{"record":{"id":"1285ab142d235561","repo":"windmill-labs/windmill","slug":"enable-unshare-pid-is-set-but-failed-to-test-unsha","errorCode":null,"errorMessage":"ENABLE_UNSHARE_PID is set but failed to test unshare: {}","messagePattern":"ENABLE_UNSHARE_PID is set but failed to test unshare: (.+?)","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"error","filePath":"backend/windmill-worker/src/worker.rs","lineNumber":513,"sourceCode":"                    Unshare isolation will NOT be available. \\\n                    If job_isolation is set to 'unshare' in Instance Settings, jobs will run without isolation. \\\n                    Common causes: user namespaces disabled (sysctl kernel.unprivileged_userns_clone=0), \\\n                    max_user_namespaces=0, or missing privileges (--mount-proc requires privileged mode).\",\n                    output.status,\n                    stderr.trim(),\n                    flags\n                );\n                None\n            },\n            Err(e) => {\n                if *ENABLE_UNSHARE_PID {\n                    if e.kind() == std::io::ErrorKind::NotFound {\n                        panic!(\n                            \"ENABLE_UNSHARE_PID is set but unshare binary not found.\\n\\\n                            Install util-linux package or set ENABLE_UNSHARE_PID=false\"\n                        );\n                    } else {\n                        panic!(\n                            \"ENABLE_UNSHARE_PID is set but failed to test unshare: {}\",\n                            e\n                        );\n                    }\n                }\n\n                if e.kind() == std::io::ErrorKind::NotFound {\n                    tracing::error!(\n                        \"unshare binary not found in PATH. Unshare isolation will NOT be available. \\\n                        Install the util-linux package to enable unshare isolation.\"\n                    );\n                } else {\n                    tracing::error!(\n                        \"Failed to execute unshare test command: {}. Unshare isolation will NOT be available.\",\n                        e\n                    );\n                }\n                None","sourceCodeStart":495,"sourceCodeEnd":531,"githubUrl":"https://github.com/windmill-labs/windmill/blob/e474e8803ce2ff5c2df09a58dab51d45f5c922ca/backend/windmill-worker/src/worker.rs#L495-L531","documentation":"Sibling of the 'unshare binary not found' panic: when ENABLE_UNSHARE_PID is on and the probe command fails to spawn for any reason OTHER than NotFound (e.g. PermissionDenied, or an I/O error spawning the process), the worker panics with the raw std::io error embedded in the message.","triggerScenarios":"ENABLE_UNSHARE_PID=true while spawning the `unshare` test command fails with a non-NotFound io error: no exec permission on the binary, seccomp/AppArmor blocking process spawn, resource limits (EAGAIN from fork), or a broken PATH/environment.","commonSituations":"Security profiles (seccomp, AppArmor, SELinux) denying execve in hardened clusters; container PIDs cgroup limit exhausted so fork fails; unshare binary mounted without exec bit (noexec volume).","solutions":["Read the embedded io error to identify the cause (PermissionDenied vs EAGAIN vs other)","Set ENABLE_UNSHARE_PID=false if isolation via unshare cannot be supported in your environment","Fix exec permissions / remount without noexec if the binary is on a noexec volume","Review seccomp/AppArmor/SELinux profiles that block execve of unshare; add an allow rule","Check cgroup pids limit (`cat /sys/fs/cgroup/pids/pids.max`) if the error indicates fork failure"],"exampleFix":"// before: security profile blocks unshare\n// after: drop the requirement\nENABLE_UNSHARE_PID=false\n// or grant capability/allow-list unshare in your seccomp profile","handlingStrategy":"validation","validationCode":"// Verify the binary is present AND executable before enabling the feature\nRUN test -x \"$(command -v unshare)\" || { echo 'unshare not executable'; exit 1; }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Avoid mounting binaries on noexec volumes","Review seccomp/AppArmor/SELinux profiles for execve restrictions on unshare","Watch cgroup pids.max limits that make fork fail (EAGAIN)","Fall back to ENABLE_UNSHARE_PID=false in hardened environments"],"tags":["rust","worker","isolation","unshare","seccomp"],"backgroundTag":"unshare-failed","analyzedSha":"e474e8803ce2ff5c2df09a58dab51d45f5c922ca","analyzedAt":"2026-09-03T12:38:19.024Z","contentChangedAt":"2026-09-03T12:38:19.024Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}