[BUG] warning that some security features may offer less protection

[User123698745]

Is there an existing issue for this?

• I have searched the existing issues

Current Behavior

Mullvad Browser displays this security warning banner
some of Mullvad Browser’s security features may offer less protection on your current operating system
with a link to this https://support.mozilla.org/en-US/kb/linux-security-warning explaining how to fix that (an AppArmor profile needs to be created).

Expected Behavior

Mullvad Browser does not display a security warning banner

Steps To Reproduce

1. Start the container with any image version >= 14, e.g. latest (versions < 14, e.g. 13.5.9, do not show the warning banner)
2. Open Mullvad Browser (http://localhost:3000/)
3. You should now get the warning banner

Environment

- OS: Windows 10 22H2
- How docker service was installed: Using the "Docker Desktop for Windows" installer from docker.com

CPU architecture

x86-64

Docker creation

docker run -p 3000:3000 --name mullvad-browser lscr.io/linuxserver/mullvad-browser:latest

Container logs

2025-08-02 23:27:02.234 | [migrations] started
2025-08-02 23:27:02.234 | [migrations] no migrations found
2025-08-02 23:27:02.311 | usermod: no changes
2025-08-02 23:27:02.332 | ───────────────────────────────────────
2025-08-02 23:27:02.332 | 
2025-08-02 23:27:02.332 |       ██╗     ███████╗██╗ ██████╗
2025-08-02 23:27:02.332 |       ██║     ██╔════╝██║██╔═══██╗
2025-08-02 23:27:02.332 |       ██║     ███████╗██║██║   ██║
2025-08-02 23:27:02.332 |       ██║     ╚════██║██║██║   ██║
2025-08-02 23:27:02.332 |       ███████╗███████║██║╚██████╔╝
2025-08-02 23:27:02.332 |       ╚══════╝╚══════╝╚═╝ ╚═════╝
2025-08-02 23:27:02.332 | 
2025-08-02 23:27:02.332 |    Brought to you by linuxserver.io
2025-08-02 23:27:02.332 | ───────────────────────────────────────
2025-08-02 23:27:02.333 | 
2025-08-02 23:27:02.333 | To support LSIO projects visit:
2025-08-02 23:27:02.333 | https://www.linuxserver.io/donate/
2025-08-02 23:27:02.333 | 
2025-08-02 23:27:02.333 | ───────────────────────────────────────
2025-08-02 23:27:02.333 | GID/UID
2025-08-02 23:27:02.333 | ───────────────────────────────────────
2025-08-02 23:27:02.336 | 
2025-08-02 23:27:02.336 | User UID:    911
2025-08-02 23:27:02.336 | User GID:    911
2025-08-02 23:27:02.336 | ───────────────────────────────────────
2025-08-02 23:27:02.338 | Linuxserver.io version: 14.5.5-ls128
2025-08-02 23:27:02.338 | Build-date: 2025-07-30T14:00:35+00:00
2025-08-02 23:27:02.338 | ───────────────────────────────────────
2025-08-02 23:27:02.338 |     
2025-08-02 23:27:02.925 | .+...+...+.....+...+....+......+.....+......+.........+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*..........+....+........+...+...+.+...+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*.+.+...+..+..........+...+..+....+.....+....+....................+.+......+...............+..+.+..+.......+...+........+......+.+...+...........+......+.......+..+....+.....+.+......+..+.+..+...+.........+...............+...+.......+.....+...+...+....+......+........................+......+......+........+.+..+...+....+..+.+..................+...........+.........+....+...+.....+...+......+.+...+......+..............+..........+.....+.+...+..+..........+......+........+.+...+...+..+......+....+..+.+...+..+...+....+.......................+..........+........+....+.....+.+.....+......+.............+..+.+........+............+.......+...+...+..+....+........+...+.......+...+..+.+..+.........+...+..................+.......+..+.+.............................+.+..............+....+..+.......