What causes "invalid sandbox config: %w" in Tencent/WeKnora?

Start from DefaultConfig() and override only the fields you need.

invalid sandbox config: %w

Error message

invalid sandbox config: %w

What it means

NewManager builds the default sandbox manager. Before constructing it, the supplied Config is run through ValidateConfig; any validation failure is wrapped as "invalid sandbox config: %w" and manager creation fails. A nil config is tolerated (DefaultConfig is substituted), so the error always comes from field-level validation.

Source

Thrown at internal/sandbox/manager.go:27

)

// DefaultManager implements the Manager interface
// It handles sandbox selection and fallback logic
type DefaultManager struct {
	config    *Config
	sandbox   Sandbox
	validator *ScriptValidator
	mu        sync.RWMutex
}

// NewManager creates a new sandbox manager with the given configuration
func NewManager(config *Config) (Manager, error) {
	if config == nil {
		config = DefaultConfig()
	}

	if err := ValidateConfig(config); err != nil {
		return nil, fmt.Errorf("invalid sandbox config: %w", err)
	}

	manager := &DefaultManager{
		config:    config,
		validator: NewScriptValidator(),
	}

	// Initialize the appropriate sandbox
	if err := manager.initializeSandbox(context.Background()); err != nil {
		return nil, err
	}

	return manager, nil
}

// initializeSandbox creates and configures the sandbox based on configuration
func (m *DefaultManager) initializeSandbox(ctx context.Context) error {
	switch m.config.Type {

View on GitHub (pinned to 988cbb0330)

Solutions

Start from DefaultConfig() and override only the fields you need.
Call ValidateConfig yourself before NewManager to see the exact failing field.
Use NewManagerFromType(sandboxType, ...) instead of constructing Config manually.
Fix the reported field (commonly config.Type) to a supported value.

Example fix

// before
cfg := &Config{} // Type unset
mgr, err := NewManager(cfg)
// after
cfg := DefaultConfig()
cfg.Type = SandboxTypeLocal
mgr, err := NewManager(cfg)

Defensive patterns

Strategy: validation

Validate before calling

if err := ValidateConfig(cfg); err != nil {
    return fmt.Errorf("config rejected before NewManager: %w", err)
}

Try / catch

mgr, err := NewManager(cfg)
if err != nil {
    return fmt.Errorf("sandbox manager init failed: %w", err)
}

Prevention

Build configs from DefaultConfig() instead of zero-value structs
Run ValidateConfig as a startup health check
Prefer NewManagerFromType over hand-assembled Config

When it happens

Trigger: Calling NewManager with a *Config whose fields fail ValidateConfig — e.g. an empty/unknown Type, an invalid DockerImage, or other constraint violations defined by ValidateConfig.

Common situations: Hand-assembling a Config struct instead of using DefaultConfig/NewManagerFromType; loading config from YAML/JSON where the sandbox type string is missing or misspelled; downstream callers constructing NewManager for remote backends with incomplete options.

Understand the failure class

Background: Schema validation failed / invalid input schema: payload rejected because its shape doesn't match the expected schema — this error's family across 28 libraries.

Related errors

AI-assisted analysis of Tencent/WeKnora@988cbb0330 (2026-09-02). Data as JSON: /api/errors/d6c00073cb5dc224. Report an issue: GitHub.