2026 OpenClaw Headless Browsers (Playwright / Chromium)
on Always-On Gateways: Docker shm, Sandbox Flags & Cross-Border macOS Quotas

1. Docker shm and Chromium

Chromium uses shared memory for compositing and media. Linux containers default /dev/shm to 64MB unless you override it. Under load you see tab crashes, renderer “Aw, Snap!” equivalents, or Playwright closing the browser with opaque errors.

Fixes that actually stick

• • Raise shm: in Compose use shm_size: "1gb" (tune to concurrency × peak renderer RSS).
• • Or disable shared memory segment usage (slower): Playwright launch arg --disable-dev-shm-usage routes to disk-backed temp—acceptable for low-QPS gateways, painful for parallel sessions.
• • Never assume Desktop defaults: CI images and minimal VPS templates often omit both fixes; reproduce with the Compose block in section 4.

2. Sandbox switches: security vs operability

Chromium’s multi-layer sandbox expects Linux capabilities and namespaces that do not always exist inside hardened containers or on certain orchestrators. Teams reach for --no-sandbox because it unblocks boot; that trades kernel-enforced renderer isolation for policy elsewhere (seccomp, AppArmor, network egress allowlists).

For how gateway-level sandbox modes (Docker vs SSH vs off) change blast radius, coordinate with multi-node coordination and isolation patterns so browser runners are not the only line of defense.

3. Cross-border macOS resource quotas

Running the gateway on macOS (bare metal Mac mini or cloud Mac) while browsers live in Docker Desktop / Colima / OrbStack adds a second quota layer: VM memory and CPUs for the Linux engine, plus macOS memory pressure and launchd limits if you also spawn native helpers.

Align three budgets

• • Playwright concurrency: each Chromium is often hundreds of MB; cap PLAYWRIGHT_BROWSERS_PATH reuse and worker count.
• • Docker engine VM: raise RAM/CPU in Docker Desktop before tuning container mem_limit—otherwise the engine OOMs first.
• • Gateway Node heap: long-lived gateways need separate limits from browser cgroups; correlate with RSS in Activity Monitor during peak automation.

4. Reproducible Compose (illustrative)

Paste as a starting point; pin image digests in production and inject secrets via your platform, not plain env files.

services:
  gateway-browser-runner:
    image: mcr.microsoft.com/playwright:v1.49.0-jammy
    shm_size: "1gb"
    mem_limit: "2g"
    cpus: "2.0"
    pids_limit: 512
    environment:
      - NODE_OPTIONS=--max-old-space-size=768
    # security_opt, read_only, tmpfs, and cap_drop should follow your org baseline
    command: ["sleep", "infinity"]

Smoke test: launch one headed/headless job, then two parallel sessions; watch docker stats and macOS memory pressure. If pull RTT from another region hurts image refresh, mirror bases per our cross-border object storage acceleration matrix.

5. OOM / crash symptom matrix

6. FAQ

Is --no-sandbox ever acceptable?

Only inside a purpose-built runner container with tight cgroup, network, and secret policies—and with written sign-off. It is not a substitute for fixing namespaces.

Does Apple Silicon change Playwright?

Images must match arm64 vs amd64; browser caches differ. Pin digests per arch and warm browsers on deploy to avoid first-hit latency over WAN.

Should browsers run on the same host as the gateway process?

Co-location minimizes IPC and file sharing latency; separation (remote CDP) helps when you need GPU or Windows-only targets—at the cost of RTT-sensitive debugging.

What is the single best default for shm?

Set shm_size generously before reaching for --disable-dev-shm-usage; most “mystery” stability issues disappear.