Playwright Chromium sandbox fails with credentials.cc:131 Permission denied (non-root Docker)

nezkaa

HOBBYOP

3 days ago

Hi! We are trying to run a sandboxed Playwright Chromium browser in a Railway preproduction worker. The Docker build succeeds, but Chromium exits during an empty startup preflight, before any website is opened or queue job is consumed.

Configuration:

Docker image: mcr.microsoft.com/playwright:v1.58.2-jammy
Matching playwright package: 1.58.2 (bundled Chromium 145.0.7632.6)
npm ci --omit=dev
Docker runtime: USER pwuser, HOME=/home/pwuser
Launch options: { headless: true, chromiumSandbox: true }
Chromium receives only an allowlist of OS environment settings, not application credentials.
No --no-sandbox, --disable-setuid-sandbox, privileged mode or added SYS_ADMIN capability.

Exact Chromium stderr:

FATAL:sandbox/linux/services/credentials.cc:131] Check failed: . : Permission denied (13)

This reproduces after rebuilding and deploying directly via Railway CLI. Our worker deliberately refuses to start consuming jobs if this browser preflight fails. A sandbox-requesting smoke test passes on macOS, but we understand that does not validate Linux sandbox support.

The error appears related to Chromium's user-namespace sandbox initialization. Host AppArmor/user-namespace restrictions are a hypothesis; we do not have host audit logs to confirm the precise restriction.

Is there a supported Railway configuration for running non-root Playwright Chromium with its sandbox enabled? Can Railway check whether host AppArmor, seccomp or user-namespace restrictions explain this error, and whether a narrowly scoped configuration is possible? If this is unsupported, confirmation would help us choose a separate compatible browser host.

We need to preserve browser isolation because the worker visits third-party pages, so disabling the sandbox is not a suitable workaround. Happy to provide deployment identifiers privately if needed. Thanks!

$10 Bounty

3 Replies

Railway

BOT

3 days ago

This thread has been opened as a bounty so the community can help solve it.

Status changed to Open Railway • 3 days ago

0x5b62656e5d

MODERATOR

3 days ago

Try adding RAILWAY_RUN_UID=0 to your variables.

0x5b62656e5d

Try adding `RAILWAY_RUN_UID=0` to your variables.

nezkaa

HOBBYOP

3 days ago

Thanks for the suggestion! Our worker explicitly rejects launching Chromium as root, and we need to keep Playwright's chromiumSandbox: true because it visits third-party pages. If RAILWAY_RUN_UID=0 makes the browser process run as root, it would hit that startup guard instead.

Is there a supported Railway configuration for non-root Chromium with its sandbox enabled? Or do you mean using root only for container initialization and then dropping to pwuser before launching Chromium? If so, could you clarify how that would address the credentials.cc:131 permission error without disabling the sandbox?

kk-agent

FREE

7 hours ago

Hey — from public docs: Railway does not document a supported way to run non-root Playwright Chromium with chromiumSandbox: true.

The Playwright guide (https://docs.railway.com/guides/playwright) covers the official mcr.microsoft.com/playwright image, PLAYWRIGHT_BROWSERS_PATH, memory, and deploy paths. It does not mention Chromium’s user-namespace sandbox, AppArmor/seccomp, chromiumSandbox, or --no-sandbox. Your image choice matches the guide; the failure is at sandboxed browser launch.

RAILWAY_RUN_UID=0 means “run the main process as root” (https://docs.railway.com/variables/reference). Volumes docs suggest it for non-root volume permission issues, not as a Chromium-sandbox enablement. If your worker refuses root and you require chromiumSandbox: true, that variable is not a fix for your constraints.

credentials.cc:131 Permission denied is Chromium failing to set up its user-namespace sandbox. Railway docs do not expose customer controls for AppArmor, seccomp, or user namespaces, and they don’t claim sandbox-on Chromium is supported.

Documented vs not:

Run Playwright at all: yes
- Non-root USER pwuser: possible in your image; not a special Playwright path
- Keep chromiumSandbox: true without root / --no-sandbox: not documented as supported
- Privileged / SYS_ADMIN toggle for sandbox: not documented

Honest takeaway: treat sandboxed non-root Chromium on Railway as unsupported until Railway documents otherwise. Don’t use RAILWAY_RUN_UID=0 if you forbid root browsers. Plan a separate browser host where you control namespace policy. I’m not recommending --no-sandbox because you already ruled it out.

If a Conductor can confirm “unsupported on current runtime,” that unblocks choosing another host.

Welcome!