windmill-labs/windmill · error

ENABLE_UNSHARE_PID is set but failed to test unshare: {}

Error message

ENABLE_UNSHARE_PID is set but failed to test unshare: {}

What it means

Sibling of the 'unshare binary not found' panic: when ENABLE_UNSHARE_PID is on and the probe command fails to spawn for any reason OTHER than NotFound (e.g. PermissionDenied, or an I/O error spawning the process), the worker panics with the raw std::io error embedded in the message.

Source

Thrown at backend/windmill-worker/src/worker.rs:513

                    Unshare isolation will NOT be available. \
                    If job_isolation is set to 'unshare' in Instance Settings, jobs will run without isolation. \
                    Common causes: user namespaces disabled (sysctl kernel.unprivileged_userns_clone=0), \
                    max_user_namespaces=0, or missing privileges (--mount-proc requires privileged mode).",
                    output.status,
                    stderr.trim(),
                    flags
                );
                None
            },
            Err(e) => {
                if *ENABLE_UNSHARE_PID {
                    if e.kind() == std::io::ErrorKind::NotFound {
                        panic!(
                            "ENABLE_UNSHARE_PID is set but unshare binary not found.\n\
                            Install util-linux package or set ENABLE_UNSHARE_PID=false"
                        );
                    } else {
                        panic!(
                            "ENABLE_UNSHARE_PID is set but failed to test unshare: {}",
                            e
                        );
                    }
                }

                if e.kind() == std::io::ErrorKind::NotFound {
                    tracing::error!(
                        "unshare binary not found in PATH. Unshare isolation will NOT be available. \
                        Install the util-linux package to enable unshare isolation."
                    );
                } else {
                    tracing::error!(
                        "Failed to execute unshare test command: {}. Unshare isolation will NOT be available.",
                        e
                    );
                }
                None

View on GitHub (pinned to e474e8803c)

Solutions

1. Read the embedded io error to identify the cause (PermissionDenied vs EAGAIN vs other)
2. Set ENABLE_UNSHARE_PID=false if isolation via unshare cannot be supported in your environment
3. Fix exec permissions / remount without noexec if the binary is on a noexec volume
4. Review seccomp/AppArmor/SELinux profiles that block execve of unshare; add an allow rule
5. Check cgroup pids limit (`cat /sys/fs/cgroup/pids/pids.max`) if the error indicates fork failure

Example fix

// before: security profile blocks unshare
// after: drop the requirement
ENABLE_UNSHARE_PID=false
// or grant capability/allow-list unshare in your seccomp profile

// Verify the binary is present AND executable before enabling the feature
RUN test -x "$(command -v unshare)" || { echo 'unshare not executable'; exit 1; }

When it happens

Trigger: ENABLE_UNSHARE_PID=true while spawning the `unshare` test command fails with a non-NotFound io error: no exec permission on the binary, seccomp/AppArmor blocking process spawn, resource limits (EAGAIN from fork), or a broken PATH/environment.

Common situations: Security profiles (seccomp, AppArmor, SELinux) denying execve in hardened clusters; container PIDs cgroup limit exhausted so fork fails; unshare binary mounted without exec bit (noexec volume).

Related errors

• ENABLE_UNSHARE_PID is set but unshare test failed. Error: {}
• ENABLE_UNSHARE_PID is set but unshare binary not found. Inst
• could not create dir '{directory_path}': {e}
• failed to execute replace_ephemeral command: {}
• sql job on http connection

AI-assisted analysis of windmill-labs/windmill@e474e8803c (2026-09-03). Data as JSON: /api/errors/1285ab142d235561. Report an issue: GitHub.