Do not use SYS_ADMIN Docker capability for k6 browser (#1330)

Updates all k6 browser Docker examples, which uses the
grafana/k6:master-with-browser image removing the usage of SYS_ADMIN
Docker capability, which is now not needed because the Chrome
'no-sandbox' argument is set by default. This change and its
implications are mentioned in a comment along with the cmdline example
and a recomendation to use a Docker SECCOMP profile instead, which
provides better security at the cost of worse UX.

Author: ka3de

src/data/markdown/docs/02 javascript api/07 k6-experimental/01 browser.md

@@ -86,9 +86,17 @@ $ k6 run script.js
 ```
 
 ```bash
-# When using the `k6:master-with-browser` Docker image, you need to add `--cap-add=SYS_ADMIN`
-# to grant further system permissions on the host for the Docker container.
-docker run --rm -i --cap-add=SYS_ADMIN grafana/k6:master-with-browser run - <script.js
+# WARNING!
+# The grafana/k6:master-with-browser image launches a Chrome browser by setting the
+# 'no-sandbox' argument. Only use it with trustworthy websites.
+#
+# As an alternative, you can use a Docker SECCOMP profile instead, and overwrite the
+# Chrome arguments to not use 'no-sandbox' such as:
+# docker container run --rm -i -e K6_BROWSER_ARGS='' --security-opt seccomp=$(pwd)/chrome.json grafana/k6:master-with-browser run - <script.js
+#
+# You can find an example of a hardened SECCOMP profile in:
+# https://raw.githubusercontent.com/jfrazelle/dotfiles/master/etc/docker/seccomp/chrome.json.
+docker run --rm -i grafana/k6:master-with-browser run - <script.js
 ```
 
 ```bash
@@ -143,9 +151,17 @@ The following command passes the [browser module options](#browser-module-option
 $ K6_BROWSER_HEADLESS=false K6_BROWSER_ARGS='show-property-changed-rects' k6 run script.js
 ```
 ```bash
-# When using the `k6:master-with-browser` Docker image, you need to add `--cap-add=SYS_ADMIN`
-# to grant further system permissions on the host for the Docker container.
-docker run --rm -i --cap-add=SYS_ADMIN -e K6_BROWSER_HEADLESS=false -e K6_BROWSER_ARGS='show-property-changed-rects' grafana/k6:master-with-browser run - <script.js
+# WARNING!
+# The grafana/k6:master-with-browser image launches a Chrome browser by setting the
+# 'no-sandbox' argument. Only use it with trustworthy websites.
+#
+# As an alternative, you can use a Docker SECCOMP profile instead, and overwrite the
+# Chrome arguments to not use 'no-sandbox' such as:
+# docker container run --rm -i -e K6_BROWSER_ARGS='' --security-opt seccomp=$(pwd)/chrome.json grafana/k6:master-with-browser run - <script.js
+#
+# You can find an example of a hardened SECCOMP profile in:
+# https://raw.githubusercontent.com/jfrazelle/dotfiles/master/etc/docker/seccomp/chrome.json.
+docker run --rm -i -e K6_BROWSER_HEADLESS=false -e K6_BROWSER_ARGS='show-property-changed-rects' grafana/k6:master-with-browser run - <script.js
 ```
 
 ```bash

src/data/markdown/translated-guides/en/03 Using k6 browser/02 Running browser tests.md

@@ -80,9 +80,17 @@ $ k6 run script.js
 ```
 
 ```bash
-# When using the `k6:master-with-browser` Docker image, you need to add `--cap-add=SYS_ADMIN`
-# to grant further system permissions on the host for the Docker container.
-docker run --rm -i --cap-add=SYS_ADMIN grafana/k6:master-with-browser run - <script.js
+# WARNING!
+# The grafana/k6:master-with-browser image launches a Chrome browser by setting the
+# 'no-sandbox' argument. Only use it with trustworthy websites.
+#
+# As an alternative, you can use a Docker SECCOMP profile instead, and overwrite the
+# Chrome arguments to not use 'no-sandbox' such as:
+# docker container run --rm -i -e K6_BROWSER_ARGS='' --security-opt seccomp=$(pwd)/chrome.json grafana/k6:master-with-browser run - <script.js
+#
+# You can find an example of a hardened SECCOMP profile in:
+# https://raw.githubusercontent.com/jfrazelle/dotfiles/master/etc/docker/seccomp/chrome.json.
+docker run --rm -i grafana/k6:master-with-browser run - <script.js
 ```
 
