OpenClaw Browser supports three modes: openclaw-managed (standalone instance), remote (remote CDP), existing-session (takes over the user's Chrome); grant the agent tool permissions via alsoAllow: [browser]

Inside a container you need headless:true + noSandbox:true + extraArgs to disable the setuid/namespace sandbox — all three are required. A SIGUSR1 hot restart doesn't fully take effect for the headless field; you need a full container restart