We checked our documentation and it does not cover this yet, so the Railway community is the best place to get a real answer: people who have already worked this out on their own projects and can tell you what actually worked.

So we'd like to open your thread as a community bounty. Railway pays a bounty to the community member who answers it, and threads like this usually get picked up quickly.

Opening it makes this entire thread public, including everything already posted. Nothing becomes public until you decide. Use the buttons below.

• Open to the community - Before you click, take a moment to edit or remove anything you'd rather not share. The thread becomes publicly visible right away.
• Keep it private and close the thread - Nothing becomes public and the thread closes.

I still need Railway staff help with this.

To clarify, I am not asking Railway to debug my application code.

This is a Railway runtime/platform-policy question.

We reproduced the exact Chromium sandbox failure in a temporary isolated

Railway canary in the same production region:

Region: us-east4-eqdc4a

Railpack V3 / Runtime V2

Runtime UID/GID: 65534

Chromium sandbox helper:

root:root

mode 4755

Exact error:

credentials.cc:137 — Permission denied (13)

Unprivileged namespace creation in that Railway runtime also returns

Permission denied.

The same candidate previously worked in a Railway staging deployment in

another region.

We need clarification from Railway regarding the hosted runtime:

1. Are the namespace operations required by non-root Chromium sandboxing

   supported in Railway Runtime V2?

2. Can this runtime/security policy differ between Railway regions?

3. Is there a supported Railway configuration for running Chromium with

   its sandbox enabled as a non-root user?

4. If the production region does not support the required namespace

   behavior, is moving the service to a region where it succeeds a

   supported solution?

We will not use --no-sandbox, root runtime, privileged containers, or

weakened permissions.

Please keep this thread private and have a Railway staff member review

the runtime-policy question.

The community is still the best next step here. The buttons below are still live: open the thread up as a public bounty after editing out anything sensitive, or keep it private and close it.

I'd look into Railway's Sandboxes (Linux VMs).

Also, for question 5, you could try it out by adding a replica in the region of your staging environment and see what happens.