From 529a96c89c41dad96609d9d9f4a8b343a791277f Mon Sep 17 00:00:00 2001 From: Viorel Munteanu Date: Mon, 17 Aug 2026 09:07:29 +0000 Subject: [PATCH] Combine namespace probes with CLONE_NEWUSER As a regular (non-root) user, most namespace types can only be unshared together with a fresh user namespace, not in isolation -- the user namespace is what supplies the needed capabilities. Probing each type on its own under-reported support: on this dev machine only --unshare-user came back as supported, when in fact ipc/pid/net/uts/ cgroup were all usable once combined with it. Co-Authored-By: Claude Sonnet 5 --- src/bwrap.cpp | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-) diff --git a/src/bwrap.cpp b/src/bwrap.cpp index f9eeffb..56861f5 100644 --- a/src/bwrap.cpp +++ b/src/bwrap.cpp @@ -113,13 +113,29 @@ std::optional find_fuse_overlayfs_pid(const std::string& merged_path) { std::vector detect_bwrap_unshare_args() { std::vector args; + + bool user_ns_supported = kernel_supports_namespace(CLONE_NEWUSER); + spdlog::debug("namespace user: {}", user_ns_supported ? "supported" : "not supported"); + if (user_ns_supported) { + args.push_back("--unshare-user"); + } + for (const auto& probe : kNamespaceProbes) { - bool supported = kernel_supports_namespace(probe.clone_flag); + if (probe.clone_flag == CLONE_NEWUSER) { + continue; + } + // As a regular (non-root) user, most namespace types can only be unshared + // together with a fresh user namespace (which supplies the capabilities + // needed), not in isolation -- so combine them here whenever the user + // namespace probe above succeeded. + int flags = probe.clone_flag | (user_ns_supported ? CLONE_NEWUSER : 0); + bool supported = kernel_supports_namespace(flags); spdlog::debug("namespace {}: {}", probe.name, supported ? "supported" : "not supported"); if (supported) { args.push_back(probe.bwrap_arg); } } + return args; }