+........+...+....+......+..............+...+....+........+......+....+........+..........+............+..+....+..+....+...+...........+......+...+.+...........+......+...+.+........+.......+.....+.+...+..............+.+...............+.....+.+......+..+.............+...............+...+..+.......+...+..............+......+...+.......+...+.........+.....+...+...+...................+..+.+........+.........+......+.......+........+.+.....+.+...............+..+.+..+....+.....+..........+...........+...+.+...+...+.................+.+......+......+.....+...+.......+...+............+.........+.........+...............+.....+.........+......+.+........+.+.....+....+........+.............+..+...+....+..+.+............+..+...+......+.+...+...+.........+......+.........+.....+..........+.....+...+..........+......+..+.......+............+..................+.....+.......+.....+..........+.....+...+...+...+......+.+..+......+....+.................+...+...+.............+.....+.+...+......+......+......+...+.....+......+.+..+...+..........+..+...+....+.....+.+........+............+......................+.....+.+......+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
2025-08-02 23:27:03.081 | ......+...+............+...+...+....+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*....+......+..+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*......+.............+..+...+....+.....+.+...........+..........+.....+..........+........+...+...+.+.....+................+...+......+...+.....+...+...+.........+.+..+.......+...+........+.+.....+....+.....+.+..................+.................+...+.+..+....+......................................+.+.....+.+........+...+....+........+......+.+.........+...........+...+...+....+...+..+..........+...+...+...+...............+.....+.......+..+.+..+...+.+..................+...+...+...........+...+.......+........+...+....+......+........+.......+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
2025-08-02 23:27:03.084 | -----
2025-08-02 23:27:03.177 | [custom-init] No custom files found, skipping...
2025-08-02 23:27:03.184 | **** No Wireguard conf found, VPN will not be enabled. ****
2025-08-02 23:27:03.218 | _XSERVTransmkdir: ERROR: euid != 0,directory /tmp/.X11-unix will not be created.
2025-08-02 23:27:03.219 | screen 0 shmid 0
2025-08-02 23:27:03.225 | [ls.io-init] done.
2025-08-02 23:27:03.295 | The XKEYBOARD keymap compiler (xkbcomp) reports:
2025-08-02 23:27:03.295 | > Warning:          Could not resolve keysym XF86CameraAccessEnable
2025-08-02 23:27:03.295 | > Warning:          Could not resolve keysym XF86CameraAccessDisable
2025-08-02 23:27:03.295 | > Warning:          Could not resolve keysym XF86CameraAccessToggle
2025-08-02 23:27:03.295 | > Warning:          Could not resolve keysym XF86NextElement
2025-08-02 23:27:03.295 | > Warning:          Could not resolve keysym XF86PreviousElement
2025-08-02 23:27:03.295 | > Warning:          Could not resolve keysym XF86AutopilotEngageToggle
2025-08-02 23:27:03.295 | > Warning:          Could not resolve keysym XF86MarkWaypoint
2025-08-02 23:27:03.295 | > Warning:          Could not resolve keysym XF86Sos
2025-08-02 23:27:03.295 | > Warning:          Could not resolve keysym XF86NavChart
2025-08-02 23:27:03.295 | > Warning:          Could not resolve keysym XF86FishingChart
2025-08-02 23:27:03.295 | > Warning:          Could not resolve keysym XF86SingleRangeRadar
2025-08-02 23:27:03.295 | > Warning:          Could not resolve keysym XF86DualRangeRadar
2025-08-02 23:27:03.295 | > Warning:          Could not resolve keysym XF86RadarOverlay
