Cockpit 360 JS API Sandboxing Notes

Server: rayserver, Cockpit version 360 (dpkg).

What Works

Basic page rendering (HTML, CSS, JS)
Cockpit CSS theme (../base1/cockpit.css)
Cockpit JS library (../base1/cockpit.js)

What Fails

cockpit.script() — ALWAYS FAILS for system commands

Even with full paths like /usr/bin/nvidia-smi, the call never resolves. The .done() callback never fires, .fail() may not fire either — it just hangs. Does NOT produce an error in browser console.

Tested: cockpit.script("/usr/bin/nvidia-smi --query-gpu=name ...") — hangs indefinitely.

cockpit.file().read() — FAILS for absolute paths

Trying to read /run/nvidia-gpu.txt, /tmp/anything — .fail() fires. The error object is empty or useless. Likely Cockpit 360 restricts file reads to package-relative paths or whitelisted dirs.

cockpit.spawn() — UNCONFIRMED

Currently testing: cockpit.spawn(["cat", "/run/nvidia-gpu.txt"]). Theory: simpler commands (cat vs nvidia-smi) may work since they don't need GPU driver access.

What's Working (infrastructure)

nvidia-gpu-monitor.service — writes every 5s to:
- /run/nvidia-gpu.txt — GPU name, driver, temp, util, memory, power, pstate, fan
- /run/nvidia-processes.txt — PID, process_name, used_memory
- /run/nvidia-cuda.txt — CUDA version string
Files are world-readable (644), owned by root
nvidia-smi works perfectly from terminal and from the service

Current Page Location

/usr/share/cockpit/nvidia-gpu/index.html Manifest: /usr/share/cockpit/nvidia-gpu/manifest.json (CSP allows unsafe-inline, menu section)

1.6 KiB Raw Permalink Blame History