You Can Install Edge Browser on openSUSE... In a Rootless Container
Tags: tutorial, linux, productivity, microsoft
Published: 2024-05-17 06:02:51

Installing Edge on Linux is _not_ a straight forward process if you're not using Debian-based distros, as only .deb package is available on [the _official_ website](https://www.microsoft.com/en-us/edge). Fortunately, Microsoft also provides its _official_ Linux repo that we can use to download and install Microsoft products on our system.

👉️ Table of contents:
1. Preparing the Container
2. Install Edge
3. Export Edge from the Container
4. Edit the Startup WM Class in the Desktop File
5. Check the Host's Keyring Entry
6. Automatically Update the Browser

---

## 1. Preparing the Container

I install the browser in a container because I want an isolation between the browser and my base system. I consider this is a _good_ practice in both security and management, as the container is rootless, plus I can delete the container along with everything inside it more easily without affecting my system in any way.

If you want to install the browser directly on your system, you can skip this part.

### 1.1. Install Distrobox and Podman on the Host

```
sudo zypper install distrobox podman
```

### 1.2. Configure Distrobox to use Podman

```
echo 'container_manager="podman"' > ~/.config/distrobox/distrobox.conf
```

### 1.3. Create a New Distrobox Container for Edge

```
distrobox create -i registry.opensuse.org/opensuse/tumbleweed:latest -n edge-dbx --volume /run/dbus/system_bus_socket:/run/dbus/system_bus_socket
```

> Note, if you're using Distrobox ≤ 1.7.1, you'll have to add `--hostname "$(uname -n)"` to the `distrobox create` command. Otherwise, you will have an issue with `.desktop` icon integretion with GNOME, see [gnome-shell issue #7531](https://gitlab.gnome.org/GNOME/gnome-shell/-/issues/7531).

### 1.4. Prepare the Packages Inside the Container

#### Base Packages

```
sudo zypper install adwaita-icon-theme dbus-1-x11 glib2
```

#### VA-API drivers for Intel GPUs

```
sudo zypper install intel-media-driver libva-utils
```

> Note, AFAIK, AMD's VA-API doesn't work with Chromium _yet_. Plus, you would also need to `sudo zypper install opi && opi codecs` for H265 video acceleration to work. For NVIDIA, please refer to [the GPU section](https://github.com/89luca89/distrobox/blob/main/docs/useful_tips.md#using-the-gpu-inside-the-container) on Distrobox's GitHub page.

### 1.5. Prepare DBus

```
eval $(dbus-launch --sh-syntax)
```

At this point, if you set a bigger cursor size on the host system like me, you might want to change the cursor size in the container to match the one on your system as well. For example, the medium size (32) would be:

```
gsettings set org.gnome.desktop.interface cursor-size 32
```

> The host's system reboot is required for this to take effect.

---

## 2. Install Edge

### 2.1. Add the _Official_ Edge Repo

```
sudo zypper ar -f --gpgcheck-allow-unsigned https://packages.microsoft.com/yumrepos/edge/ edge-yum
```

Then, refresh all repos with:

```
sudo zypper refresh
```

> Note, I use `-f` to make the repo automatically refresh, and `--gpgcheck-allow-unsigned` to allow the unsigned repo and packages, the same with the [_official_ config.repo](https://packages.microsoft.com/yumrepos/edge/config.repo) on Microsoft website.

### 2.2. Install Edge (finally 😂)

```
sudo zypper install microsoft-edge-stable
```

---

## 3. Export Edge from the Container

```
distrobox-export -a microsoft-edge-stable -ef "--enable-features=UseOzonePlatform,VaapiVideoDecodeLinuxGL,VaapiVideoEncoder --use-gl=angle --use-angle=gl --ozone-platform=wayland"
```

I use many flags as shown on above to enable native Wayland mode and VA-API video acceleration. Unlike other Chromium-based browser, you'll have to enable native Wayland through launch flags.