2025-08-02 23:27:03.295 | > Warning:          Could not resolve keysym XF86TraditionalSonar
2025-08-02 23:27:03.295 | > Warning:          Could not resolve keysym XF86ClearvuSonar
2025-08-02 23:27:03.295 | > Warning:          Could not resolve keysym XF86SidevuSonar
2025-08-02 23:27:03.295 | > Warning:          Could not resolve keysym XF86NavInfo
2025-08-02 23:27:03.296 | Errors from xkbcomp are not fatal to the X server
2025-08-02 23:27:03.711 | 19
2025-08-02 23:27:03.723 | 20
2025-08-02 23:27:03.839 | INFO:data_websocket:pcmflux library found. Audio capture is available.
2025-08-02 23:27:03.862 | INFO:data_websocket:pixelflux library found. Striped encoding modes available.
2025-08-02 23:27:03.912 | INFO:root:Expected C js_config_t size (from ctypes): 1354 bytes
2025-08-02 23:27:03.973 | INFO:main:Upload directory ensured: /config/Desktop
2025-08-02 23:27:03.974 | INFO:main:Starting Selkies (WebSocket Mode) with args: Namespace(encoder='x264enc', framerate=60, video_bitrate=16000, dri_node='', audio_device_name='', h264_crf=25, h264_fullcolor=False, h264_streaming_mode=False, watermark_path='', watermark_location=-1, debug=False)
2025-08-02 23:27:03.974 | INFO:main:Initial Encoder: x264enc, Framerate: 60, Bitrate: 16000kbps
2025-08-02 23:27:03.974 | INFO:main:SelkiesStreamingApp initialized: encoder=x264enc, display=1024x768
2025-08-02 23:27:03.974 | INFO:main:All main components initialized. Running server...
2025-08-02 23:27:03.981 | INFO:webrtc_input:Resetting keyboard modifiers.
2025-08-02 23:27:03.982 | INFO:webrtc_input:Starting clipboard monitor
2025-08-02 23:27:03.983 | INFO:webrtc_input:Found XFIXES version 4.0
2025-08-02 23:27:03.983 | INFO:webrtc_input:starting cursor monitor
2025-08-02 23:27:03.983 | INFO:webrtc_input:watching for cursor changes
2025-08-02 23:27:03.993 | WARNING:data_websocket:Cannot broadcast cursor data: no clients connected or server not ready.
2025-08-02 23:27:03.993 | INFO:data_websocket:Data WebSocket Server listening on port 8082
2025-08-02 23:27:04.122 | INFO:webrtc_input:Initializing 4 persistent gamepad instances...
2025-08-02 23:27:04.122 | INFO:root:Packed js_config payload for 'Microsoft X-Box 360 pad' (js0): len=1360 bytes. Name='Microsoft X-Box 360 pad', Vendor=0x045e, Product=0x028e, Version=0x0100, Reported Buttons=11 (Array capacity: 512), Reported Axes=8 (Array capacity: 64)
2025-08-02 23:27:04.122 | INFO:selkies_gamepad:Gamepad configured. JS socket: /tmp/selkies_js0.sock, EVDEV socket: /tmp/selkies_event1000.sock. Using fixed config: Microsoft X-Box 360 pad
2025-08-02 23:27:04.122 | INFO:webrtc_input:Initialized and started persistent gamepad instance for index 0 (Name: 'Microsoft X-Box 360 pad', JS: /tmp/selkies_js0.sock, EVDEV: /tmp/selkies_event1000.sock).
2025-08-02 23:27:04.122 | INFO:root:Packed js_config payload for 'Microsoft X-Box 360 pad' (js1): len=1360 bytes. Name='Microsoft X-Box 360 pad', Vendor=0x045e, Product=0x028e, Version=0x0100, Reported Buttons=11 (Array capacity: 512), Reported Axes=8 (Array capacity: 64)
2025-08-02 23:27:04.122 | INFO:selkies_gamepad:Gamepad configured. JS socket: /tmp/selkies_js1.sock, EVDEV socket: /tmp/selkies_event1001.sock. Using fixed config: Microsoft X-Box 360 pad
2025-08-02 23:27:04.122 | INFO:webrtc_input:Initialized and started persistent gamepad instance for index 1 (Name: 'Microsoft X-Box 360 pad', JS: /tmp/selkies_js1.sock, EVDEV: /tmp/selkies_event1001.sock).
2025-08-02 23:27:04.122 | INFO:root:Packed js_config payload for 'Microsoft X-Box 360 pad' (js2): len=1360 bytes. Name='Microsoft X-Box 360 pad', Vendor=0x045e, Product=0x028e, Version=0x0100, Reported Buttons=11 (Array capacity: 512), Reported Axes=8 (Array capacity: 64)
