fix: make bwrap setuid-root to fix sandbox e2e tests#1690
Merged
Conversation
Signed-off-by: Jet Chiang <pokyuen.jetchiang-ext@solo.io>
This reverts commit 0c03da9. Signed-off-by: Jet Chiang <pokyuen.jetchiang-ext@solo.io>
Signed-off-by: Jet Chiang <pokyuen.jetchiang-ext@solo.io>
supreme-gg-gg
force-pushed
the
chore/pin-versions
branch
from
093f7c9 to
a0aec4a
Compare
supreme-gg-gg
changed the title
supreme-gg-gg
requested review from
EItanya,
ilackarms,
peterj and
yuval-k
as code owners
EItanya
approved these changes
Apr 17, 2026
Contributor
There was a problem hiding this comment.
Pull request overview
This PR adjusts the Python and Go ADK runtime container images to ensure bubblewrap (bwrap) can be used by the non-root agent user (uid 1001) on hosts that restrict unprivileged user namespaces, unblocking sandboxed execution in CI/e2e environments.
Changes:
- Set the setuid bit on
/usr/bin/bwrapin the Python runtime Dockerfile. - Set the setuid bit on
/usr/bin/bwrapin the Go ADK “full” runtime Dockerfile.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
python/Dockerfile |
Adds chmod u+s /usr/bin/bwrap after installing bubblewrap so sandboxed commands can run under the non-root user. |
go/Dockerfile.full |
Adds chmod u+s /usr/bin/bwrap in the final runtime image so Go ADK sandbox execution works under uid 1001. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
shmuelarditi
pushed a commit
to shmuelarditi/kagent
that referenced
this pull request
Apr 19, 2026
Sets the setuid bit on `/usr/bin/bwrap` in both runtime `Dockerfiles` so the non-root agent process (uid 1001) can create the user + network namespaces that bubblewrap relies on to sandbox skills and executed code. Without this, hosts with `kernel.apparmor_restrict_unprivileged_userns=1` deny bwrap's `RTM_NEWADDR` call when it brings up loopback, making every sandboxed command fail and blocking two CI e2e tests. The binary already runs inside a `privileged: true` Kubernetes pod, so the container already has full host capabilities; setuid only changes which process inside that pod holds them, and bubblewrap is a small, audited tool specifically designed to be setuid-safe. Privilege mode is dropped before running the user's command. --------- Signed-off-by: Jet Chiang <pokyuen.jetchiang-ext@solo.io>
EItanya
pushed a commit
that referenced
this pull request
Apr 23, 2026
The root cause is the same as identified in #1690 (Ubuntu AppArmor-based restrictions on unprivileged user namespaces causing `bwrap` to throw an error) but had to switch the fix to be more robust. My suspicion on why it worked before: chainguard image was shipping a version of `bwrap` that allows for `setuid` which is a valid solution suggested by the creator of bubblewrap, but it now changes to a build of `bwrap` that does not allow `setuid`, thus we're seeing `bwrap: setuid use of bubblewrap is not supported in this build` This fix is functionally the same as the previous one, but disables the specific AppArmor blocking unprivileged processes from creating new user namespaces entirely (which is totally fine in CI). This means that whatever Chainguard chooses to include in its apk repository for `bwrap` this will always work. --- If anyone is running into this in their own setup (Ubuntu 24.04), you can either use the same approach here, or alternatively install and set the official `bwrap-userns-restrict` AppArmor profile that allows `bwrap` to create namespaces. I noticed that this should be set by default in the next major release [since it's in the 25.04 release notes](https://documentation.ubuntu.com/release-notes/25.04/#apparmor-profile-for-bwrap). See discussion in [this issue](openai/codex#14919) from OpenAI Codex regarding `bwrap` sandboxing --------- Signed-off-by: Jet Chiang <pokyuen.jetchiang-ext@solo.io>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Sets the setuid bit on
/usr/bin/bwrapin both runtimeDockerfilesso the non-root agent process (uid 1001) can create the user + network namespaces that bubblewrap relies on to sandbox skills and executed code. Without this, hosts withkernel.apparmor_restrict_unprivileged_userns=1deny bwrap'sRTM_NEWADDRcall when it brings up loopback, making every sandboxed command fail and blocking two CI e2e tests.The binary already runs inside a
privileged: trueKubernetes pod, so the container already has full host capabilities; setuid only changes which process inside that pod holds them, and bubblewrap is a small, audited tool specifically designed to be setuid-safe. Privilege mode is dropped before running the user's command.