fix(ci): enable unprivileged userns for hub-check bwrap

2026-07-30 12:38:11 +08:00
parent 6f736abe50
commit b91938071d
1 changed files with 3 additions and 0 deletions
@@ -123,6 +123,9 @@ jobs:
            useradd --create-home --shell /bin/bash cphci
          fi
          install -d -o cphci -g cphci -m 0700 /w/t
+          # bwrap needs unprivileged user namespaces once CapEff is emptied.
+          sysctl -w kernel.unprivileged_userns_clone=1 2>/dev/null || true
+          sysctl -w kernel.apparmor_restrict_unprivileged_userns=0 2>/dev/null || true
          REPO_ROOT="$(cd .. && pwd)"
          NODE_BIN_DIR="$(dirname "$(command -v node)")"
          NPX_BIN="$(command -v npx)"