 ```bash
@@ -104,9 +112,17 @@ $ K6_BROWSER_HEADLESS=false k6 run script.js
 ```
 
 ```bash
-# When using the `k6:master-with-browser` Docker image, you need to add `--cap-add=SYS_ADMIN`
-# to grant further system permissions on the host for the Docker container.
-docker run --rm -i --cap-add=SYS_ADMIN -e K6_BROWSER_HEADLESS=false grafana/k6:master-with-browser run - <script.js
+# WARNING!
+# The grafana/k6:master-with-browser image launches a Chrome browser by setting the
+# 'no-sandbox' argument. Only use it with trustworthy websites.
+#
+# As an alternative, you can use a Docker SECCOMP profile instead, and overwrite the
+# Chrome arguments to not use 'no-sandbox' such as:
+# docker container run --rm -i -e K6_BROWSER_ARGS='' --security-opt seccomp=$(pwd)/chrome.json grafana/k6:master-with-browser run - <script.js
+#
+# You can find an example of a hardened SECCOMP profile in:
+# https://raw.githubusercontent.com/jfrazelle/dotfiles/master/etc/docker/seccomp/chrome.json.
+docker run --rm -i -e K6_BROWSER_HEADLESS=false grafana/k6:master-with-browser run - <script.js
 ```
 
 ```bash
@@ -314,4 +330,4 @@ export function news() {
 
 The preceding code contains two scenarios. One for the browser-level test called `browser` and one for the protocol-level test called `news`. Both scenarios are using the [constant-vus executor](/using-k6/scenarios/executors/constant-vus/) which introduces a constant number of virtual users to execute as many iterations as possible for a specified amount of time. 
 
-Since it's all in one script, this allows for greater collaboration amongst teams.
+Since it's all in one script, this allows for greater collaboration amongst teams.

src/data/markdown/translated-guides/en/03 Using k6 browser/04 Migrating to k6 v0-46.md

@@ -138,9 +138,17 @@ $ K6_BROWSER_HEADLESS=false K6_BROWSER_TIMEOUT='60s' k6 run script.js
 ```
 
 ```bash
-# When using the `k6:master-with-browser` Docker image, you need to add `--cap-add=SYS_ADMIN`
-# to grant further system permissions on the host for the Docker container.
-docker run --rm -i --cap-add=SYS_ADMIN -e K6_BROWSER_HEADLESS=false -e K6_BROWSER_TIMEOUT='60s' grafana/k6:master-with-browser run - <script.js
+# WARNING!
+# The grafana/k6:master-with-browser image launches a Chrome browser by setting the
+# 'no-sandbox' argument. Only use it with trustworthy websites.
+#
+# As an alternative, you can use a Docker SECCOMP profile instead, and overwrite the
+# Chrome arguments to not use 'no-sandbox' such as:
+# docker container run --rm -i -e K6_BROWSER_ARGS='' --security-opt seccomp=$(pwd)/chrome.json grafana/k6:master-with-browser run - <script.js
+#
+# You can find an example of a hardened SECCOMP profile in:
+# https://raw.githubusercontent.com/jfrazelle/dotfiles/master/etc/docker/seccomp/chrome.json.
+docker run --rm -i -e K6_BROWSER_HEADLESS=false -e K6_BROWSER_TIMEOUT='60s' grafana/k6:master-with-browser run - <script.js
 ```
 
 ```bash