Grafana Image Renderer fails to launch the Chromium browser process

[deny0524]

What happened: The Grafana Image Renderer fails to launch the Chromium browser process with the following error:

Error: Failed to launch the browser process!
Failed to move to new namespace: PID namespaces supported, Network namespace supported, but failed: errno = Operation not permitted
[1024/034315.556312:WARNING:process_reader_linux.cc(95)] sched_getscheduler: Function not implemented (38)
[1024/034315.556473:WARNING:process_reader_linux.cc(95)] sched_getscheduler: Function not implemented (38)
[1024/034315.556916:ERROR:file_io_posix.cc(145)] open /sys/devices/system/cpu/cpu0/cpufreq/scaling_cur_freq: No such file or directory (2)
[1024/034315.556949:ERROR:file_io_posix.cc(145)] open /sys/devices/system/cpu/cpu0/cpufreq/scaling_max_freq: No such file or directory (2)

This results in HTTP 500 errors when trying to render images.

What you expected to happen: The Grafana Image Renderer should successfully launch the browser process without encountering namespace or permission-related issues, allowing it to render images correctly without returning errors.

How to reproduce it (as minimally and precisely as possible):

1. Deploy the Grafana Image Renderer on a GKE Autopilot cluster.
2. Set the following environment variables for the Grafana Image Renderer: RENDERING_ARGS="--no-sandbox --disable-setuid-sandbox --disable-gpu --headless --disable-dev-shm-usage --window-size=1280x758"
3. Attempt to render a dashboard panel using the Grafana Image Renderer.
4. Observe the logs and see the failure to launch the browser process.

Anything else we need to know?:

• The issue appears to be related to restrictions in GKE Autopilot, which prevents elevated privileges and certain namespace operations.
• We have tried increasing shared memory using an emptyDir volume and removing privileged mode due to GKE's constraints, but the problem persists.

Environment:

• Grafana Image Renderer version: docker.io/grafana/grafana-image-renderer:latest
• Grafana version: 11.2.2+security-01
• Installed plugin or remote renderer service: Grafana Image Renderer as a Kubernetes deployment
• OS Grafana Image Renderer is installed on: Running as a container in a GKE Autopilot cluster
• User OS & Browser: N/A (issue occurs in Kubernetes environment)
• Others: GKE Autopilot restricts running privileged containers and namespace operations, which may contribute to this issue.

[igordrnobrega]

To add one more information, on our infrastructure the problem seems to be related to the package upgrade made on here: https://github.com/grafana/grafana-image-renderer/compare/v3.11.3...v3.11.4 IDK if we need to do any extra step on grafana helm to be able to enable something that is missing.