How can I install the Chrome engine in the Dify sandbox so that I can use Python code execution capabilities to perform PDF conversion?

[jiangpeng663]

Self Checks

• I have searched for existing issues search for existing issues, including closed ones.
• I confirm that I am using English to submit this report (我已阅读并同意 Language Policy).
• [FOR CHINESE USERS] 请务必使用英文提交 Issue，否则会被关闭。谢谢！:)
• Please do not modify this template :) and fill in all the required fields.

1. Is this request related to a challenge you're experiencing? Tell me about your story.

How can I install the Chrome engine in the Dify sandbox so that I can use Python code execution capabilities to perform PDF conversion?

2. Additional context or comments

No response

[dosubot[bot]]

Unfortunately, Chrome/Chromium cannot run directly in the standard Dify sandbox due to its security architecture. The sandbox enforces chroot isolation and seccomp syscall filtering that blocks subprocess execution (execve syscall), which means native binaries like Chrome, Playwright, Puppeteer, and wkhtmltopdf are all unable to run [1].

Here are your options for PDF conversion:

Option 1 — External Browser API (Recommended)
Call an external headless browser service (e.g., Browserless, Apify) over HTTP from your sandbox code. This completely sidesteps the sandbox restrictions [1]:

import requests

def main():
    response = requests.post('https://chrome.browserless.io/pdf',
                             params={'token': 'YOUR_TOKEN'},
                             json={'url': 'https://example.com'})
    return {'pdf': response.content}

Make sure SANDBOX_ENABLE_NETWORK=true is set in your .env so the sandbox can make outbound HTTP calls [2].

Option 2 — Custom Sandbox Image (Advanced)
You can rebuild the sandbox image with Chrome installed and relax the seccomp restrictions, but this is complex:

1. Use strace to capture required syscalls (e.g., execve, wait4, clone, pipe2)
2. Modify the Go source code's syscall allowlist (the allowed_syscalls in config.yaml alone is not sufficient — execve is blocked in the source)
3. Add Chrome/Playwright binaries to the python_lib_path
4. Rebuild the Docker image

A community image like svcvit/dify-sandbox-py:0.1.2 enables more syscalls by default and may work, though with security trade-offs [1].

Option 3 — Pure Python PDF Libraries
If you don't strictly need a browser engine, consider Python-only PDF libraries (like fpdf2, reportlab, or weasyprint) added via docker/volumes/sandbox/dependencies/python-requirements.txt [3]. Note that weasyprint still requires some system-level dependencies and may need a custom Docker image [4].

For production use, Option 1 (external API) is the most reliable and maintainable approach.

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}