ory/hydra · error

failed to apply empty landlock sandbox

Error message

failed to apply empty landlock sandbox

What it means

Returned by the jsonnet CLI's RunE when landlockx.ApplyEmpty fails, i.e. the Linux Landlock sandbox denying all filesystem paths could not be installed. Common on kernels without Landlock support or with unprivileged Landlock disabled, so the sandboxed evaluation cannot safely start.

Source

Thrown at oryx/jsonnetsecure/cmd.go:42

	// NOTE: Ideally we'd like to limit RSS but that is not possible on Linux with `ulimit/setrlimit(2)` - only with cgroups.
	virtualMemoryLimitBytes = 2 * GiB
)

func NewJsonnetCmd() *cobra.Command {
	var null bool
	cmd := &cobra.Command{
		Use:    "jsonnet",
		Short:  "Run Jsonnet as a CLI command",
		Hidden: true,
		RunE: func(cmd *cobra.Command, args []string) error {
			// Lock the worker down to its already-open stdio: the
			// only I/O it does is read snippets/parameters from stdin
			// and write JSON to stdout/stderr. Denying all path-based
			// filesystem access prevents a malicious snippet from
			// touching the operator's file system even if the
			// jsonnet VM ever exposed a path-import primitive.
			if err := landlockx.ApplyEmpty(nil); err != nil {
				return errors.Wrap(err, "failed to apply empty landlock sandbox")
			}

			// This could fail because current limits are lower than what we tried to set,
			// so we still continue in this case.
			SetVirtualMemoryLimit(virtualMemoryLimitBytes)

			if null {
				return scan(cmd.OutOrStdout(), cmd.InOrStdin())
			}

			input, err := io.ReadAll(cmd.InOrStdin())
			if err != nil {
				return errors.Wrap(err, "failed to read from stdin")
			}

			json, err := eval(input)
			if err != nil {
				return errors.Wrap(err, "failed to evaluate jsonnet")

View on GitHub (pinned to 4174065ffb)

Solutions

1. Run on a kernel with Landlock support (Linux 5.13+, ideally newer) and unprivileged Landlock enabled
2. Check the wrapped error for the exact syscall/privilege failure
3. Avoid running the jsonnet worker on unsupported hosts, or provision a container/VM sandbox instead

When it happens

Trigger: Thrown at oryx/jsonnetsecure/cmd.go:42 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of ory/hydra@4174065ffb (2026-09-03). Data as JSON: /api/errors/6087037d1778c377. Report an issue: GitHub.