Repository navigation
[Linux][Ubuntu 26.04] Tool sandbox preflight fails although bubblewrap namespace test succeeds #5052
Description
Description
On Ubuntu 26.04, Copilot CLI tool calls fail during sandbox initialization with:
Bubblewrap: network.proxy requires unprivileged user and network namespaces, which this host refused (unshare --user --net exited with exit status: 1).
This happens even though a direct bubblewrap test using user and network namespaces succeeds. The failure occurs before the requested tool command runs.
Environment
- Copilot CLI: 1.0.91
- Ubuntu: 26.04
- bubblewrap: 0.11.1
kernel.apparmor_restrict_unprivileged_userns: 1kernel.unprivileged_userns_clone: 1user.max_user_namespaces: 13625user.max_net_namespaces: 13625
Diagnostics
Bubblewrap test succeeds:
bwrap --unshare-user --unshare-net \\
--ro-bind / / \\
--proc /proc --dev /dev \\
/usr/bin/true
# exit 0The /etc/apparmor.d/bwrap-userns-restrict profile is loaded, along with unpriv_bwrap.
A plain unshare test fails while writing uid_map:
unshare --user --map-root-user /usr/bin/true
# write to /proc/self/uid_map: Operation not permittedAt the time of Copilot tool-call failures, the kernel audit log showed:
apparmor="AUDIT" operation="userns_create" profile="unconfined"
comm="unshare" requested="userns_create" target="unprivileged_userns"
apparmor="DENIED" operation="capable" profile="unprivileged_userns"
comm="unshare" capability=21 capname="sys_admin"
The same userns_create transition followed by CAP_SYS_ADMIN denial appeared for both observed attempts.
Expected behavior
Copilot CLI should successfully initialize its tool sandbox on this Ubuntu/AppArmor setup, or report a precise actionable cause if the sandbox preflight relies on an unshare path that is blocked while bubblewrap itself can create the required namespaces.
Is this a known compatibility issue with Ubuntu's restricted unprivileged user namespaces, or is there a supported configuration/workaround that does not require weakening AppArmor restrictions globally?
Activity
caarlos0 commentedon Oct 15, 2026
Thanks for the detailed report.
Why it fails. For a sandbox with network access, Copilot CLI does not only call
bwrap. Its preflight also runsunshare --user --map-current-user --keep-caps --net -- sh -c :. Your audit log and your plainunshare --user --map-root-usertest show that Ubuntu's AppArmor policy denies this:bwraphas an AppArmor profile that allows user namespaces, andunsharehas none. Your directbwraptest passes for that reason. This is the same denial, so the preflight is correct to refuse.What the sandbox needs for network access on Linux:
bwrap(bubblewrap) 0.5.0 or laterslirp4netnsunshareandnsenter)iptables,ip6tables,iptables-restoreandip6tables-restore/dev/net/tunbwrap. Checkkernel.apparmor_restrict_unprivileged_userns,user.max_user_namespacesanduser.max_net_namespaces.A workaround that does not weaken AppArmor globally. Give
unshareits own profile that allows user namespaces, in/etc/apparmor.d/unshare:Then run
sudo apparmor_parser -r /etc/apparmor.d/unshare. This allows user namespaces forunshareonly, and the sysctl stays at1. I have not tested this on Ubuntu 26.04, so please tell us if it works.Better error. The error you saw names only the first problem. A future version will list all of the requirements above in the error, so you can see everything at once.