2025-08-02 23:27:04.122 | INFO:selkies_gamepad:Gamepad configured. JS socket: /tmp/selkies_js2.sock, EVDEV socket: /tmp/selkies_event1002.sock. Using fixed config: Microsoft X-Box 360 pad
2025-08-02 23:27:04.123 | INFO:webrtc_input:Initialized and started persistent gamepad instance for index 2 (Name: 'Microsoft X-Box 360 pad', JS: /tmp/selkies_js2.sock, EVDEV: /tmp/selkies_event1002.sock).
2025-08-02 23:27:04.123 | INFO:root:Packed js_config payload for 'Microsoft X-Box 360 pad' (js3): len=1360 bytes. Name='Microsoft X-Box 360 pad', Vendor=0x045e, Product=0x028e, Version=0x0100, Reported Buttons=11 (Array capacity: 512), Reported Axes=8 (Array capacity: 64)
2025-08-02 23:27:04.123 | INFO:selkies_gamepad:Gamepad configured. JS socket: /tmp/selkies_js3.sock, EVDEV socket: /tmp/selkies_event1003.sock. Using fixed config: Microsoft X-Box 360 pad
2025-08-02 23:27:04.123 | INFO:webrtc_input:Initialized and started persistent gamepad instance for index 3 (Name: 'Microsoft X-Box 360 pad', JS: /tmp/selkies_js3.sock, EVDEV: /tmp/selkies_event1003.sock).
2025-08-02 23:27:04.123 | INFO:selkies_gamepad:Gamepad /tmp/selkies_js0.sock: Event processor started.
2025-08-02 23:27:04.123 | INFO:selkies_gamepad:JS interposer server listening on /tmp/selkies_js0.sock
2025-08-02 23:27:04.124 | INFO:selkies_gamepad:Gamepad /tmp/selkies_js1.sock: Event processor started.
2025-08-02 23:27:04.124 | INFO:selkies_gamepad:JS interposer server listening on /tmp/selkies_js1.sock
2025-08-02 23:27:04.125 | INFO:selkies_gamepad:Gamepad /tmp/selkies_js2.sock: Event processor started.
2025-08-02 23:27:04.125 | INFO:selkies_gamepad:JS interposer server listening on /tmp/selkies_js2.sock
2025-08-02 23:27:04.126 | INFO:selkies_gamepad:Gamepad /tmp/selkies_js3.sock: Event processor started.
2025-08-02 23:27:04.126 | INFO:selkies_gamepad:JS interposer server listening on /tmp/selkies_js3.sock
2025-08-02 23:27:04.127 | INFO:selkies_gamepad:EVDEV interposer server listening on /tmp/selkies_event1000.sock
2025-08-02 23:27:04.127 | INFO:selkies_gamepad:EVDEV interposer server listening on /tmp/selkies_event1001.sock
2025-08-02 23:27:04.127 | INFO:selkies_gamepad:EVDEV interposer server listening on /tmp/selkies_event1002.sock
2025-08-02 23:27:04.127 | INFO:selkies_gamepad:EVDEV interposer server listening on /tmp/selkies_event1003.sock
2025-08-02 23:27:04.288 | dbus-daemon[243]: [system] Activating service name='org.freedesktop.login1' requested by ':1.26' (uid=911 pid=356 comm="/app/Browser/mullvadbrowser.real -profile /config/" label="kernel") (using servicehelper)
2025-08-02 23:27:04.288 | dbus-daemon[243]: [system] Activating service name='org.freedesktop.timedate1' requested by ':1.26' (uid=911 pid=356 comm="/app/Browser/mullvadbrowser.real -profile /config/" label="kernel") (using servicehelper)
2025-08-02 23:27:04.290 | dbus-daemon[243]: [system] Activated service 'org.freedesktop.login1' failed: Failed to execute program org.freedesktop.login1: Permission denied
2025-08-02 23:27:05.904 | WARNING:data_websocket:Cannot broadcast cursor data: no clients connected or server not ready.
2025-08-02 23:27:06.309 | WARNING:data_websocket:Cannot broadcast cursor data: no clients connected or server not ready.
2025-08-02 23:27:11.026 | INFO:data_websocket:Data WebSocket connected from ('127.0.0.1', 47794)
2025-08-02 23:27:11.026 | INFO:data_websocket:Broadcasting stream resolution: {"type": "stream_resolution", "width": 1024, "height": 768}
2025-08-02 23:27:11.027 | INFO:data_websocket:Sending last known cursor to new client ('127.0.0.1', 47794)
