{"repo":"NousResearch/hermes-agent","public_id":"15765","display_label":"Linux browser sandbox errors and --no-sandbox fixes","summary":"These issues and PRs address browser automation failures on Linux environments (root users, VPS, Ubuntu 23.10+) caused by sandbox restrictions, proposing automatic injection of the --no-sandbox flag and related detection logic.","subsystem":"agent","counts":{"members":4,"open_issues":0,"open_issues_distinct":0,"open_prs":0,"closed_issues":1,"merged_prs":1,"attempt_prs":2},"landed_fix":{"status":"merged_to_main","basis":"structural","pr":19747,"merged_at":"2026-05-04T12:27:23+00:00"},"resolution":{"state":"resolved","by":"pr-19747"},"freshness":{"state":"verified","last_verified_at":"2026-05-04T12:27:23+00:00","is_stale":false},"grouping":{"backbone":"STRUCTURAL_SPANNING","link_density":0.5},"fix_edges":[{"issue_number":15765,"pr_number":19747,"tier":"verified","basis":"closing_ref","confidence":0.95,"recoverable_from_timeline":true,"pr_merged_at":"2026-05-04T12:27:23+00:00"}],"members":[{"kind":"issue","number":15765,"title":"Browser automation fails on Linux root/VPS: needs --no-sandbox and chromium channel auto-detection","url":null,"state":"closed"},{"kind":"pr","number":15771,"title":"fix(browser): inject --no-sandbox when running as root on Linux VPS","url":null,"state":"closed","close_reason":{"refs":[{"kind":"pr","value":"#19747","number":19747}],"category":"merged_via","implication":"superseded"},"merged":false},{"kind":"pr","number":19747,"title":"fix(browser): inject --no-sandbox for root and AppArmor userns restrictions","url":null,"state":"merged","close_reason":{"category":"merged"},"merged":true,"is_fix_pr":true,"fix_tier":"verified","files_changed":["tools/browser_tool.py"],"fix_hunks":[{"file":"tools/browser_tool.py","hunks":["@@ -1482,6 +1482,34 @@ def _run_browser_command(\n         if \"AGENT_BROWSER_IDLE_TIMEOUT_MS\" not in browser_env:\n             idle_ms = str(BROWSER_SESSION_INACTIVITY_TIMEOUT * 1000)\n             browser_env[\"AGENT_BROWSER_IDLE_TIMEOUT_MS\"] = idle_ms\n+\n+        # Inject --no-sandbox when needed (issue #15765):\n+        # - Running as root: Chromium always refuses to start without it\n+        # - Ubuntu 23.10+ / AppArmor systems: unprivileged user namespaces\n+        #   are restricted, causing Chromium to exit with \"No usable sandbox\"\n+        #   even for non-root users running under systemd or containers.\n+        if \"AGENT_BROWSER_CHROME_FLAGS\" not in browser_env:\n+            _needs_sandbox_bypass = False\n+            if hasattr(os, \"geteuid\") and os.geteuid() == 0:\n+                _needs_sandbox_bypass = True\n+                logger.debug(\"browser: running as root — injecting --no-sandbox\")\n+            else:\n+                # Detect AppArmor user namespace restrictions (Ubuntu 23.10+)\n+                _userns_restrict = \"/proc/sys/kernel/apparmor_restrict_unprivileged_userns\"\n+                try:\n+                    with open(_userns_restrict) as _f:\n+                        if _f.read().strip() == \"1\":\n+                            _needs_sandbox_bypass = True\n+                            logger.debug(\n+                                \"browser: AppArmor userns restrictions detected — \"\n+                                \"injecting --no-sandbox\"\n+                            )\n+                except OSError:\n+                    pass\n+            if _needs_sandbox_bypass:\n+                browser_env[\"AGENT_BROWSER_CHROME_FLAGS\"] = (\n+                    \"--no-sandbox --disable-dev-shm-usage\"\n+                )\n         \n         # Use temp files for stdout/stderr instead of pipes.\n         # agent-browser starts a background daemon that inherits file\n"]}]},{"kind":"pr","number":21659,"title":"Fix browser_navigate failing with 'No usable sandbox!' on Ubuntu 23.10+","url":null,"state":"closed","close_reason":{"refs":[{"kind":"commit","value":"8ed2ef6f46e9642acfba57b4b8da893a574ecfd0","number":0},{"kind":"commit","value":"4695d2716f60da89152bdc9dfa7d96e54ea7c22e","number":0}],"category":"implemented_elsewhere","implication":"superseded"},"merged":false,"is_fix_pr":true,"fix_tier":"suggested","fix_detail_withheld":true}],"trust":{"default_tier":"verified","includes_suggested":false}}