Judging by a quick sample of recent commits to master, it looks like this "Cannot start ChromeHeadless" issue is occurring on about 1/3rd of the pipelines. I think we're going to need to revert !12036 (merged) and do some further research.
ok... after dozens of failed pipelines where I tried to enable debug output in Chrome I finally came across the following bugfixes relating to Karma's handling of stderr:
These two fixes landed in recent versions of karma, so upgrading to v1.7.0 solved the issue.
We can now see the real error message that was previously being silently discarded (build log):
Failed to move to new namespace: PID namespaces supported, Network namespace supported, but failed: errno = Operation not permitted
It seems this error is due to Chrome's sandbox feature. Some missing kernel privileges when running in a docker container appear to be at fault, and recommendations online suggested using docker run --cap-add=CAP_SYS_ADMIN. Since that isn't an option, I'm going to use --no-sandbox.
I still do not know why this failure was transient...