2025-08-02 23:27:11.028 | INFO:data_websocket:Attempting to establish PulseAudio connection...
2025-08-02 23:27:11.030 | INFO:data_websocket:PulseAudio connection established.
2025-08-02 23:27:11.070 | INFO:data_websocket:Applying client settings (initial=True): {'videoBitRate': 16000000, 'videoFramerate': 60, 'videoCRF': 25, 'encoder': 'x264enc', 'h264_fullcolor': False, 'h264_streaming_mode': False, 'resizeRemote': True, 'isManualResolutionMode': False, 'manualWidth': 1024, 'manualHeight': 768, 'audioBitRate': 320000, 'videoBufferSize': 0, 'initialClientWidth': 2560, 'initialClientHeight': 1286}
2025-08-02 23:27:11.070 | INFO:gst_app_resize:on_resize_handler attempting resize for: 2560x1286
2025-08-02 23:27:11.070 | INFO:gst_app_resize:App dimensions updated to 2560x1286 before xrandr call.
2025-08-02 23:27:11.074 | INFO:gst_app_resize:Mode 2560x1286 not found in xrandr list. Attempting to add for screen 'screen'.
2025-08-02 23:27:11.081 | INFO:gst_app_resize:Successfully ran: xrandr --newmode 2560x1286 276.25 2560 2736 3008 3456 1286 1289 1299 1333 -hsync +vsync
2025-08-02 23:27:11.086 | INFO:gst_app_resize:Successfully ran: xrandr --addmode screen 2560x1286
2025-08-02 23:27:11.086 | INFO:gst_app_resize:Applying xrandr mode '2560x1286' for screen 'screen'.
2025-08-02 23:27:11.095 | INFO:gst_app_resize:Successfully applied xrandr mode '2560x1286'.
2025-08-02 23:27:11.095 | INFO:gst_app_resize:resize_display('2560x1286') reported success.
2025-08-02 23:27:11.095 | WARNING:data_websocket:Pipeline is inactive for the initial client. Forcing a start.
2025-08-02 23:27:11.095 | INFO:data_websocket:Video pipeline for x264enc needs to start (was not active or forced).
2025-08-02 23:27:11.095 | INFO:data_websocket:Starting x264enc: 2560x1286 @ 60.0fps, CRF: 25, FullFrame: True
2025-08-02 23:27:11.096 | INFO:data_websocket:Broadcasting stream resolution: {"type": "stream_resolution", "width": 2560, "height": 1286}
2025-08-02 23:27:11.096 | WARNING:data_websocket:Attempting to start backpressure task, but client_settings_received event is not set or None. The task will wait for this event. Ensure it's set when initial client settings are processed.
2025-08-02 23:27:11.096 | INFO:data_websocket:Trying to ensure client_settings_received is set for backpressure task start.
2025-08-02 23:27:11.096 | INFO:data_websocket:New frame backpressure task started (current encoder: 'x264enc').
2025-08-02 23:27:11.096 | INFO:data_websocket:x264enc capture started successfully.
2025-08-02 23:27:11.096 | INFO:data_websocket:Initial client settings message processed by ws_handler.
2025-08-02 23:27:11.096 | INFO:data_websocket:Initial setup: Audio pipeline not yet active, attempting start.
2025-08-02 23:27:11.096 | INFO:data_websocket:Starting pcmflux audio pipeline...
2025-08-02 23:27:11.096 | INFO:data_websocket:pcmflux settings: device='', bitrate=320000, channels=2
2025-08-02 23:27:11.097 | [pcmflux] Attempting to connect to PulseAudio device: system_default...
2025-08-02 23:27:11.097 | INFO:data_websocket:Frame-based backpressure logic task started.
2025-08-02 23:27:11.097 | INFO:data_websocket:Client settings received, proceeding with backpressure loop.
2025-08-02 23:27:11.097 | INFO:data_websocket:pcmflux audio capture started successfully.
2025-08-02 23:27:11.098 | [pcmflux] SUCCESS: Connected to PulseAudio.
2025-08-02 23:27:11.098 | INFO:data_websocket:pcmflux audio chunk broadcasting task started.
2025-08-02 23:27:11.099 | [pcmflux] SUCCESS: Opus encoder created.
2025-08-02 23:27:11.099 | [pcmflux] Capture loop started. Device: system_default, Rate: 48000, Channels: 2, Bitrate: 320 kbps, VBR: On, Silence Gate: Off, PCM Chunk: 3840 bytes
