Inside a container you need headless:true + noSandbox:true + extraArgs to disable the setuid/namespace sandbox — all three are required. A SIGUSR1 hot restart doesn't fully take effect for the headless field; you need a full container restart