8.36.0: Chromium 151.0.7922.137 preloads the WebUI omnibox popup at browser start (+~75 MB per browser, headless too) #1656

Summary

Gotenberg 8.36.0 ships Chromium 151.0.7922.137-1~deb13u1. In that Chromium point release, two features flipped to enabled-by-default (chrome/browser/ui/omnibox/omnibox_next_features.cc):

OmniboxPopupAimPresenter constructs its WebUI contents unconditionally and registers them with WebUIContentsPreloadManager, so every browser start now pre-renders Chrome's address-bar popup — headless included — in a persistent renderer process holding ~70–76 MB of private (anonymous) memory that never goes away.

Reproduction

docker run -d --rm --name gt --memory=512m --memory-swap=512m -p 3000:3000 gotenberg/gotenberg:8.36.0 \
  gotenberg --chromium-auto-start=true
# wait for /health, then, inside the container's net/mount namespace:
cat <user-data-dir>/DevToolsActivePort        # port from the browser's --user-data-dir
curl -s http://127.0.0.1:<port>/json/list

8.36.0, no conversion performed:

page        about:blank
browser_ui  chrome://omnibox-popup.top-chrome/
browser_ui  chrome://omnibox-popup.top-chrome/omnibox_popup_aim.html

plus a --type=renderer process at ~75 MB anonymous RSS (/proc/<pid>/smaps_rollup). 8.35.0 lists only about:blank. Gotenberg's Chromium command line is identical between the two versions (only the pinning-proxy port differs); the Debian wrapper and /etc/chromium.d/* are byte-identical.

Impact

Measured on the same host, same 512 MB cgroup, 71 HTML→PDF conversions of a 30 KB document at 8 concurrent requests:

The resting footprint of the browser rises by ~75 MB for a UI a PDF service can never show.

Suggested fix

Add WebUIOmniboxPopup,WebUIOmniboxAimPopup to the --disable-features list Gotenberg passes to Chromium (currently site-per-process,Translate,BlinkGenPropertyTrees). Verified on 8.36.0: targets back to about:blank only, renderer gone, private memory 136–143 MB.

Note for anyone working around it meanwhile: Chromium keeps only the last --disable-features switch on the command line, and the Debian wrapper places $CHROMIUM_FLAGS before Gotenberg's arguments, so the override cannot be applied via /etc/chromium.d or CHROMIUM_FLAGS without also reordering the wrapper's exec line.