What causes "sandbox: build Docker client: %w" in Tencent/WeKnora?

Verify the Docker daemon is running and reachable (docker info works with the same user/env).

sandbox: build Docker client: %w

Error message

sandbox: build Docker client: %w

What it means

NewManagerFromType, for the docker backend, applies runtime defaults and builds the client via NewDockerRemoteClient(config); failure is wrapped as "sandbox: build Docker client: %w". Construction usually fails when the Docker daemon is unreachable or the configured image/runtime is invalid.

Source

Thrown at internal/sandbox/manager.go:262

	if dockerImage != "" {
		config.DockerImage = dockerImage
	}

	var client RemoteSandboxClient
	var err error
	switch sType {
	case SandboxTypeCube:
		if client, err = NewCubeRemoteClient(config); err != nil {
			return nil, fmt.Errorf("sandbox: build Cube client: %w", err)
		}
	case SandboxTypeE2B:
		if client, err = NewE2BRemoteClient(config); err != nil {
			return nil, fmt.Errorf("sandbox: build E2B client: %w", err)
		}
	case SandboxTypeDocker:
		applyDockerRuntimeDefaults(config)
		if client, err = NewDockerRemoteClient(config); err != nil {
			return nil, fmt.Errorf("sandbox: build Docker client: %w", err)
		}
	}
	if client == nil {
		return NewManager(config)
	}
	return NewSessionBoundManager(SessionBoundManagerConfig{
		Config:  config,
		Client:  client,
		Store:   NewMemorySessionSandboxBindingStore(),
		Checker: PermissiveSessionExistenceChecker{},
	})
}

// NewDisabledManager creates a manager that rejects all execution requests
func NewDisabledManager() Manager {
	return &DefaultManager{
		config:    DefaultConfig(),
		sandbox:   &disabledSandbox{},

View on GitHub (pinned to 988cbb0330)

Solutions

Verify the Docker daemon is running and reachable (docker info works with the same user/env).
Fix DOCKER_HOST / mount /var/run/docker.sock into containers that need it.
Unwrap the error for the exact client failure (socket permission vs connection refused) and address it.
Validate/override config.DockerImage to an image available to the daemon.

Example fix

// before
mgr, err := NewManagerFromType("docker", "myorg/missing-image") // daemon unreachable
// after
// ensure daemon: systemctl start docker; export DOCKER_HOST=unix:///var/run/docker.sock
mgr, err := NewManagerFromType("docker", "python:3.11-slim")

Defensive patterns

Strategy: validation

Validate before calling

cmd := exec.Command("docker", "info")
if err := cmd.Run(); err != nil {
    return fmt.Errorf("docker daemon unreachable: %w", err)
}

Try / catch

mgr, err := NewManagerFromType("docker", image)
if err != nil {
    return fmt.Errorf("docker client build failed: %w", err)
}

Prevention

Run docker info as a readiness probe before enabling the docker backend
Mount /var/run/docker.sock or set DOCKER_HOST correctly in containers
Ensure the configured DockerImage exists/pullable from the daemon
Check socket group permissions for the running user

When it happens

Trigger: Calling NewManagerFromType("docker", ...) when NewDockerRemoteClient fails — Docker socket not available/unauthorized, DOCKER_HOST misconfigured, or invalid DockerImage/runtime defaults in config.

Common situations: Running inside a container without /var/run/docker.sock mounted; Docker Desktop not running locally; missing group permissions on the docker socket; pointing DOCKER_HOST at a remote daemon that is down; specifying an image that the daemon cannot resolve at build time.

Related errors

AI-assisted analysis of Tencent/WeKnora@988cbb0330 (2026-09-02). Data as JSON: /api/errors/59b4808f26744277. Report an issue: GitHub.