Linux browser sandbox errors and --no-sandbox fixes

Fixes on record

Merged to main. A stamp counts the issues a fix is linked to.

• #19747 fix(browser): inject --no-sandbox for root and AppArmor userns restrictions

  merged to main

  files: tools/browser_tool.py

  Show the diff

  • tools/browser_tool.py

    @@ -1482,6 +1482,34 @@ def _run_browser_command(
             if "AGENT_BROWSER_IDLE_TIMEOUT_MS" not in browser_env:
                 idle_ms = str(BROWSER_SESSION_INACTIVITY_TIMEOUT * 1000)
                 browser_env["AGENT_BROWSER_IDLE_TIMEOUT_MS"] = idle_ms
    +
    +        # Inject --no-sandbox when needed (issue #15765):
    +        # - Running as root: Chromium always refuses to start without it
    +        # - Ubuntu 23.10+ / AppArmor systems: unprivileged user namespaces
    +        #   are restricted, causing Chromium to exit with "No usable sandbox"
    +        #   even for non-root users running under systemd or containers.
    +        if "AGENT_BROWSER_CHROME_FLAGS" not in browser_env:
    +            _needs_sandbox_bypass = False
    +            if hasattr(os, "geteuid") and os.geteuid() == 0:
    +                _needs_sandbox_bypass = True
    +                logger.debug("browser: running as root — injecting --no-sandbox")
    +            else:
    +                # Detect AppArmor user namespace restrictions (Ubuntu 23.10+)
    +                _userns_restrict = "/proc/sys/kernel/apparmor_restrict_unprivileged_userns"
    +                try:
    +                    with open(_userns_restrict) as _f:
    +                        if _f.read().strip() == "1":
    +                            _needs_sandbox_bypass = True
    +                            logger.debug(
    +                                "browser: AppArmor userns restrictions detected — "
    +                                "injecting --no-sandbox"
    +                            )
    +                except OSError:
    +                    pass
    +            if _needs_sandbox_bypass:
    +                browser_env["AGENT_BROWSER_CHROME_FLAGS"] = (
    +                    "--no-sandbox --disable-dev-shm-usage"
    +                )
             
             # Use temp files for stdout/stderr instead of pipes.
             # agent-browser starts a background daemon that inherits file