Fix Playwright ERR_BLOCKED_BY_CLIENT in Docker by adding sandbox bypass flags

[Copilot]

Playwright MCP server was failing navigation with ERR_BLOCKED_BY_CLIENT despite container launching successfully. Chromium's sandbox requirements aren't met in Docker containers without explicit bypass flags.

Changes

Added Docker-specific Chromium launch flags to PLAYWRIGHT_LAUNCH_OPTIONS:

• --no-sandbox - bypass Linux sandbox restrictions
• --disable-setuid-sandbox - additional sandbox bypass
• --disable-gpu - disable GPU acceleration (unavailable in headless containers)

Enhanced security warning to explicitly note these flags disable critical browser protections and should only be used in controlled CI environments.

PLAYWRIGHT_LAUNCH_OPTIONS: '{"args": ["--no-sandbox", "--disable-setuid-sandbox", "--disable-gpu", "--disable-blink-features=AutomationControlled", "--disable-web-security", "--disable-features=IsolateOrigins,site-per-process"]}'

Standard pattern for Playwright in Docker per official docs.

Original prompt

---

This section details on the original issue you should resolve

<issue_title>[mcp-stress-test] Playwright MCP server browser navigation blocked by security policy</issue_title>
<issue_description>## MCP Server Stress Test - Non-Authentication Failure

The nightly stress test detected 1 server with a non-authentication failure.

Test Summary

• Test Session: stress-test-20260205-030515
• Test Date: 2026-02-05T03:05:15Z
• Total Non-Auth Failures: 1

---

Failed Server

1. playwright - Browser Navigation Error

Container: mcr.microsoft.com/playwright:v1.49.1-noble

Issue Type: Security Policy / Browser Configuration

Status: ⚠️ Partial Success (browser launches but navigation blocked)

Error:

Error: page.goto: net::ERR_BLOCKED_BY_CLIENT at (example.com/redacted)
Call log:
  - navigating to "(example.com/redacted), waiting until "domcontentloaded"

Analysis:
The Playwright MCP server and browser launch successfully, indicating the container and MCP protocol communication are working correctly. However, navigation attempts are blocked by a client-side security policy (ERR_BLOCKED_BY_CLIENT). This error typically occurs when:

• An ad blocker or security extension is active in the browser profile
• Content Security Policy (CSP) blocks the navigation
• Browser launch args include restrictive security settings

The MCP server itself is functional; this is a browser configuration issue.

Suggested Investigation:

• Review browser launch options in the Playwright server configuration
• Disable browser extensions or security add-ons
• Use headless mode without UI extensions
• Check for CSP headers or security policies in the browser profile
• Verify browser args don't include overly restrictive security flags
• Test with different URLs to isolate the issue

---

Test Configuration

The test used the following setup:

• MCP Gateway: Pre-configured via workflow infrastructure
• Test Method: Sequential server testing with simple tool invocations
• Playwright Browser: Containerized Playwright v1.49.1

Gateway Performance

✅ No gateway-level issues detected:

• MCP protocol communication working correctly
• Container launched successfully
• Error responses properly formatted
• No crashes or timeouts

Next Steps

1. Investigate browser launch configuration
2. Apply fixes to browser settings
3. Re-run stress test to verify

---

Generated by Nightly MCP Stress Test
Test Session: stress-test-20260205-030515

Full Test Results: See workflow run artifacts at /tmp/mcp-stress-results/test_report.md

AI generated by Nightly MCP Server Stress Test

<agent_instructions>Only update the .md file, not the .lock.yml file. </agent_instructions>

Comments on the Issue (you are @copilot in this section)

Custom agent used: agentic-workflows
GitHub Agentic Workflows (gh-aw) - Create, debug, and upgrade AI-powered workflows with intelligent prompt routing

• Fixes [mcp-stress-test] Playwright MCP server browser navigation blocked by security policy #689

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[Copilot]

Pull request overview

This PR fixes the Playwright MCP server's browser navigation failure in Docker environments by adding required Chromium sandbox bypass flags and enhanced security documentation.

Changes:

• Added Docker-specific Chromium launch flags (--no-sandbox, --disable-setuid-sandbox, --disable-gpu) to PLAYWRIGHT_LAUNCH_OPTIONS
• Enhanced security warning with explicit multi-line documentation about disabled security features
• Added reference to official Playwright Docker documentation

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.