From 628c18dc822361b6c78cef3832684bed0388d91c Mon Sep 17 00:00:00 2001 From: Alexander Petric Date: Fri, 19 Dec 2025 18:14:06 -0500 Subject: [PATCH] fix: improve error msg for unshare error (#7421) --- backend/windmill-worker/src/worker.rs | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/backend/windmill-worker/src/worker.rs b/backend/windmill-worker/src/worker.rs index 693faebed2..fe48b0976c 100644 --- a/backend/windmill-worker/src/worker.rs +++ b/backend/windmill-worker/src/worker.rs @@ -346,11 +346,13 @@ lazy_static::lazy_static! { \n\ Solutions:\n\ • Check if user namespaces are enabled: 'sysctl kernel.unprivileged_userns_clone'\n\ + • Check max user namespaces limit: 'cat /proc/sys/user/max_user_namespaces'\n\ + (Some AMIs like Bottlerocket have max_user_namespaces=0 which disables user namespaces entirely)\n\ • For Docker: Requires 'privileged: true' in docker-compose for --mount-proc flag\n\ • For Kubernetes: Requires 'privileged: true' in securityContext for --mount-proc flag\n\ • Try different flags via UNSHARE_ISOLATION_FLAGS env var (remove --mount-proc if privileged mode not possible)\n\ • Alternative: Use NSJAIL instead\n\ - • Disable: Set ENABLE_UNSHARE_PID=false", + • Disable: Set ENABLE_UNSHARE_PID=false (or disableUnsharePid=true in Helm chart)", stderr.trim(), flags );