From b91938071d10a526fbd64fdc6a4999c5414119b9 Mon Sep 17 00:00:00 2001
From: Hong Jiarong <me@jrhim.com>
Date: Thu, 30 Jul 2026 12:38:11 +0800
Subject: [PATCH] fix(ci): enable unprivileged userns for hub-check bwrap

---
 .gitea/workflows/hub-check.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.gitea/workflows/hub-check.yml b/.gitea/workflows/hub-check.yml
index 161dfa3..06eb918 100644
--- a/.gitea/workflows/hub-check.yml
+++ b/.gitea/workflows/hub-check.yml
@@ -123,6 +123,9 @@ jobs:
             useradd --create-home --shell /bin/bash cphci
           fi
           install -d -o cphci -g cphci -m 0700 /w/t
+          # bwrap needs unprivileged user namespaces once CapEff is emptied.
+          sysctl -w kernel.unprivileged_userns_clone=1 2>/dev/null || true
+          sysctl -w kernel.apparmor_restrict_unprivileged_userns=0 2>/dev/null || true
           REPO_ROOT="$(cd .. && pwd)"
           NODE_BIN_DIR="$(dirname "$(command -v node)")"
           NPX_BIN="$(command -v npx)"