{"record":{"id":"69c7dc24bf797cbe","repo":"xai-org/grok-build","slug":"runtime-socket-deny-resolution-failed-error","errorCode":null,"errorMessage":"runtime-socket deny resolution failed: {error}","messagePattern":"runtime-socket deny resolution failed: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/codegen/xai-grok-sandbox/src/profiles.rs","lineNumber":357,"sourceCode":"    ) -> anyhow::Result<SandboxProfile> {\n        let (profile, _) = self.resolve_profile_with_runtime_sockets(workspace, config)?;\n        Ok(profile)\n    }\n\n    /// Resolve the profile plus provenance for automatic runtime-socket entries.\n    pub(crate) fn resolve_profile_with_runtime_sockets(\n        &self,\n        workspace: &Path,\n        config: &SandboxConfig,\n    ) -> anyhow::Result<(SandboxProfile, Vec<PathBuf>)> {\n        let mut profile = self.resolve(workspace, config)?;\n        let mut runtime_socket_denies = Vec::new();\n        if profile.restrict_network {\n            crate::runtime_sockets::append_runtime_socket_denies(\n                &mut profile.deny,\n                &mut runtime_socket_denies,\n            )\n            .map_err(|error| anyhow::anyhow!(\"runtime-socket deny resolution failed: {error}\"))?;\n        }\n        Ok((profile, runtime_socket_denies))\n    }\n\n    fn resolve(&self, workspace: &Path, config: &SandboxConfig) -> anyhow::Result<SandboxProfile> {\n        match self {\n            // Selected `off` is handled before resolve (empty CapabilitySet /\n            // early return in apply). Reaching here is almost always a custom\n            // profile with `extends = \"off\"` / `\"none\"` — return Err, never panic.\n            Self::Off => anyhow::bail!(\n                \"sandbox profile 'off' cannot be resolved as a base profile; \\\n                 choose a built-in base (workspace, devbox, read-only, strict)\"\n            ),\n\n            Self::Workspace => Ok(SandboxProfile {\n                name: \"workspace\".to_string(),\n                read_only: vec![],\n                read_write: essential_writable_paths(workspace),","sourceCodeStart":339,"sourceCodeEnd":375,"githubUrl":"https://github.com/xai-org/grok-build/blob/bc7f02eddd3d84085849dc19ed216f11c23b0571/crates/codegen/xai-grok-sandbox/src/profiles.rs#L339-L375","documentation":"`resolve_profile_with_runtime_sockets` calls `append_runtime_socket_denies` when the profile restricts network, to add denies for runtime/discovery sockets (e.g. agent/container sockets); this error wraps any failure of that resolution. Without resolving runtime socket denies, a network-restricted profile could silently leave sockets writable, so resolution failure aborts profile resolution and the sandbox plan/verify steps that depend on it.","triggerScenarios":"Profile has restrict_network = true and `runtime_sockets::append_runtime_socket_denies` fails — e.g. it cannot enumerate expected runtime sockets for the current environment, or a socket path glob/entry it produces fails validation while being appended to deny lists.","commonSituations":"Running under an unusual container runtime or supervisor where expected runtime socket paths differ; docker/containerd/socket directories absent or oddly permissioned; env like XDG_RUNTIME_DIR unset so runtime socket discovery fails.","solutions":["Read the inner `{error}` to see which socket path or discovery step failed.","Ensure the runtime environment provides expected sockets/paths (e.g. XDG_RUNTIME_DIR set, /var/run present).","If the environment legitimately has no runtime sockets, switch to a profile with restrict_network = false or a profile variant that tolerates this.","Upgrade/patch the sandbox crate if the socket list doesn't cover your runtime; file an issue with the inner error.","Verify with resolve_profile/verify_resolved_read_deny_masks in a debug run to see the partially-built deny plan."],"exampleFix":"# before\n[profiles.ci]\nextends = \"workspace\"\nrestrict_network = true   # fails in minimal container with no runtime sockets\n# after\n[profiles.ci]\nextends = \"workspace\"\nrestrict_network = false  # or provide XDG_RUNTIME_DIR before launching","handlingStrategy":"try-catch","validationCode":"fn runtime_socket_env_ok() -> Result<(), String> {\n    match std::env::var(\"XDG_RUNTIME_DIR\") {\n        Ok(d) if std::path::Path::new(&d).is_dir() => Ok(()),\n        _ => {\n            if std::path::Path::new(\"/var/run\").is_dir() { Ok(()) }\n            else { Err(\"no runtime socket directory found\".into()) }\n        }\n    }\n}\n// check before enabling restrict_network profiles","typeGuard":null,"tryCatchPattern":"match resolve_profile(profile, workspace) {\n    Ok(p) => p,\n    Err(e) if e.to_string().contains(\"runtime-socket deny resolution failed\") => {\n        eprintln!(\"Network-restricted profile needs runtime sockets: {e:#}\\nSet XDG_RUNTIME_DIR or disable restrict_network.\");\n        std::process::exit(1);\n    }\n    Err(e) => return Err(e),\n}","preventionTips":["Set XDG_RUNTIME_DIR (and ensure /var/run) in containers and CI before enabling restrict_network.","Only enable restrict_network on environments known to expose expected runtime sockets.","Fall back to a non-network-restricted profile in minimal containers.","Include the inner error text when reporting sandbox resolution failures."],"tags":["rust","sandbox","network","sockets","profile"],"backgroundTag":"runtime-socket-resolution-failed","analyzedSha":"bc7f02eddd3d84085849dc19ed216f11c23b0571","analyzedAt":"2026-08-31T04:59:42.031Z","schemaVersion":2},"datasetVersion":"2026-08-31T09:17:48.483Z"}