semaphoreui/semaphore · error

failed to set no_new_privs

Error message

failed to set no_new_privs: %w

What it means

Panics from ConfigInit in util/config.go when the process-wide NO_NEW_PRIVS prctl flag is enabled in the config (Config.Process.NoNewPrivs) but the SetNoNewPrivs syscall fails at startup. It is a hard startup failure: the security hardening option was explicitly requested, so the process refuses to continue without it. Typical causes are a seccomp filter or container runtime blocking the prctl syscall, or an unsupported kernel/platform.

Solutions

1. Check the wrapped syscall error — EPERM/EINVAL from prctl(PR_SET_NO_NEW_PRIVS) usually means the container/seccomp profile blocks it
2. Run the container with a seccomp profile that allows prctl (or the default Docker profile, which does)
3. Disable no_new_privs in the Semaphore config if the deployment environment legitimately cannot set it
4. Do not enable this option under gVisor/legacy runtimes that do not implement PR_SET_NO_NEW_PRIVS

When it happens

Trigger: Thrown at util/config.go:912 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of semaphoreui/semaphore@1774ccb71a (2026-09-07). Data as JSON: /api/errors/396a6e1114b15f31. Report an issue: GitHub.

Appendix: source

Thrown at util/config.go:912

	Config.Apps = map[string]App{}

	if !noConfigFile {
		usedConfigPath = loadConfigFile(configPath)
	}

	loadConfigEnvironment()
	loadConfigDefaults()

	// Resolve encryption keyrings (read key files, apply precedence, build the
	// runtime keyrings) before validation consumes the keys.
	resolveEncryptionKeys()

	//fmt.Println("Validating config")
	validateConfig()

	if Config.Process.NoNewPrivs {
		if err := SetNoNewPrivs(); err != nil {
			panic(fmt.Errorf("failed to set no_new_privs: %w", err))
		}
	}

	var encryption []byte

	hash, _ := base64.StdEncoding.DecodeString(Config.CookieHash)
	if len(Config.CookieEncryption) > 0 {
		encryption, _ = base64.StdEncoding.DecodeString(Config.CookieEncryption)
	}

	Cookie = securecookie.New(hash, encryption)

	if Config.WebHost != "" {
		var err error
		WebHostURL, err = url.Parse(Config.WebHost)
		if err != nil {
			panic(err)
		}

View on GitHub (pinned to 1774ccb71a)