T14:25:51Z")
Have you tried setting `privileged: true` for your pipeline step? This should be a viable solution. See https://docs.drone.io/pipeline/docker/syntax/steps/#privileged-mode ---
**Author:** ![leamas](https://yyz1.discourse-cdn.com/flex003/user_avatar/drone.discourse.group/leamas/32/2586_2.png) [@leamas](https://drone.discourse.group/u/leamas)\ **Post date:** [March 26, 2021, 2:43pm UTC](https://drone.discourse.group/t/newbie-q-custom-seccomp-profile-flatpak-builder/9834/6 "2021-03-26T14:43:57Z")
Indeed. But do I have access to a trusted repository in the sense which is required here? ---
**Author:** ![leamas](https://yyz1.discourse-cdn.com/flex003/user_avatar/drone.discourse.group/leamas/32/2586_2.png) [@leamas](https://drone.discourse.group/u/leamas)\ **Post date:** [March 26, 2021, 3:56pm UTC](https://drone.discourse.group/t/newbie-q-custom-seccomp-profile-flatpak-builder/9834/7 "2021-03-26T15:56:48Z")
More dialog with with Dr Google. As I understand it I should be able to fix this if I run my own instance, but not on [drone.io](http://drone.io) ---
**Author:** ![bradrydzewski](https://yyz1.discourse-cdn.com/flex003/user_avatar/drone.discourse.group/bradrydzewski/32/3513_2.png) [@bradrydzewski](https://drone.discourse.group/u/bradrydzewski)\ **Post date:** [March 26, 2021, 4:27pm UTC](https://drone.discourse.group/t/newbie-q-custom-seccomp-profile-flatpak-builder/9834/8 "2021-03-26T16:27:54Z")
> More dialog with with Dr Google. As I understand it I should be able to fix this if I run my own instance, but not on [drone.io](http://drone.io/) correct, we do no enable privileged mode on Drone cloud, which means you would need to self-host. ---
**Author:** ![H-o-l](https://yyz1.discourse-cdn.com/flex003/user_avatar/drone.discourse.group/h-o-l/32/3183_2.png) [@H-o-l](https://drone.discourse.group/u/H-o-l)\ **Post date:** [March 29, 2021, 2:39pm UTC](https://drone.discourse.group/t/newbie-q-custom-seccomp-profile-flatpak-builder/9834/9 "2021-03-29T14:39:27Z")
I @bradrydzewski thanks for the idea! When I use `privileged: true` with `drone exec` I have the following error: ```auto linter: untrusted repositories cannot enable privileged mode ``` Do you know if I can use `drone exec` with `privileged: true`? (`drone exec` is really cool to debug locally). Another thing about `privileged: true` is that I fear it will give too much authorization to docker containers. The docker seccomp profile option looks better to me. Do you think [Drone.io](http://Drone.io) could include this feature? @leamas for info, I have found that it is possible to change the docker seccomp profile for the docker daemon directly. It’s not a perfect workaround (again, it’s too much authorization, I would prefer to avoid changing seccomp profile system-wide) but it exists. See [dockerd | Docker Documentation](https://docs.docker.com/engine/reference/commandline/dockerd/#daemon-configuration-file) ---
**Author:** ![bradrydzewski](https://yyz1.discourse-cdn.com/flex003/user_avatar/drone.discourse.group/bradrydzewski/32/3513_2.png) [@bradrydzewski](https://drone.discourse.group/u/bradrydzewski)\ **Post date:** [March 29, 2021, 2:43pm UTC](https://drone.discourse.group/t/newbie-q-custom-seccomp-profile-flatpak-builder/9834/10 "2021-03-29T14:43:13Z")
> [@H-o-l](#): > > Do you know if I can use `drone exec` with `privileged: true` ? You can use the `drone exec --privileged` flag > [@H-o-l](#): > > `linter: untrusted repositories cannot enable privileged mode` If you receive this error in the user interface, a Drone system administrator will need to mark the repository as trusted. See [this thread](http://discuss.harness.io/t/solved-running-in-privileged-mode/3736/2) for more details. ---
**Author:** ![H-o-l](https://yyz1.discourse-cdn.com/flex003/user_avatar/drone.discourse.group/h-o-l/32/3183_2.png) [@H-o-l](https://drone.discourse.group/u/H-o-l)\ **Post date:** [March 29, 2021, 2:57pm UTC](https://drone.discourse.group/t/newbie-q-custom-seccomp-profile-flatpak-builder/9834/11 "2021-03-29T14:57:19Z")
> You can use the drone exec --privileged flag Nice, thanks! I just tested and it doesn’t fix the issue I have with running Chromium inside Drone docker container. Changing docker daemon seccomp fixes it but it’s too wide. The ideal solution would be to be able to pass `docker container run` command a custom `--security-opt` argument.