an hour ago
Hi,
We are running a Playwright/Chromium document-processing worker on a standard Railway service.
The Docker image builds successfully, and the service runs normally. However, Chromium fails when attempting to initialize its sandbox:
Permission denied (13)
sandbox/linux/services/credentials.cc:137We investigated directly inside the Railway container and obtained the following results:
| Test | Result |
|---|---|
| unshare --user true as UID 1000 | EACCES – Permission denied |
| Same command as root | EACCES – Permission denied |
| unshare true without namespace flags | PASS |
| kernel.unprivileged_userns_clone | 1 |
| user.max_user_namespaces | 2014631 |
| Seccomp | Filtering active, 3 filters |
| AppArmor | containers-default-0.67.0 (enforce) |
| Chromium setuid helper | Present, root-owned, permissions 4755 |
| Worker process | UID 1000, NoNewPrivs=0 |
This suggests that Linux user namespace creation is restricted by the container's security policy, despite being enabled at the kernel level.
We have not established whether the restriction comes from seccomp, AppArmor, or another host-level policy.
Questions:
- Does Railway support Chromium's Linux namespace sandbox on standard services?
- Is there a supported configuration that permits the required namespace operations without disabling Chromium's sandbox?
- If not, is there a recommended secure approach for running Playwright/Chromium workloads on Railway?
We do not want to use --no-sandbox, privileged containers, or weaken TLS/security protections.
The worker is currently running with document collection disabled.
Any guidance from the Railway team or developers who have encountered this issue would be appreciated.
Thank you!
1 Replies
an hour ago
Standard services don't let you configure container security contexts, capability sets, or seccomp/AppArmor profiles, on any plan. So there's no supported setting that allows the user namespace creation Chromium's namespace sandbox needs. The EACCES you get from unshare --user, even as root, comes from that container policy and not from your image.
That means we can't offer a configuration on standard services that runs Chromium's Linux namespace sandbox without turning the sandbox off, and we don't have a separately documented hardened setup for Playwright/Chromium workloads to recommend in its place.
Status changed to Awaiting User Response Railway • about 1 hour ago