[BUG] Chromium does not start without --no-sandbox flag

[rogierlommers]

Is there an existing issue for this?

• I have searched the existing issues

Current Behavior

I'm using the docker run command below.
The container starts, but it doesn't start Chromium by default and when I manually start chromium in the embedded terminal, I get the folowing error:

The error

I can solve it by starting chromium with the --no-snadbox flag, but I don't think this is the correct solution. What am I doing wong? Any clue?

Expected Behavior

That chromium automatically starts and that the --no-sandbox flag isn't necessary.

Steps To Reproduce

Execute docker-run command.
Find out chromium doesn't' start.

Environment

- OS: Linux services 6.12.41+deb13-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.12.41-1 (2025-08-12) x86_64
- How docker service was installed: added repo, then apt installed it.

CPU architecture

x86-64

Docker creation

docker run \
  --name=chromium \
  --rm \
  --security-opt seccomp=unconfined \
  -e PUID=1000 \
  -e PGID=1000 \
  -e TZ=Europe/Amsterdam \
  -e CHROME_CLI=https://www.linuxserver.io/ \
  -e DISABLE_IPV6=true \
  -p 3000:3000 \
  -p 3001:3001 \
  -v /srv/local/chromium-container/data:/config \
  --shm-size="1gb" \
  lscr.io/linuxserver/chromium:latest

Container logs

───────────────────────────────────────
GID/UID
───────────────────────────────────────

User UID:    1000
User GID:    1000
───────────────────────────────────────
[custom-init] No custom files found, skipping...
_XSERVTransmkdir: ERROR: euid != 0,directory /tmp/.X11-unix will not be created.
screen 0 shmid 0
xsettingsd: Loaded 5 settings from /config/.xsettingsd
[ls.io-init] done.
xsettingsd: Created window 0x200001 on screen 0 with timestamp 429231399
xsettingsd: Selection _XSETTINGS_S0 is owned by 0x0
xsettingsd: Took ownership of selection _XSETTINGS_S0
17
18
INFO:data_websocket:pcmflux library found. Audio capture is available.
INFO:data_websocket:pixelflux library found. Striped encoding modes available.
INFO:root:Expected C js_config_t size (from ctypes): 1354 bytes
INFO:main:Upload directory ensured: /config/Desktop
INFO:main:Starting Selkies (WebSocket Mode) with args: Namespace(encoder='x264enc', framerate=60, video_bitrate=16000, dri_node='', audio_device_name='', h264_crf=25, h264_fullcolor=False, h264_streaming_mode=False, watermark_path='', watermark_location=-1, port=8082, debug=False)
INFO:main:Initial Encoder: x264enc, Framerate: 60, Bitrate: 16000kbps
INFO:main:SelkiesStreamingApp initialized: encoder=x264enc, display=1024x768
INFO:main:All main components initialized. Running server...
INFO:webrtc_input:System DPI detected as ~96. Cursor size cap set to 32x32px.
INFO:webrtc_input:Resetting keyboard modifiers.
INFO:webrtc_input:Starting clipboard monitor
INFO:webrtc_input:Found XFIXES version 4.0
INFO:webrtc_input:starting cursor monitor
INFO:webrtc_input:watching for cursor changes
WARNING:data_websocket:Cannot broadcast cursor data: no clients connected or server not ready.
INFO:data_websocket:Data WebSocket Server listening on port 8082
INFO:webrtc_input:Initializing 4 persistent gamepad instances...
INFO:root:Packed js_config payload for 'Microsoft X-Box 360 pad' (js0): len=1360 bytes. Name='Microsoft X-Box 360 pad', Vendor=0x045e, Product=0x028e, Version=0x0100, Reported Buttons=11 (Array capacity: 512), Reported Axes=8 (Array capacity: 64)
INFO:selkies_gamepad:Gamepad configured. JS socket: /tmp/selkies_js0.sock, EVDEV socket: /tmp/selkies_event1000.sock. Using fixed config: Microsoft X-Box 360 pad
INFO:webrtc_input:Initialized and started persistent gamepad instance for index 0 (Name: 'Microsoft X-Box 360 pad', JS: /tmp/selkies_js0.sock, EVDEV: /tmp/selkies_event1000.sock).
INFO:root:Packed js_config payload for 'Microsoft X-Box 360 pad' (js1): len=1360 bytes. Name='Microsoft X-Box 360 pad', Vendor=0x045e, Product=0x028e, Version=0x0100, Reported Buttons=11 (Array capacity: 512), Reported Axes=8 (Array capacity: 64)
INFO:selkies_gamepad:Gamepad configured. JS socket: /tmp/selkies_js1.sock, EVDEV socket: /tmp/selkies_event1001.sock. Using fixed config: Microsoft X-Box 360 pad
INFO:webrtc_input:Initialized and started persistent gamepad instance for index 1 (Name: 'Microsoft X-Box 360 pad', JS: /tmp/selkies_js1.sock, EVDEV: /tmp/selkies_event1001.sock).
INFO:root:Packed js_config payload for 'Microsoft X-Box 360 pad' (js2): len=1360 bytes. Name='Microsoft X-Box 360 pad', Vendor=0x045e, Product=0x028e, Version=0x0100, Reported Buttons=11 (Array capacity: 512), Reported Axes=8 (Array capacity: 64)
INFO:selkies_gamepad:Gamepad configured. JS socket: /tmp/selkies_js2.sock, EVDEV socket: /tmp/selkies_event1002.sock. Using fixed config: Microsoft X-Box 360 pad
INFO:webrtc_input:Initialized and started persistent gamepad instance for index 2 (Name: 'Microsoft X-Box 360 pad', JS: /tmp/selkies_js2.sock, EVDEV: /tmp/selkies_event1002.sock).
INFO:root:Packed js_config payload for 'Microsoft X-Box 360 pad' (js3): len=1360 bytes. Name='Microsoft X-Box 360 pad', Vendor=0x045e, Product=0x028e, Version=0x0100, Reported Buttons=11 (Array capacity: 512), Reported Axes=8 (Array capacity: 64)
INFO:selkies_gamepad:Gamepad configured. JS socket: /tmp/selkies_js3.sock, EVDEV socket: /tmp/selkies_event1003.sock. Using fixed config: Microsoft X-Box 360 pad
INFO:webrtc_input:Initialized and started persistent gamepad instance for index 3 (Name: 'Microsoft X-Box 360 pad', JS: /tmp/selkies_js3.sock, EVDEV: /tmp/selkies_event1003.sock).
INFO:selkies_gamepad:Gamepad /tmp/selkies_js0.sock: Event processor started.
INFO:selkies_gamepad:JS interposer server listening on /tmp/selkies_js0.sock
INFO:selkies_gamepad:Gamepad /tmp/selkies_js1.sock: Event processor started.
INFO:selkies_gamepad:JS interposer server listening on /tmp/selkies_js1.sock
INFO:selkies_gamepad:Gamepad /tmp/selkies_js2.sock: Event processor started.
INFO:selkies_gamepad:JS interposer server listening on /tmp/selkies_js2.sock
INFO:selkies_gamepad:Gamepad /tmp/selkies_js3.sock: Event processor started.
INFO:selkies_gamepad:JS interposer server listening on /tmp/selkies_js3.sock
INFO:selkies_gamepad:EVDEV interposer server listening on /tmp/selkies_event1000.sock
INFO:selkies_gamepad:EVDEV interposer server listening on /tmp/selkies_event1001.sock
INFO:selkies_gamepad:EVDEV interposer server listening on /tmp/selkies_event1002.sock
INFO:selkies_gamepad:EVDEV interposer server listening on /tmp/selkies_event1003.sock

