{"record":{"id":"0025c9162da47bed","repo":"JuliusBrussee/caveman","slug":"cave-sandbox-os-network-isolation-unavailable","errorCode":"cave_sandbox_os_network_isolation_unavailable","errorMessage":"cave_sandbox_os_network_isolation_unavailable","messagePattern":"cave_sandbox_os_network_isolation_unavailable","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/agent/src/sandbox-network.ts","lineNumber":65,"sourceCode":"        ...nodeArgs,\n      ],\n    };\n  }\n  if (process.platform === \"linux\") {\n    return {\n      command: \"/usr/bin/unshare\",\n      args: [\n        \"--user\",\n        \"--map-root-user\",\n        \"--net\",\n        \"--\",\n        process.execPath,\n        \"--no-addons\",\n        ...nodeArgs,\n      ],\n    };\n  }\n  throw new Error(\"cave_sandbox_os_network_isolation_unavailable\");\n}\n","sourceCodeStart":47,"sourceCodeEnd":67,"githubUrl":"https://github.com/JuliusBrussee/caveman/blob/3ee70a102609e550bd2e68004bf5990a9341c851/packages/agent/src/sandbox-network.ts#L47-L67","documentation":"networkIsolatedNode builds an OS-level network-isolated child process (Node with --no-addons plus platform-specific sandboxing). When no supported OS sandbox mechanism is available, it throws this error because it cannot honestly promise network isolation. Raised inside networkIsolatedNode, reached via isolated().","triggerScenarios":"Requesting a network-isolated execution environment on an OS/configuration where the required sandboxing primitive (e.g. macOS sandbox-exec profiles or Linux network namespaces) is unavailable.","commonSituations":"Running on Windows or an unsupported Unix variant; container environments without CAP_SYS_ADMIN / unprivileged userns so network namespaces cannot be created; stripped-down Node builds missing needed flags.","solutions":["Run the agent on a supported OS/kernel that provides the sandbox primitive (Linux netns or macOS seatbelt)","Enable unprivileged user namespaces (sysctl kernel.unprivileged_userns_clone=1) or run with the capability needed for network namespaces","Use an alternative isolation boundary (container/VM) and skip OS-level network isolation","Upgrade Node so the execPath supports the required launch flags"],"exampleFix":"// before: assuming isolation everywhere\nconst child = await isolated(fn);\n// after: probe support first\nif (!await supportsNetworkIsolation()) {\n  console.warn('network isolation unavailable; running without it');\n  const child = await fn();\n} else {\n  const child = await isolated(fn);\n}","handlingStrategy":"fallback","validationCode":"function supportsOsNetworkIsolation(): boolean {\n  return process.platform === 'linux' || process.platform === 'darwin';\n}","typeGuard":null,"tryCatchPattern":"try {\n  child = await isolated(fn);\n} catch (e) {\n  if (e.message === 'cave_sandbox_os_network_isolation_unavailable') {\n    child = await fn(); // run without isolation, log a warning\n  } else throw e;\n}","preventionTips":["Run workloads on Linux/macOS with userns or sandbox-exec available","Pre-verify sandbox support in CI images and setup scripts","Fall back to container/VM isolation when OS primitives are missing"],"tags":["sandbox","security","platform","network"],"backgroundTag":"unsupported-platform","analyzedSha":"3ee70a102609e550bd2e68004bf5990a9341c851","analyzedAt":"2026-09-20T15:53:39.229Z","contentChangedAt":"2026-09-20T15:53:39.229Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}