The README presents KVM_ENABLED=false as a supported path for direct NsJail
development, but the compose service lacks the privileges that mode needs:
mkdir: cannot create directory '/sys/fs/cgroup/init': Read-only file system
/usr/local/bin/start-direct-sandbox.sh: line 24: /sys/fs/cgroup/cgroup.subtree_control: Read-only file system
[sandbox] WARNING: could not enable controllers on root (3 procs remain)
[sandbox] WARNING: 12 /proc submounts remain
unshare: unshare failed: Operation not permitted
The container restarts continuously. The security profile in
docker-compose.yaml appears tuned for microVM mode, so the NsJail fallback
is not usable as shipped.
Either the compose file should grant the needed capabilities when
KVM_ENABLED=false, or the README should note that the fallback requires
extra privileges.
The README presents
KVM_ENABLED=falseas a supported path for direct NsJaildevelopment, but the compose service lacks the privileges that mode needs:
The container restarts continuously. The security profile in
docker-compose.yamlappears tuned for microVM mode, so the NsJail fallbackis not usable as shipped.
Either the compose file should grant the needed capabilities when
KVM_ENABLED=false, or the README should note that the fallback requiresextra privileges.