{"record":{"id":"6087037d1778c377","repo":"ory/hydra","slug":"failed-to-apply-empty-landlock-sandbox","errorCode":null,"errorMessage":"failed to apply empty landlock sandbox","messagePattern":"failed to apply empty landlock sandbox","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"oryx/jsonnetsecure/cmd.go","lineNumber":42,"sourceCode":"\t// NOTE: Ideally we'd like to limit RSS but that is not possible on Linux with `ulimit/setrlimit(2)` - only with cgroups.\n\tvirtualMemoryLimitBytes = 2 * GiB\n)\n\nfunc NewJsonnetCmd() *cobra.Command {\n\tvar null bool\n\tcmd := &cobra.Command{\n\t\tUse:    \"jsonnet\",\n\t\tShort:  \"Run Jsonnet as a CLI command\",\n\t\tHidden: true,\n\t\tRunE: func(cmd *cobra.Command, args []string) error {\n\t\t\t// Lock the worker down to its already-open stdio: the\n\t\t\t// only I/O it does is read snippets/parameters from stdin\n\t\t\t// and write JSON to stdout/stderr. Denying all path-based\n\t\t\t// filesystem access prevents a malicious snippet from\n\t\t\t// touching the operator's file system even if the\n\t\t\t// jsonnet VM ever exposed a path-import primitive.\n\t\t\tif err := landlockx.ApplyEmpty(nil); err != nil {\n\t\t\t\treturn errors.Wrap(err, \"failed to apply empty landlock sandbox\")\n\t\t\t}\n\n\t\t\t// This could fail because current limits are lower than what we tried to set,\n\t\t\t// so we still continue in this case.\n\t\t\tSetVirtualMemoryLimit(virtualMemoryLimitBytes)\n\n\t\t\tif null {\n\t\t\t\treturn scan(cmd.OutOrStdout(), cmd.InOrStdin())\n\t\t\t}\n\n\t\t\tinput, err := io.ReadAll(cmd.InOrStdin())\n\t\t\tif err != nil {\n\t\t\t\treturn errors.Wrap(err, \"failed to read from stdin\")\n\t\t\t}\n\n\t\t\tjson, err := eval(input)\n\t\t\tif err != nil {\n\t\t\t\treturn errors.Wrap(err, \"failed to evaluate jsonnet\")","sourceCodeStart":24,"sourceCodeEnd":60,"githubUrl":"https://github.com/ory/hydra/blob/4174065ffb052799890f7480f5360a877a67ffc1/oryx/jsonnetsecure/cmd.go#L24-L60","documentation":"Returned by the jsonnet CLI's RunE when landlockx.ApplyEmpty fails, i.e. the Linux Landlock sandbox denying all filesystem paths could not be installed. Common on kernels without Landlock support or with unprivileged Landlock disabled, so the sandboxed evaluation cannot safely start.","triggerScenarios":"Thrown at oryx/jsonnetsecure/cmd.go:42 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Run on a kernel with Landlock support (Linux 5.13+, ideally newer) and unprivileged Landlock enabled","Check the wrapped error for the exact syscall/privilege failure","Avoid running the jsonnet worker on unsupported hosts, or provision a container/VM sandbox instead"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4174065ffb052799890f7480f5360a877a67ffc1","analyzedAt":"2026-09-03T14:52:41.581Z","contentChangedAt":"2026-09-03T14:52:41.581Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}