[github-actions]

Thanks for opening your first issue here! Be sure to follow the relevant issue templates, or risk having this issue marked as invalid.

[Roxedus]

wrapped-chromium is the command you need to use if you want to launch it outside of right clicking the background.

[rogierlommers]

wrapped-chromium is the command you need to use if you want to launch it outside of right clicking the background.

If I try to run it using right-clicking, then nothing happens... that's why I started debugging by running from the console. Sorry, I should have mentionned that in my initial issue.

By the way, here is the output of the wrapped-chromium script:

[thelamer]

The detection we run looks if the container is running seccomp unconfined which you are and then does not pass no sandbox.

So to "fix" your issue stop passing seccomp unconfined.

The underlying issue is that even your host does not seem to support user namespacing, which leads me to believe this is not just a Debian host there is more to this story.

[rogierlommers]

The detection we run looks if the container is running seccomp unconfined which you are and then does not pass no sandbox.

So to "fix" your issue stop passing seccomp unconfined.

The underlying issue is that even your host does not seem to support user namespacing, which leads me to believe this is not just a Debian host there is more to this story.

Thanks; this indeed fixed it. I can assure you that it's really only debian. Anyhow, my next problem is that the container doesn't store state. So for example, when I open a page in the chromium instance in the container and I then stop the container, then restarting the container gives me a "clean" chromium. I would have expected that my browsing/chromium state would be saved in the volume.

[thelamer]

There is no "on to the next issue" this is GitHub not a support forum. Think about your question you will come to a reasonable conclusion.