[BUG] "Paste" button appearing when LEFT CLICK

[ghiki]

Is there an existing issue for this?

• I have searched the existing issues

Current Behavior

In
image: lscr.io/linuxserver/firefox:kasm
version, when using from Firefox (with edge this didnt happen) always appear "Paste" button when taking windows focus and left clicking.

Something is mentioned here:
https://www.kasmweb.com/kasmvnc/docs/latest/release_notes/1.3.2.html

Expected Behavior

Left click on Kasm browser when left click.

Steps To Reproduce

Create container with

version: "2.1"
services:
  # ───────────── Navegador protegido (Firefox / noVNC) ─────────────
  firefox_kasm:
    #image: lscr.io/linuxserver/firefox:latest
    image: lscr.io/linuxserver/firefox:kasm
    container_name: firefox_secure_kasm
    restart: unless-stopped
    environment:
      - PUID=1000
      - PGID=100
      - TZ=Europe/Madrid
      - CUSTOM_USER=xxxxxxx
      - PASSWORD=xxxxxx
      - LC_ALL=es_ES.UTF-8
      - DRINODE=/dev/dri/renderD128       # ← fuerza la GPU/DRI concreta (Intel VAAPI)
      - LIBVA_DRIVER_NAME=iHD         # Driver Intel moderno (cámbialo a i965 si tu iGPU es muy antigua)

      # Tips opcionales del propio contenedor (no de resolución):
      # - NO_FULL=1      # evita auto-fullscreen si no lo quieres
      # - TITLE=Firefox  # cambia el título de la página
    devices:
      - /dev/dri:/dev/dri                 # ← expone VAAPI (Intel iGPU) al contenedor
    volumes:
      - firefox-kasm_secure_config:/config
      - /share/Downloads:/config/Descargas
      - firefox-kasm_secure_downloads:/downloads
      - /share/Public/noshell:/usr/bin/xterm:ro   # bloquea xterm
      - /share/Public/noshell:/usr/bin/sudo:ro    # bloquea sudo
    ports:
      - "9898:3001"   # HTTPS externo → interno noVNC
    security_opt:
      - seccomp:unconfined
    shm_size: "1gb"

volumes:
  firefox-kasm_secure_config:
  firefox-kasm_secure_downloads:

access to it and left click

Environment

- OS: Qnap QTS (Alpine Linux based)
- How  docker service was installed: from Qnap

CPU architecture

x86-64

Docker creation

version: "2.1"
services:
  # ───────────── Navegador protegido (Firefox / noVNC) ─────────────
  firefox_kasm:
    #image: lscr.io/linuxserver/firefox:latest
    image: lscr.io/linuxserver/firefox:kasm
    container_name: firefox_secure_kasm
    restart: unless-stopped
    environment:
      - PUID=1000
      - PGID=100
      - TZ=Europe/Madrid
      - CUSTOM_USER=xxxxxxx
      - PASSWORD=xxxxxx
      - LC_ALL=es_ES.UTF-8
      - DRINODE=/dev/dri/renderD128       # ← fuerza la GPU/DRI concreta (Intel VAAPI)
      - LIBVA_DRIVER_NAME=iHD         # Driver Intel moderno (cámbialo a i965 si tu iGPU es muy antigua)

      # Tips opcionales del propio contenedor (no de resolución):
      # - NO_FULL=1      # evita auto-fullscreen si no lo quieres
      # - TITLE=Firefox  # cambia el título de la página
    devices:
      - /dev/dri:/dev/dri                 # ← expone VAAPI (Intel iGPU) al contenedor
    volumes:
      - firefox-kasm_secure_config:/config
      - /share/Downloads:/config/Descargas
      - firefox-kasm_secure_downloads:/downloads
      - /share/Public/noshell:/usr/bin/xterm:ro   # bloquea xterm
      - /share/Public/noshell:/usr/bin/sudo:ro    # bloquea sudo
    ports:
      - "9898:3001"   # HTTPS externo → interno noVNC
    security_opt:
      - seccomp:unconfined
    shm_size: "1gb"

volumes:
  firefox-kasm_secure_config:
  firefox-kasm_secure_downloads:

Container logs

      ██╗     ███████╗██╗ ██████╗
      ██║     ██╔════╝██║██╔═══██╗
      ██║     ███████╗██║██║   ██║
      ██║     ╚════██║██║██║   ██║
      ███████╗███████║██║╚██████╔╝
      ╚══════╝╚══════╝╚═╝ ╚═════╝

