{"record":{"id":"3472092328517470","repo":"windmill-labs/windmill","slug":"enable-unshare-pid-is-set-but-unshare-binary-not-f","errorCode":null,"errorMessage":"ENABLE_UNSHARE_PID is set but unshare binary not found.\nInstall util-linux package or set ENABLE_UNSHARE_PID=false","messagePattern":"ENABLE_UNSHARE_PID is set but unshare binary not found\\.\nInstall util-linux package or set ENABLE_UNSHARE_PID=false","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"error","filePath":"backend/windmill-worker/src/worker.rs","lineNumber":508,"sourceCode":"                    );\n                }\n\n                tracing::error!(\n                    \"unshare test command failed (exit code: {}). stderr: '{}'. flags: '{}'. \\\n                    Unshare isolation will NOT be available. \\\n                    If job_isolation is set to 'unshare' in Instance Settings, jobs will run without isolation. \\\n                    Common causes: user namespaces disabled (sysctl kernel.unprivileged_userns_clone=0), \\\n                    max_user_namespaces=0, or missing privileges (--mount-proc requires privileged mode).\",\n                    output.status,\n                    stderr.trim(),\n                    flags\n                );\n                None\n            },\n            Err(e) => {\n                if *ENABLE_UNSHARE_PID {\n                    if e.kind() == std::io::ErrorKind::NotFound {\n                        panic!(\n                            \"ENABLE_UNSHARE_PID is set but unshare binary not found.\\n\\\n                            Install util-linux package or set ENABLE_UNSHARE_PID=false\"\n                        );\n                    } else {\n                        panic!(\n                            \"ENABLE_UNSHARE_PID is set but failed to test unshare: {}\",\n                            e\n                        );\n                    }\n                }\n\n                if e.kind() == std::io::ErrorKind::NotFound {\n                    tracing::error!(\n                        \"unshare binary not found in PATH. Unshare isolation will NOT be available. \\\n                        Install the util-linux package to enable unshare isolation.\"\n                    );\n                } else {\n                    tracing::error!(","sourceCodeStart":490,"sourceCodeEnd":526,"githubUrl":"https://github.com/windmill-labs/windmill/blob/e474e8803ce2ff5c2df09a58dab51d45f5c922ca/backend/windmill-worker/src/worker.rs#L490-L526","documentation":"With ENABLE_UNSHARE_PID enabled, the worker probes for the `unshare` binary (from util-linux) before starting. If the probe fails with ErrorKind::NotFound — i.e. the binary is not installed in the container — the worker panics at startup, because PID-namespace isolation is impossible without it.","triggerScenarios":"ENABLE_UNSHARE_PID=true in an image that lacks the `unshare` executable: minimal/distroless base images, custom Dockerfiles built FROM slim images without util-linux.","commonSituations":"Building a custom worker image from alpine/slim/debian-slim and forgetting util-linux; switching base images during a hardening exercise; using the OSS image where util-linux is trimmed.","solutions":["Install util-linux in the image (`apt-get install -y util-linux` or the alpine equivalent `apk add util-linux util-linux-misc` for the `unshare` binary)","Set ENABLE_UNSHARE_PID=false if PID isolation is not required","Switch to the standard Windmill EE/CE image which ships unshare","Verify with `which unshare` inside the running container"],"exampleFix":"// before: Dockerfile based on slim\nFROM debian:bookworm-slim\n// after\nFROM debian:bookworm-slim\nRUN apt-get update && apt-get install -y util-linux && rm -rf /var/lib/apt/lists/*","handlingStrategy":"validation","validationCode":"// Dockerfile preflight\nRUN set -eux; \\\n    command -v unshare >/dev/null || { echo 'unshare missing: install util-linux'; exit 1; }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always install util-linux when building custom worker images","Add an image smoke test: `docker run <img> unshare --version`","Prefer the official images unless you own the dependency list","If unshare cannot be shipped, set ENABLE_UNSHARE_PID=false explicitly in config"],"tags":["rust","worker","isolation","missing-binary","docker"],"backgroundTag":"command-not-found","analyzedSha":"e474e8803ce2ff5c2df09a58dab51d45f5c922ca","analyzedAt":"2026-09-03T12:38:19.024Z","contentChangedAt":"2026-09-03T12:38:19.024Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}