2025-08-02 23:27:11.099 | X Shared Memory Extension available.
2025-08-02 23:27:11.099 | XShm setup complete for 2560x1286.
2025-08-02 23:27:11.099 | CPU cores available: 6
2025-08-02 23:27:11.101 | WARNING:webrtc_input:No clipboard content to send
2025-08-02 23:27:11.268 | INFO:data_websocket:Received START_VIDEO for encoder: x264enc
2025-08-02 23:27:11.268 | INFO:data_websocket:x264enc pipeline is already capturing.
2025-08-02 23:27:11.268 | INFO:data_websocket:Received START_AUDIO command from client for server-to-client audio.
2025-08-02 23:27:11.269 | INFO:data_websocket:START_AUDIO: pcmflux audio pipeline already active.
2025-08-02 23:27:12.103 | Res: 2560x1286 Mode: H264 (CPU) CS_IN:I420 LR FF Stripes: 1 CRF:25 EncFPS: 3.00 EncStripes/s: 3.00
2025-08-02 23:27:13.098 | [pcmflux] First non-silent audio chunk detected! Encoding...
2025-08-02 23:27:13.099 | [pcmflux] Status | Read: 1, Silent: 0 (0.0%), Encoded: 1, Rate: 0.01 kbps
2025-08-02 23:27:13.118 | Res: 2560x1286 Mode: H264 (CPU) CS_IN:I420 LR FF Stripes: 1 CRF:25 EncFPS: 2.00 EncStripes/s: 2.00
2025-08-02 23:27:14.135 | Res: 2560x1286 Mode: H264 (CPU) CS_IN:I420 LR FF Stripes: 1 CRF:25 EncFPS: 2.00 EncStripes/s: 2.00
2025-08-02 23:27:15.100 | [pcmflux] Status | Read: 17, Silent: 0 (0.0%), Encoded: 17, Rate: 0.20 kbps
2025-08-02 23:27:15.146 | Res: 2560x1286 Mode: H264 (CPU) CS_IN:I420 LR FF Stripes: 1 CRF:25 EncFPS: 2.00 EncStripes/s: 2.00
2025-08-02 23:27:15.846 | INFO:data_websocket:Cleaning up Data WS handler for ('127.0.0.1', 47794)...
2025-08-02 23:27:15.846 | INFO:data_websocket:Last client (('127.0.0.1', 47794)) disconnected. Cancelling frame backpressure task.
2025-08-02 23:27:15.846 | INFO:data_websocket:No other clients in set after ('127.0.0.1', 47794) disconnected. Marking pipelines for stop.
2025-08-02 23:27:15.846 | INFO:data_websocket:Stopping global pipelines due to last client disconnect (('127.0.0.1', 47794)).
2025-08-02 23:27:15.846 | INFO:main:Initiating unified pipeline shutdown...
2025-08-02 23:27:15.857 | INFO:main:Queueing x264-striped capture stop.
2025-08-02 23:27:15.857 | INFO:main:Queueing pcmflux audio capture stop.
2025-08-02 23:27:15.857 | INFO:main:Waiting for 2 capture module(s) to stop...
2025-08-02 23:27:15.873 | Capture loop stopped. X resources released.
2025-08-02 23:27:16.031 | INFO:data_websocket:Stats sender: WS connection closed.
2025-08-02 23:27:17.101 | [pcmflux] Status | Read: 100, Silent: 0 (0.0%), Encoded: 100, Rate: 1.20 kbps
2025-08-02 23:27:17.101 | [pcmflux] Stop requested. Cleaning up capture loop...
2025-08-02 23:27:17.101 | [pcmflux] Audio capture loop finished. Resources released.
2025-08-02 23:27:17.101 | INFO:main:All C++ capture modules have stopped.
2025-08-02 23:27:17.102 | INFO:data_websocket:Frame-based backpressure logic task cancelled.
2025-08-02 23:27:17.102 | INFO:data_websocket:Frame-based backpressure logic task finished.
2025-08-02 23:27:17.102 | INFO:data_websocket:Backpressure task was stopped. Calling _reset_frame_ids_and_notify.
2025-08-02 23:27:17.102 | INFO:data_websocket:Resetting frame IDs.
2025-08-02 23:27:17.102 | INFO:data_websocket:Frame IDs reset, but no clients to notify.
2025-08-02 23:27:17.102 | INFO:data_websocket:pcmflux audio chunk broadcasting task cancelled.
2025-08-02 23:27:17.102 | INFO:data_websocket:pcmflux audio chunk broadcasting task finished.
2025-08-02 23:27:17.102 | INFO:main:Unified pipeline shutdown complete.
2025-08-02 23:27:17.102 | INFO:data_websocket:Data WS handler for ('127.0.0.1', 47794) finished all cleanup.

