xai-org/grok-build · error

runtime-socket deny resolution failed: {error}

Error message

runtime-socket deny resolution failed: {error}

What it means

`resolve_profile_with_runtime_sockets` calls `append_runtime_socket_denies` when the profile restricts network, to add denies for runtime/discovery sockets (e.g. agent/container sockets); this error wraps any failure of that resolution. Without resolving runtime socket denies, a network-restricted profile could silently leave sockets writable, so resolution failure aborts profile resolution and the sandbox plan/verify steps that depend on it.

Source

Thrown at crates/codegen/xai-grok-sandbox/src/profiles.rs:357

    ) -> anyhow::Result<SandboxProfile> {
        let (profile, _) = self.resolve_profile_with_runtime_sockets(workspace, config)?;
        Ok(profile)
    }

    /// Resolve the profile plus provenance for automatic runtime-socket entries.
    pub(crate) fn resolve_profile_with_runtime_sockets(
        &self,
        workspace: &Path,
        config: &SandboxConfig,
    ) -> anyhow::Result<(SandboxProfile, Vec<PathBuf>)> {
        let mut profile = self.resolve(workspace, config)?;
        let mut runtime_socket_denies = Vec::new();
        if profile.restrict_network {
            crate::runtime_sockets::append_runtime_socket_denies(
                &mut profile.deny,
                &mut runtime_socket_denies,
            )
            .map_err(|error| anyhow::anyhow!("runtime-socket deny resolution failed: {error}"))?;
        }
        Ok((profile, runtime_socket_denies))
    }

    fn resolve(&self, workspace: &Path, config: &SandboxConfig) -> anyhow::Result<SandboxProfile> {
        match self {
            // Selected `off` is handled before resolve (empty CapabilitySet /
            // early return in apply). Reaching here is almost always a custom
            // profile with `extends = "off"` / `"none"` — return Err, never panic.
            Self::Off => anyhow::bail!(
                "sandbox profile 'off' cannot be resolved as a base profile; \
                 choose a built-in base (workspace, devbox, read-only, strict)"
            ),

            Self::Workspace => Ok(SandboxProfile {
                name: "workspace".to_string(),
                read_only: vec![],
                read_write: essential_writable_paths(workspace),

View on GitHub (pinned to bc7f02eddd)

Solutions

  1. Read the inner `{error}` to see which socket path or discovery step failed.
  2. Ensure the runtime environment provides expected sockets/paths (e.g. XDG_RUNTIME_DIR set, /var/run present).
  3. If the environment legitimately has no runtime sockets, switch to a profile with restrict_network = false or a profile variant that tolerates this.
  4. Upgrade/patch the sandbox crate if the socket list doesn't cover your runtime; file an issue with the inner error.
  5. Verify with resolve_profile/verify_resolved_read_deny_masks in a debug run to see the partially-built deny plan.

Example fix

# before
[profiles.ci]
extends = "workspace"
restrict_network = true   # fails in minimal container with no runtime sockets
# after
[profiles.ci]
extends = "workspace"
restrict_network = false  # or provide XDG_RUNTIME_DIR before launching
Defensive patterns

Strategy: try-catch

Validate before calling

fn runtime_socket_env_ok() -> Result<(), String> {
    match std::env::var("XDG_RUNTIME_DIR") {
        Ok(d) if std::path::Path::new(&d).is_dir() => Ok(()),
        _ => {
            if std::path::Path::new("/var/run").is_dir() { Ok(()) }
            else { Err("no runtime socket directory found".into()) }
        }
    }
}
// check before enabling restrict_network profiles

Try / catch

match resolve_profile(profile, workspace) {
    Ok(p) => p,
    Err(e) if e.to_string().contains("runtime-socket deny resolution failed") => {
        eprintln!("Network-restricted profile needs runtime sockets: {e:#}\nSet XDG_RUNTIME_DIR or disable restrict_network.");
        std::process::exit(1);
    }
    Err(e) => return Err(e),
}

Prevention

When it happens

Trigger: Profile has restrict_network = true and `runtime_sockets::append_runtime_socket_denies` fails — e.g. it cannot enumerate expected runtime sockets for the current environment, or a socket path glob/entry it produces fails validation while being appended to deny lists.

Common situations: Running under an unusual container runtime or supervisor where expected runtime socket paths differ; docker/containerd/socket directories absent or oddly permissioned; env like XDG_RUNTIME_DIR unset so runtime socket discovery fails.

Related errors

AI-assisted analysis of xai-org/grok-build@bc7f02eddd (2026-08-31). Data as JSON: /api/errors/69c7dc24bf797cbe. Report an issue: GitHub.