No usable sandbox error when using --no-sandbox

I am getting a Error: Failed to launch chrome! and 1026/072748.940030:FATAL:zygote_host_impl_linux.cc(127)] No usable sandbox! when launching chromium even when I am passing no-sandbox and disable-setuid-sandbox to launching the browser.

Steps to reproduce

This is my code:

const browser = await puppeteer.launch({
    headless: true,
    args: [
      'no-sandbox',
      'disable-setuid-sandbox',
    ]
  });

Also, after reading about travis CI, I thought maybe my server should need the same, so I used:

const browser = await puppeteer.launch({
    headless: true,
    args: [
      '--no-sandbox',
      '--disable-setuid-sandbox',
    ]
  });

But it didn’t work neither.

Tell us about your environment:

• Puppeteer version: 1.5.0
• Platform / OS version: CentOS Linux release 7.4.1708 (Core)
• URLs (if applicable):
• Node.js version: 9.11.1

What is the expected result?

To run chromium without problems (and without sandbox).

What happens instead?

It throws an error.

Complete error:

Error: Failed to launch chrome!
[1026/072748.940030:FATAL:zygote_host_impl_linux.cc(127)] No usable sandbox! Update your kernel or see https://chromium.googlesource.com/chromium/src/+/master/docs/linux_suid_sandbox_development.md for more information on developing with the SUID sandbox. If you want to live dangerously and need an immediate workaround, you can try using --no-sandbox.
#0 0x560eb8cb0bac base::debug::StackTrace::StackTrace()
#1 0x560eb8c3ea30 logging::LogMessage::~LogMessage()
#2 0x560eb9f90ce0 service_manager::ZygoteHostImpl::Init()
#3 0x560eb89678ad content::ContentMainRunnerImpl::Initialize()
#4 0x560eb8970714 service_manager::Main()
#5 0x560eb8965cc4 content::ContentMain()
#6 0x560ebcc2e389 headless::(anonymous namespace)::RunContentMain()
#7 0x560ebcc2e412 headless::HeadlessBrowserMain()
#8 0x560eb896da55 headless::HeadlessShellMain()
#9 0x560eb6efb1ac ChromeMain
#10 0x7f572c2d4445 __libc_start_main
#11 0x560eb6efb02a _start

Received signal 6
#0 0x560eb8cb0bac base::debug::StackTrace::StackTrace()
#1 0x560eb8cb0711 base::debug::(anonymous namespace)::StackDumpSignalHandler()
#2 0x7f5731ff66d0 <unknown>
#3 0x7f572c2e8277 __GI_raise
#4 0x7f572c2e9968 __GI_abort
#5 0x560eb8caf565 base::debug::BreakDebugger()
#6 0x560eb8c3ee99 logging::LogMessage::~LogMessage()
#7 0x560eb9f90ce0 service_manager::ZygoteHostImpl::Init()
#8 0x560eb89678ad content::ContentMainRunnerImpl::Initialize()
#9 0x560eb8970714 service_manager::Main()
#10 0x560eb8965cc4 content::ContentMain()
#11 0x560ebcc2e389 headless::(anonymous namespace)::RunContentMain()
#12 0x560ebcc2e412 headless::HeadlessBrowserMain()
#13 0x560eb896da55 headless::HeadlessShellMain()
#14 0x560eb6efb1ac ChromeMain
#15 0x7f572c2d4445 __libc_start_main
#16 0x560eb6efb02a _start
  r8: 00007f57325f3a80  r9: 0000000000000030 r10: 0000000000000008 r11: 0000000000000206
 r12: 00007ffcb9bdd788 r13: 0000000000000161 r14: 00007ffcb9bdd790 r15: 00007ffcb9bdd798
  di: 0000000000002627  si: 0000000000002627  bp: 00007ffcb9bdd2d0  bx: 00007ffcb9bdd340
  dx: 0000000000000006  ax: 0000000000000000  cx: ffffffffffffffff  sp: 00007ffcb9bdd198
  ip: 00007f572c2e8277 efl: 0000000000000206 cgf: 0000000000000033 erf: 0000000000000000
 trp: 0000000000000000 msk: 0000000000000000 cr2: 0000000000000000
[end of stack trace]
Calling _exit(1). Core file will not be generated.


TROUBLESHOOTING: https://github.com/GoogleChrome/puppeteer/blob/master/docs/troubleshooting.md

    at onClose (/var/www/ceb-smoke-tests/smokes/node_modules/puppeteer/lib/Launcher.js:285:14)
    at Interface.helper.addEventListener (/var/www/ceb-smoke-tests/smokes/node_modules/puppeteer/lib/Launcher.js:274:50)
    at Interface.emit (events.js:185:15)
    at Interface.close (readline.js:379:8)
    at Socket.onend (readline.js:152:10)
    at Socket.emit (events.js:185:15)
    at endReadableNT (_stream_readable.js:1106:12)
    at process._tickCallback (internal/process/next_tick.js:178:19)

[MarcoSeko]

@aslushnikov Thank you for the detailed sandbox manual!

Note on running puppeteer in debian container WITH sandbox:

If you run puppeteer inside a debian-based docker container, you can enable the user namespace cloning for the Dockerfile with:

RUN echo 'kernel.unprivileged_userns_clone=1' > /etc/sysctl.d/userns.conf

However, make sure to start your container with --cap-add=SYS_ADMIN, e.g.

docker run -it --init --rm --cap-add=SYS_ADMIN --name puppeteer-chrome-debian_c puppeteer-chrome-debian_i node -e "cat screenshot.js"

otherwise you will get the same kind of error message as above:

(node:9) UnhandledPromiseRejectionWarning: Error: Failed to launch chrome!
[0822/151521.958305:FATAL:zygote_host_impl_linux.cc(116)] No usable sandbox! Update your kernel or see 
https://chromium.googlesource.com/chromium/src/+/master/docs/linux_suid_sandbox_development.md
for more information on developing with the SUID sandbox.
If you want to live dangerously and need an immediate workaround, you can try using --no-sandbox.

[aslushnikov]

For those coming here: there’s a detailed manual on setting up sendbox in our troubleshooting.md.