Repository navigation
fix(deploy): let the hub's sandboxes run under bubblewrap - #29
Merged
Merged
Conversation
The coder and designer run every command under bubblewrap, which makes a user namespace for each one. Docker's default seccomp profile refuses that without CAP_SYS_ADMIN, so inside the Compose hub every designer tool call failed with "bwrap: No permissions to create a new namespace" and the coordinator reported the workspaces as broken. Run the hub service with seccomp=unconfined and keep its capabilities dropped. Document the Ubuntu 24.04 sysctl that strips capabilities from unprivileged user namespaces, which also blocks bubblewrap on such hosts, including the VM that Colima runs.
|
Triage: Pass No changes needed from you. A maintainer will review this pull request. Notes:
Changed since the last verdict (Fail at |
brianjfox
changed the title
With only seccomp relaxed, bubblewrap gets past namespace creation and
then fails twice more inside the Compose hub: Docker's AppArmor profile
refuses the mount propagation change ("Failed to make / slave"), and the
masked /proc paths make the fresh /proc mount impossible from a user
namespace ("Can't mount proc on /proc"). The sandbox runtime's own srt
command runs only once all three are lifted, so run the hub without them;
its capabilities stay dropped.
Closes #30
…serns # Conflicts: # docs/SELF_HOST.md
corbits-triage
Bot
added
sensitive: medium
Triage: Ready
and removed
Triage: Not Ready
labels
![corbits-triage[bot]](https://avatars.githubusercontent.com/u/275831056?s=60&v=4){kind=small}
TheGreatAxios
approved these changes
Oct 31, 2026
brianjfox
changed the title
brianjfox
changed the title
This was referenced Nov 2, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #30
What changed
The hub service in
deploy/compose.ymlnow runs withseccomp=unconfined,apparmor=unconfinedandsystempaths=unconfined; its capabilities stay dropped.docs/SELF_HOST.mdgains a "Sandboxes" section covering the requirement, the Ubuntu 24.04 sysctl, and the error text seen without it.Why
With the Compose deployment, every designer tool call fails, including reading a project document:
The coder and designer run their commands under bubblewrap through
@anthropic-ai/sandbox-runtime, which gives each command its own user, pid and mount namespaces with a fresh/proc. Docker's defaults block that three ways inside the hub container, and each one surfaces only after the previous is lifted:CAP_SYS_ADMIN: "No permissions to create a new namespace"./procpaths make a fresh/procmount impossible from a user namespace: "Can't mount proc on /proc: Operation not permitted".On Ubuntu 24.04 hosts, including the VM Colima runs,
kernel.apparmor_restrict_unprivileged_userns=1additionally strips the capabilities from unprivileged user namespaces ("setting up uid map: Permission denied"). That is host configuration, so it is documented rather than changed here.How it was verified
docker compose --env-file .env.hub --project-directory . -f deploy/compose.yml configrenders the threesecurity_optentries on the hub service.bunx prettier --check deploy/compose.yml docs/SELF_HOST.mdpasses.srtcommand with the image's ripgrep. With onlyseccompandapparmorunconfined it fails at the/procmount; with all three it runs the sandboxed command, which could read/procand write under/tmp.git grepover the workflow-run repository) shows thesandbox_tool_process_failedresult on every file read and write, which is how the fault was traced.The follow-up fixes to the sandbox code itself, which surfaced once the sandbox could start, are in a separate pull request.