[github-actions]

Thanks for opening your first issue here! Be sure to follow the relevant issue templates, or risk having this issue marked as invalid.

[thespad]

It's not something we can "fix". Version 14 was released nearly a year ago, it includes that warning because that's when distros started adding in restrictions on unprivileged user namespace creation, not because anything changed within it per se.

Apparmor profiles have to be managed on the host, not in the container, and as far I can tell either the apparmor profile they supply doesn't provide sufficient permissions or the browser running in the container is unable to tell that it has sufficient permissions when the profile is applied.

In any case, the only way I can see so far to provide what it needs is to run the container privileged, which is not advisable.

Of course being in a container means that it's already sandboxed in its own process namespace, so the lack of browser-specific sandboxing is not the issue it would be running natively on the host.

[thelamer]

It's sandbox musical chairs, you can't namespace in the container so the container is your sandbox. Technically if there is an unknown vuln tabs could leak to other tabs. The solution is certainly not to expose host privs to remove the warning as that is worse, so it kind of is what it is.

[fish-not-phish]

Is there no possible way to even suppress/hide the warning via CLI commands during the launch of Mullvad (or any other application, since this appears to impact other applications as well)? It gives the user the illusion that their application is insecure.

[thespad]

There is a config setting for it, security.sandbox.warn_unprivileged_namespaces, it'll see how easy it is to inject into the container startup.