Fix browser sandbox detection in containers

[Will-thom]

Summary

• detect non-root containers where unprivileged user namespaces are blocked by probing \unshare -U /bin/true\
• preserve user-provided \AGENT_BROWSER_ARGS\ and legacy \AGENT_BROWSER_CHROME_FLAGS\
• add \libnspr4\ and \libnss3\ to the Debian image dependencies for Chromium/NSS

Fixes #28960.

Testing

• .venv\Scripts\ruff.exe check tools\browser_tool.py tests\tools\test_browser_chromium_check.py\
• \PYTHONDONTWRITEBYTECODE=1 .venv\Scripts\python.exe -m pytest -o addopts= -q -p no:timeout tests\tools\test_browser_chromium_check.py\ (18 passed)
• Docker non-root probe on
  ode:22.22.3-bookworm: \unshare -U /bin/true\ fails with \Operation not permitted, and the new logic injects --no-sandbox,--disable-dev-shm-usage\
• Docker \debian:13.4: \�pt-get install -y --no-install-recommends libnspr4 libnss3\ succeeds

Note: I did not run a full Docker image build locally to avoid unnecessary disk usage; the package install and container userns behavior were validated directly.

[alt-glitch]

Fixes #28960. Competing with open PRs #22582, #20014, #23517, #24198 — all addressing browser sandbox detection / AGENT_BROWSER_ARGS vs AGENT_BROWSER_CHROME_FLAGS issues. This PR adds unshare -U probe for non-root container detection and Dockerfile deps. Builds on merged #19747 (root + AppArmor detection). Maintainers should evaluate against the competing PRs.

[teknium1]

Thanks for chasing the container browser failure. The core premise still holds on current main: tools/browser_tool.py:2012-2044 only auto-injects --no-sandbox for root and AppArmor-restricted user namespaces, and a broad grep on origin/main found no unshare -U probe.

Problems

• The Dockerfile hunk is stale against current main. PR #29080 targets the old apt-get install ... nodejs npm ... tini line, while current main's Dockerfile now uses Debian 13, copies Node 22 from a source image, and runs npx playwright install --with-deps chromium --only-shell at Dockerfile:132-133.
• Part of the PR is already present on current main: tools/browser_tool.py:2017-2023 already preserves user-provided AGENT_BROWSER_ARGS and legacy AGENT_BROWSER_CHROME_FLAGS via commit 4695d2716f.

Suggested changes

• Salvage the unique unshare -U /bin/true probe into the current sandbox-injection path, with the added unit coverage for root, AppArmor, failed unshare, non-Linux skip, and user-provided args preservation.
• Re-check whether explicit libnspr4 libnss3 is still needed in the current Dockerfile after the existing Playwright --with-deps layer.

Automated hermes-sweeper review.

[teknium1]

This hunk targets the old Dockerfile dependency line. On current main, the image has moved to Debian 13, copies Node 22 from a source stage, and runs npx playwright install --with-deps chromium --only-shell, so this dependency addition needs to be re-evaluated against the current Dockerfile rather than applied verbatim.

[teknium1]

Thanks for the focused container reproduction and dependency investigation. This is an automated hermes-sweeper review; the requested behavior is already implemented on main and shipped in v2026.7.1.

• tools/browser_tool.py:301-314 enables the Chromium sandbox bypass for root, Docker, and AppArmor-restricted user namespaces.
• tools/browser_tool.py:2405-2416 preserves pre-set AGENT_BROWSER_ARGS and legacy AGENT_BROWSER_CHROME_FLAGS, otherwise injecting --no-sandbox,--disable-dev-shm-usage.
• tools/browser_tool.py:4568-4576 detects Docker using /.dockerenv and /proc/1/cgroup, covering the reported non-root container case without relying on an unshare probe.
• Dockerfile:138-140 builds the image with npx playwright install --with-deps chromium --only-shell.
• The later implementation is commit a10727a555ad5e5c4155b3b74d19959c36c436db, included in v2026.7.1. The linked issue Installation: missing deps #28960 was also closed as implemented on main with this evidence.