abhigyanpatwari/GitNexus · error · SandboxError

Bubblewrap namespace preflight failed: {result.detail or res

Error message

Bubblewrap namespace preflight failed: {result.detail or result.stderr_tail[-1000:]}

What it means

Raised by preflight_bubblewrap after the bwrap namespace self-test (/usr/bin/true inside a user/pid/ipc/uts-unsharing bwrap) fails. run_managed runs the probe with a 10s timeout and require_pid_namespace=True; if result.ok is false the sandbox treats containment as unavailable and surfaces result.detail or the last 1000 chars of stderr.

Source

Thrown at eval/workflow_bench/proposer_sandbox.py:498

    command = [
        str(bwrap),
        "--unshare-user",
        "--unshare-pid",
        "--unshare-ipc",
        "--unshare-uts",
        "--die-with-parent",
        "--new-session",
        *_runtime_mount_args(),
        "--proc",
        "/proc",
        "--dev",
        "/dev",
        "--",
        "/usr/bin/true",
    ]
    result = run_managed(command, timeout=10, require_pid_namespace=True)
    if not result.ok:
        raise SandboxError(f"Bubblewrap namespace preflight failed: {result.detail or result.stderr_tail[-1000:]}")
    return bwrap


def pid_namespace_command(
    command: Sequence[str],
    *,
    bwrap_bin: Path,
) -> list[str]:
    """Wrap a trusted host command in an owned PID namespace.

    This boundary deliberately preserves the host filesystem and network; its
    sole purpose is making every descendant visible to the outer driver even
    when a nested command creates a new session or process group.
    """

    if not command:
        raise ValueError("PID-namespace command must not be empty")
    return [

View on GitHub (pinned to d540b00184)

Solutions

1. Enable unprivileged user namespaces if your distro allows it: 'sudo sysctl -w kernel.unprivileged_userns_clone=1' (Debian/Ubuntu) and ensure bwrap is setuid if userns is unavailable.
2. Run the driver in a context that permits the needed namespaces: a privileged container, a VM, or bare-metal Linux.
3. Re-run the failing bwrap command manually (the one in preflight_bubblewrap) to read the full stderr and address the specific denial.
4. Update bubblewrap and glibc to versions known to work together; verify /proc is mounted and the kernel is recent enough.

Example fix

// before
# inside a default Docker container -> preflight fails
bwrap = preflight_bubblewrap()
// after
# run the container with namespace caps, e.g.:
# docker run --privileged --cap-add=SYS_ADMIN --security-opt apparmor=unconfined ...
bwrap = preflight_bubblewrap()

import subprocess, shutil

def bwrap_works() -> bool:
    bwrap = shutil.which('bwrap')
    if not bwrap:
        return False
    cmd = [bwrap,'--unshare-user','--unshare-pid','--unshare-ipc','--unshare-uts',
           '--die-with-parent','--new-session','--proc','/proc','--dev','/dev','--','/usr/bin/true']
    return subprocess.run(cmd, timeout=15, capture_output=True).returncode == 0

if not bwrap_works():
    raise EnvironmentError('bwrap namespace preflight failed; enable unprivileged userns / use a privileged container')

null

try:
    bwrap = preflight_bubblewrap()
except SandboxError as exc:
    if 'preflight failed' in str(exc):
        raise SystemExit(f'bwrap unavailable on this host: {exc}')
    raise

When it happens

Trigger: bwrap is installed and executable but cannot establish the required namespaces: unprivileged user namespaces disabled (kernel.unprivileged_userns_clone=0), seccomp/AppArmor/SELinux blocking clone, a parent already in a restricted container (Docker without --privileged, systemd-nspawn), or the preflight timed out (>10s).

Common situations: Default Docker container without --security-opt or CAP_SYS_ADMIN; unprivileged userns disabled on Debian/older RHEL; AppArmor profile denies bwrap; running inside another bwrap/podman; glibc/bubblewrap version mismatch; /proc not properly mounted; CI runner hardened to disable unprivileged userns; corporate hardened laptop image; a podman/k8s pod that blocks clone3.

Related errors

• Bubblewrap containment is supported only on Linux/WSL2, not
• {label} must be a real non-symlink directory: {path}
• {label} contains an unsafe path component: {relative}
• {label} must be a regular non-symlink file: {path}
• {label} changed while opening: {path}

AI-assisted analysis of abhigyanpatwari/GitNexus@d540b00184 (2026-08-12). Data as JSON: /api/errors/77848d2b9398f046. Report an issue: GitHub.