---

## 4. Edit the Startup WM Class in the Desktop File

You can use [MenuLibre](https://github.com/bluesabre/menulibre) for this. Easy installation on the host system:

```
sudo zypper install menulibre gnome-icon-theme
```

Then, you can add `microsoft-edge` as the Startup WM Class, as shown in the screenshot below:

![MenuLibre](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/qzehvd800y5fhpczf0s5.png)

> Note, you can use `Alt+F2` then `lg` to view any app's correct Startup WM Class value.

> If the icon of the browser doesn't show up, you can reboot the system. After that, the icon will show up without issues.

---

## 5. Check the Host's Keyring Entry

This is the most important step of all. On GNOME, we can use [the Passwords and Keys](https://gitlab.gnome.org/GNOME/seahorse) app (Seahorse) to check whether the browser created a correct entry. If it doesn't create any entry, it means that all your data, which would be encrypted otherwise, will be stored in plain text!

In our case, if the encryption is in place, Edge will store its entry as _Chromium Safe Storage_, as shown in the screenshot below:

![Edge's keyring entry](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/v4ot1kohu9td9vtai96f.png)

> Note, not all container images could access the host's keyring in rootless mode, Ubuntu's container images for example.

---

## 6. Automatically Update the Browser

One important factor to make the browser as secure as it can be is to update it ASAP when a new version is released. To do this, we can use systemd's service and timer like this:

### `dbx-upgrade.service`

```
[Unit]
Description=Upgrade all rootless Distrobox containers.
RequiresMountsFor=/run/user/1000/containers

[Service]
Type=exec
ExecStart=-bash -c "distrobox-upgrade --all"
Restart=on-failure
RestartSec=60
TimeoutStopSec=5min
RemainAfterExit=yes
```

Save this in `~/.config/systemd/user/dbx-upgrade.service`.

### `dbx-upgrade.timer`

```
[Unit]
Description=Run distrobox-upgrade --all daily.

[Timer]
OnCalendar=daily
RandomizedDelaySec=5min
Persistent=true

[Install]
WantedBy=timers.target
```

Save this in `~/.config/systemd/user/dbx-upgrade.timer`.

### Enable the Timer

```
systemctl --user daemon-reload && systemctl --user enable dbx-upgrade.timer
```

---

## Why Not Flatpak

There are many issues with all the Chromium-based browsers on Flathub. The showstoppers for me are Widevine and PWA supports.
- You need to open `filesystem=host-os` to have Widevine support. I tested with Brave, see [Brave Flatpak issue #357](https://github.com/flathub/com.brave.Browser/issues/357). [Flatseal](https://flathub.org/apps/com.github.tchx84.Flatseal) is the easiest way to do it.
- Currently, on Wayland session, PWA icons doesn't work correctly, see [Edge Flatpak issue #486](https://github.com/flathub/com.microsoft.Edge/issues/486).

Also, everyone must know that every Chromium-based browser available on Flathub uses [zypak](https://github.com/refi64/zypak) to circumvent Chromium's _refined_ sandboxing. For a better or worse, security of zypak and Flatpak's sandboxing in general are still up for debating.

Lastly, Edge on Flathub is _**NOT**_ maintained or affiliated by Microsoft. I am against using unverified software, unless it's maintained by your Linux distro, I don't think using unverified software in any form is a good idea, especially when _security_ is the utmost important aspect of the app. Yes, your web browser is that kind of app. If you're not convinced, please see the recent incidents [[1]](https://popey.com/blog/2024/02/exodus-bitcoin-wallet-490k-swindle/), [[2]](https://popey.com/blog/2024/03/exodus-wallet-part-three/) about fake Exodus wallet app for example.

---

I hope this helps! Bye 💨

---

Cover Photo by [Microsoft Edge](https://unsplash.com/@microsoftedge?utm_content=creditCopyText&utm_medium=referral&utm_source=unsplash) on [Unsplash](https://unsplash.com/photos/person-using-surface-laptop-epf0g9qyIgY?utm_content=creditCopyText&utm_medium=referral&utm_source=unsplash)