   Brought to you by linuxserver.io
───────────────────────────────────────

To support LSIO projects visit:
https://www.linuxserver.io/donate/

───────────────────────────────────────
GID/UID
───────────────────────────────────────

User UID:    1000
User GID:    100
───────────────────────────────────────
Linuxserver.io version: 141.0.3build1-0ubuntu0.24.04.1mt1-ls8
Build-date: 2025-08-12T02:35:46+00:00
───────────────────────────────────────
    
**** adding /dev/dri/renderD128 to video group root with id 0 ****
**** The device /dev/dri/renderD128 does not have group read/write permissions, attempting to fix inside the container.If it doesn't work, you can run the following on your docker host: ****
sudo chmod g+rw /dev/dri/renderD128

**** The device /dev/dri/card0 does not have group read/write permissions, attempting to fix inside the container.If it doesn't work, you can run the following on your docker host: ****
sudo chmod g+rw /dev/dri/card0

[custom-init] No custom files found, skipping...
Openbox-Message: No se pudo abrir la pantalla desde la variable de entorno DISPLAY
_XSERVTransmkdir: ERROR: euid != 0,directory /tmp/.X11-unix will not be created.

Xvnc KasmVNC 1.3.3 - built Jul 12 2025 19:10:05
Copyright (C) 1999-2018 KasmVNC Team and many others (see README.me)
See http://kasmweb.com for information on KasmVNC.
Underlying X server release 12101012

[ls.io-init] done.
The XKEYBOARD keymap compiler (xkbcomp) reports:
> Warning:          Could not resolve keysym XF86CameraAccessEnable
> Warning:          Could not resolve keysym XF86CameraAccessDisable
> Warning:          Could not resolve keysym XF86CameraAccessToggle
> Warning:          Could not resolve keysym XF86NextElement
> Warning:          Could not resolve keysym XF86PreviousElement
> Warning:          Could not resolve keysym XF86AutopilotEngageToggle
> Warning:          Could not resolve keysym XF86MarkWaypoint
> Warning:          Could not resolve keysym XF86Sos
> Warning:          Could not resolve keysym XF86NavChart
> Warning:          Could not resolve keysym XF86FishingChart
> Warning:          Could not resolve keysym XF86SingleRangeRadar
> Warning:          Could not resolve keysym XF86DualRangeRadar
> Warning:          Could not resolve keysym XF86RadarOverlay
> Warning:          Could not resolve keysym XF86TraditionalSonar
> Warning:          Could not resolve keysym XF86ClearvuSonar
> Warning:          Could not resolve keysym XF86SidevuSonar
> Warning:          Could not resolve keysym XF86NavInfo
Errors from xkbcomp are not fatal to the X server
[mi] mieq: warning: overriding existing handler (nil) with 0x556ed5445930 for event 2
[mi] mieq: warning: overriding existing handler (nil) with 0x556ed5445930 for event 3
19
Obt-Message: Xinerama extension is not present on the server
xvnc_get_formats
xvnc_get_formats
xvnc_get_formats
 2025-09-09 10:26:58,748 [INFO] websocket 0: got client connection from 127.0.0.1
 2025-09-09 10:26:58,760 [PRIO] Connections: accepted: @46.24.42.34_1757406418.748337::websocket
xvnc_get_formats
xvnc_get_formats
 2025-09-09 10:27:14,256 [PRIO] Connections: closed: @46.24.42.34_1757406418.748337::websocket (Clean disconnection)
 2025-09-09 10:27:15,454 [INFO] websocket 1: got client connection from 127.0.0.1
 2025-09-09 10:27:15,466 [PRIO] Connections: accepted: @46.24.42.34_1757406435.454422::websocket
 2025-09-09 10:35:59,209 [INFO] websocket 2: got client connection from 127.0.0.1
 2025-09-09 10:35:59,222 [PRIO] Connections: accepted: @46.24.42.34_1757406959.210219::websocket
xvnc_get_formats
 2025-09-09 10:36:15,370 [PRIO] Connections: closed: @46.24.42.34_1757406959.210219::websocket (Clean disconnection)
 2025-09-09 10:36:16,182 [INFO] websocket 3: got client connection from 127.0.0.1
 2025-09-09 10:36:16,195 [PRIO] Connections: accepted: @46.24.42.34_1757406976.182885::websocket
xvnc_get_formats
 2025-09-09 10:36:34,699 [PRIO] Connections: closed: @46.24.42.34_1757406976.182885::websocket (Clean disconnection)
 2025-09-09 10:36:35,926 [INFO] websocket 4: got client connection from 127.0.0.1
 2025-09-09 10:36:35,939 [PRIO] Connections: accepted: @46.24.42.34_1757406995.926977::websocket
 2025-09-09 10:36:56,688 [PRIO] Connections: closed: @46.24.42.34_1757406995.926977::websocket (Clean disconnection)
 2025-09-09 10:36:57,429 [INFO] websocket 5: got client connection from 127.0.0.1
 2025-09-09 10:36:57,442 [PRIO] Connections: accepted: @46.24.42.34_1757407017.429989::websocket
 2025-09-09 10:37:29,399 [PRIO] Connections: closed: @46.24.42.34_1757407017.429989::websocket (Clean disconnection)
 2025-09-09 10:37:30,287 [INFO] websocket 6: got client connection from 127.0.0.1
 2025-09-09 10:37:30,299 [PRIO] Connections: accepted: @46.24.42.34_1757407050.287663::websocket
[GFX1-]: RenderCompositorSWGL failed mapping default framebuffer, no dt
libva info: VA-API version 1.20.0
libva info: User environment variable requested driver 'iHD'
libva info: Trying to open /usr/lib/x86_64-linux-gnu/dri/iHD_drv_video.so
libva info: Found init function __vaDriverInit_1_20
libva info: va_openDriver() returns 0
 2025-09-09 10:38:40,805 [PRIO] VNCSConnST: Failed to flush remaining socket data on close: write: Broken pipe (32)
 2025-09-09 10:38:40,806 [PRIO] Connections: closed: @46.24.42.34_1757407050.287663::websocket (write: Broken pipe (32))
xvnc_get_formats

