From 6498bf7eb61b8c0bffe0bb23f6ab49edd4a99b5a Mon Sep 17 00:00:00 2001 From: Ahmed Abdelhalim Date: Tue, 21 Jul 2026 17:32:47 +0200 Subject: Disable pacman sandbox in archlinux molecule image for QEMU compat MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit pacman 7.0+'s alpm sandbox runs package download/extraction under a restricted user + seccomp filter. That filter needs syscalls QEMU's user-mode emulation doesn't support, so building this amd64 image on an arm64 host (e.g. Apple Silicon) fails immediately on the first pacman call: error: error restricting syscalls via seccomp: 22! error: switching to sandbox user 'alpm' failed! Confirmed directly: `pacman -Sy` fails with the sandbox enabled and succeeds cleanly with `DisableSandbox` set in pacman.conf. Scoped entirely to this test image, not any real role/target this repo manages. Safe for CI too — the sandbox is a defense-in-depth layer protecting the host from a compromised download during package fetch, irrelevant to a container that's destroyed immediately after each test run; disabling it changes no package-resolution or install behavior, only removes that extra isolation layer. Native (non-emulated) CI runners were never affected by the underlying bug either way. Co-Authored-By: Claude.ai --- molecule/archlinux/Dockerfile.j2 | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/molecule/archlinux/Dockerfile.j2 b/molecule/archlinux/Dockerfile.j2 index 9e25e4f3..fd6791e7 100644 --- a/molecule/archlinux/Dockerfile.j2 +++ b/molecule/archlinux/Dockerfile.j2 @@ -2,6 +2,14 @@ FROM docker.io/library/archlinux ENV container docker +# pacman's syscall sandbox (alpm) doesn't work under QEMU user-mode +# emulation (e.g. building amd64 images on an arm64 host): the sandbox's +# seccomp filter needs syscalls QEMU doesn't emulate, so pacman fails +# with "error restricting syscalls via seccomp" before ever reaching the +# network. Disabling it only affects local cross-arch testing; native +# CI runners aren't emulated and are unaffected either way. +RUN sed -i '/^\[options\]/a DisableSandbox' /etc/pacman.conf + RUN pacman -Syu --noconfirm --needed python3 systemd udev dbus \ && pacman -Scc --noconfirm -- cgit v1.2.3