pacman 7.0+'s alpm sandbox runs package download/extraction under a
restricted user + seccomp filter. That filter needs syscalls QEMU's
user-mode emulation doesn't support, so building this amd64 image on an
arm64 host (e.g. Apple Silicon) fails immediately on the first pacman
call:
error: error restricting syscalls via seccomp: 22!
error: switching to sandbox user 'alpm' failed!
Confirmed directly: `pacman -Sy` fails with the sandbox enabled and
succeeds cleanly with `DisableSandbox` set in pacman.conf.
Scoped entirely to this test image, not any real role/target this repo
manages. Safe for CI too — the sandbox is a defense-in-depth layer
protecting the host from a compromised download during package fetch,
irrelevant to a container that's destroyed immediately after each test
run; disabling it changes no package-resolution or install behavior,
only removes that extra isolation layer. Native (non-emulated) CI
runners were never affected by the underlying bug either way.
Co-Authored-By: Claude.ai