monadical/greywall
Archived
13
0
Fork 0
Code Issues Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

docs: add more information about nested sandboxing and integration test skip behavior

Browse Source
This commit is contained in:
JY Tan
2026-01-17 13:39:03 -08:00
parent 71c211c9ab
commit 3c3f28b32c
2 changed files with 42 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
docs/troubleshooting.md
View File

@@ -1,5 +1,19 @@
# Troubleshooting
## Nested Sandboxing Not Supported
Fence cannot run inside another sandbox that uses the same underlying technology.
**macOS (Seatbelt)**: If you try to run fence inside an existing `sandbox-exec` sandbox (e.g., Nix's Darwin build sandbox), you'll see:
```text
Sandbox: sandbox-exec(...) deny(1) forbidden-sandbox-reinit
```
This is a macOS kernel limitation - nested Seatbelt sandboxes are not allowed. There is no workaround.
**Linux (Landlock)**: Landlock supports stacking (nested restrictions), but fence's test binaries cannot use the Landlock wrapper (see [Testing docs](testing.md#sandboxed-build-environments-nix-etc)).
## "bwrap: loopback: Failed RTM_NEWADDR: Operation not permitted" (Linux)
This error occurs when fence tries to create a network namespace but the environment lacks the `CAP_NET_ADMIN` capability. This is common in: