From 7a333788c1059e0925f369d430aaff482558c389 Mon Sep 17 00:00:00 2001 From: Viorel Munteanu Date: Sat, 22 Aug 2026 09:49:31 +0000 Subject: [PATCH] Remove --as-pid-1 from the bwrap invocation bwrap now runs its own small reaper as pid 1 inside the sandbox instead of execing the target command directly into that role. -e/--exec is unaffected: it resolves the real namespace-holding child dynamically via /proc rather than assuming any particular process identity, so it still joins the right namespaces with the extra reaper process in the tree. Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_01Gv3s5jckJKzh6JkMoi2Akz --- src/bwrap.cpp | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-) diff --git a/src/bwrap.cpp b/src/bwrap.cpp index 0dd3a8f..6ac2a04 100644 --- a/src/bwrap.cpp +++ b/src/bwrap.cpp @@ -188,7 +188,6 @@ std::vector build_bwrap_args(const std::string& root, std::vector args = {"bwrap", "--die-with-parent"}; auto unshare_args = detect_bwrap_unshare_args(); - bool has_pid_ns = false; bool has_uts_ns = false; for (const auto& arg : unshare_args) { // Not requested yet: without any network setup (slirp4netns or similar), @@ -200,15 +199,10 @@ std::vector build_bwrap_args(const std::string& root, continue; } args.push_back(arg); - if (arg == "--unshare-pid") { - has_pid_ns = true; - } else if (arg == "--unshare-uts") { + if (arg == "--unshare-uts") { has_uts_ns = true; } } - if (has_pid_ns) { - args.push_back("--as-pid-1"); - } if (hostname) { // bwrap itself refuses --hostname without --unshare-uts, so this must be