Playwright's Chromium crashes pages only when the suite runs inside a container — what does `--ipc=host` change?

## The symptom The suite is green on laptops and green on a self-hosted runner, then moves into a container and starts losing pages. Chromium tests fail with crashed-target errors, or a page simply stops responding mid-test; Firefox and WebKit in the same run are fine. It gets worse with more workers, bigger pages and longer tests — a payroll regression suite rendering wide report grids is a textbook trigger — and it looks like flake because the same test passes on a rerun. ## Why `/dev/shm` is the culprit Chromium is multi-process. The browser process, each renderer and the GPU process pass large buffers (rendered frames, bitmaps, decoded media) through **POSIX shared memory**, which on Linux is backed by the `/dev/shm` tmpfs. A normal Linux host sizes that generously. A container gets its own tiny default — historically 64 MB — because the runtime creates a private IPC namespace and a small `/dev/shm` mount for it. When Chromium asks for shared memory and the tmpfs is full, the allocation fails and the renderer process dies. From Playwright's side that surfaces as the page's target crashing, so every pending action and assertion against it fails at once. ## What `--ipc=host` changes Running the container with `--ipc=host` puts it in the **host's IPC namespace** and gives it the host's `/dev/shm` rather than the cramped per-container one. Chromium's shared-memory allocations then have the room they would have had on a normal machine, and the crashes stop. This is the configuration Playwright's own documentation recommends for running its image, which is why it appears in nearly every working example of `docker run` with this image. - It is a **runtime** flag on the container, not a Playwright option — no config change makes up for its absence. - It only matters for Chromium (and Chromium-channel projects such as Chrome and Edge); the other engines do not use `/dev/shm` this way. - It is orthogonal to the image tag: the right image with the wrong IPC setting still crashes. ## The alternatives, and what each costs | Approach | Effect | Cost | |---|---|---| | `--ipc=host` | Container shares the host IPC namespace and its `/dev/shm` | Drops an isolation boundary between container and host | | Larger `--shm-size` | Keeps the private namespace, just enlarges the tmpfs | You have to guess a number; a heavier page can still exhaust it | | Chromium's `--disable-dev-shm-usage` | Chromium writes shared memory to `/tmp` instead | Disk-backed rather than memory-backed, so slower; not the browser's normal path | For a CI runner that already boots per job, the isolation cost of `--ipc=host` is usually trivial and it is the recommended default. On a shared multi-tenant host where dropping the namespace boundary is unacceptable, a generous `--shm-size` is the honest fallback — but it is a guess, and the failure mode when the guess is wrong is exactly the flake you were trying to remove. ## Diagnosing it before guessing 1. Note that only Chromium projects fail while Firefox and WebKit pass in the same run — that asymmetry alone points at shared memory rather than at the image or the app. 2. Check whether failures cluster under load: more workers or more parallel pages making it worse is the signature of a fixed-size resource being exhausted. 3. Look at the container's `/dev/shm` size from inside the job; a 64 MB tmpfs is the tell. 4. Add `--ipc=host` and re-run the same commit before changing any test code. If the crashes vanish, you have your answer and you have not touched the suite. ## Why it is worth knowing rather than copying The flag is easy to copy from a sample command and impossible to justify later. Teams that copied it tend to strip it when they "clean up" the container invocation, or lose it when they move from a plain `docker run` to running the suite inside a job-level container, and the flake returns weeks later under a new name. Knowing that it exists to give Chromium real shared memory is what stops that regression — and it also tells you the fix does **not** belong in retries, timeouts or the test code, which is where teams usually spend the first week.