[github-actions]

Thanks for opening your first issue here! Be sure to follow the relevant issue templates, or risk having this issue marked as invalid.

[LinuxServer-CI]

This issue has been automatically marked as stale because it has not had recent activity. This might be due to missing feedback from OP. It will be closed if no further activity occurs. Thank you for your contributions.

[DenTechs]

Figured i'd mention that i'm also experiencing the same issue. Also some keyboard keys are getting stuck when changing windows. For example if I use "ctrl - tab" to change windows, when i got back to firefox the ctrl key is stuck down until i click it again.

[thelamer]

This is just how firefox decided to implement the seemless clipboard API, to disable this in about:config set dom.event.clipboardevents.enabled to false.

[ghiki]

Still happening the same issue with "dom.event.clipboardevents.enable" switched to "false"

this is my compose yaml:

services:
  chromium_cont:
    #image: lscr.io/linuxserver/chromium:latest
    image: lscr.io/linuxserver/chromium:kasm
    #This is just how firefox decided to implement the seemless clipboard API, to disable this in about:config set dom.event.clipboardevents.enabled to false.
    container_name: chromium_secure_cont
    restart: unless-stopped
    environment:
      - PUID=1000
      - PGID=100
      - TZ=Europe/Madrid
      - CUSTOM_USER=administrador
      - PASSWORD=Eroski02
      - LC_ALL=es_ES.UTF-8

      # ── Drivers/VAAPI/Mesa ────────────────────────────────────────
      - DOCKER_MODS=linuxserver/mods:universal-package-install
      - INSTALL_PACKAGES=libgl1-mesa-dri|mesa-va-drivers|libegl1|vainfo|intel-media-va-driver-non-free|i965-va-driver|intel-gpu-tools
      - DRINODE=/dev/dri/renderD128
      - LIBVA_DRIVER_NAME=iHD
      - HW3D=true
      - KASM_EGL_DEVICE=/dev/dri/renderD128
      - XDG_RUNTIME_DIR=/run/user/1000

      # ── Flags Chromium para VAAPI en contenedor ───────────────────
      #- CHROME_CLI=--no-sandbox --use-gl=egl --ozone-platform=x11 --ignore-gpu-blocklist --enable-gpu-rasterization --enable-zero-copy --enable-features=VaapiVideoDecoder,VaapiVideoEncoder,CanvasOopRasterization --disable-features=UseChromeOSDirectVideoDecoder,Vulkan
      - KASM_AUDIO_OUTPUT=1
      - KASM_AUDIO_INPUT=1
    devices:
      - /dev/dri/card0:/dev/dri/card0
      - /dev/dri/renderD128:/dev/dri/renderD128
    group_add:
      - "44"   # video
    volumes:
      - chromium-cont_secure_config:/config
      - chromium-cont_secure_downloads:/downloads
      # (opcionales) bloqueos de shell
      - /share/Public/noshell:/usr/bin/xterm:ro
      - /share/Public/noshell:/usr/bin/sudo:ro
      - /share/Downloads:/config/Downloads
      - /share/Downloads:/config/Desktop
    ports:
      - "9898:3001"              # o "8090:3001" si prefieres 8090
    security_opt:
      - seccomp:unconfined
    shm_size: "1gb"
    tmpfs:
      - /run/user/1000:size=32m,mode=700

volumes:
  chromium-cont_secure_config:
  chromium-cont_secure_downloads:

btw, if i set "clipboardevents" to "false", i cant copy anything from browser to outside the browser