fix: make bwrap setuid-root to fix sandbox e2e tests#1690
Merged
EItanya merged 3 commits intokagent-dev:mainfrom Apr 17, 2026
Merged
fix: make bwrap setuid-root to fix sandbox e2e tests#1690EItanya merged 3 commits intokagent-dev:mainfrom
EItanya merged 3 commits intokagent-dev:mainfrom
Conversation
Signed-off-by: Jet Chiang <pokyuen.jetchiang-ext@solo.io>
This reverts commit 0c03da9. Signed-off-by: Jet Chiang <pokyuen.jetchiang-ext@solo.io>
Signed-off-by: Jet Chiang <pokyuen.jetchiang-ext@solo.io>
supreme-gg-gg
force-pushed
the
chore/pin-versions
branch
from
093f7c9 to
a0aec4a
Compare
supreme-gg-gg
changed the title
supreme-gg-gg
requested review from
EItanya,
ilackarms,
peterj and
yuval-k
as code owners
EItanya
approved these changes
Apr 17, 2026
Contributor
There was a problem hiding this comment.
Pull request overview
This PR adjusts the Python and Go ADK runtime container images to ensure bubblewrap (bwrap) can be used by the non-root agent user (uid 1001) on hosts that restrict unprivileged user namespaces, unblocking sandboxed execution in CI/e2e environments.
Changes:
- Set the setuid bit on
/usr/bin/bwrapin the Python runtime Dockerfile. - Set the setuid bit on
/usr/bin/bwrapin the Go ADK “full” runtime Dockerfile.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
python/Dockerfile |
Adds chmod u+s /usr/bin/bwrap after installing bubblewrap so sandboxed commands can run under the non-root user. |
go/Dockerfile.full |
Adds chmod u+s /usr/bin/bwrap in the final runtime image so Go ADK sandbox execution works under uid 1001. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
shmuelarditi
pushed a commit
to shmuelarditi/kagent
that referenced
this pull request
Apr 19, 2026
Sets the setuid bit on `/usr/bin/bwrap` in both runtime `Dockerfiles` so the non-root agent process (uid 1001) can create the user + network namespaces that bubblewrap relies on to sandbox skills and executed code. Without this, hosts with `kernel.apparmor_restrict_unprivileged_userns=1` deny bwrap's `RTM_NEWADDR` call when it brings up loopback, making every sandboxed command fail and blocking two CI e2e tests. The binary already runs inside a `privileged: true` Kubernetes pod, so the container already has full host capabilities; setuid only changes which process inside that pod holds them, and bubblewrap is a small, audited tool specifically designed to be setuid-safe. Privilege mode is dropped before running the user's command. --------- Signed-off-by: Jet Chiang <pokyuen.jetchiang-ext@solo.io>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Sets the setuid bit on
/usr/bin/bwrapin both runtimeDockerfilesso the non-root agent process (uid 1001) can create the user + network namespaces that bubblewrap relies on to sandbox skills and executed code. Without this, hosts withkernel.apparmor_restrict_unprivileged_userns=1deny bwrap'sRTM_NEWADDRcall when it brings up loopback, making every sandboxed command fail and blocking two CI e2e tests.The binary already runs inside a
privileged: trueKubernetes pod, so the container already has full host capabilities; setuid only changes which process inside that pod holds them, and bubblewrap is a small, audited tool specifically designed to be setuid-safe. Privilege mode is dropped before running the user's command.