`--cap-add=SYS_ADMIN` capability is needed to enable Chromium sandbox that makes the browser more secure. Alternatively, it should be possible to start the browser binary with the `--no-sandbox` flag.
The image is automatically built, tested, and published by the [publish.yml](https://github.com/puppeteer/puppeteer/blob/main/.github/workflows/publish.yml) workflow.