Skip to main content

​
SIGABRT before the sandbox comes up

This is a microVM runtime failing on a host with no /dev/kvm. It is not a corrupt runtime and no version of any microVM tool fixes it — nested virtualisation is unavailable on all but bare-metal instance types, and Oracle’s Ampere ARM64 shapes do not offer it at all. nativesandbox is the answer to this error. If you are seeing it, you are still on the microVM runtime.

​
No container engine at …

The socket is per-user and carries your uid, not the 1000 every tutorial prints. Check the one that matches the account your service runs as:

​
The socket disappears after a logout

Sandboxes work, then stop at an arbitrary later moment with no deploy and no code change. The user’s systemd session — and the socket with it — is torn down at logout unless lingering is on. This is the single most confusing failure in a rootless setup, because the cause and the symptom are hours apart.

​
Limits are accepted and ignored

The worst failure mode here, because nothing fails: every sandbox is simply unbounded.
If that prints the host’s total memory rather than the limit you asked for, cgroup delegation is missing:
You want cpu memory pids. A fresh user@.service override may be needed after a kernel or systemd upgrade.

​
no such image

Rootless Podman keeps images per user, under ~/.local/share/containers. An image pulled with sudo podman is invisible to your service account, and vice versa. nativesandbox pulls on demand, so this usually resolves itself on the first run — the first pull is slow, and every later one is cached.

​
A command hangs until the timeout with no output

Almost always a tool waiting on stdin. nativesandbox runs every command with stdin closed precisely so that readers get EOF immediately, so if you are seeing this, suspect a tool that polls a TTY instead: pass its non-interactive flag (npm --yes, apt-get -y, git --no-pager).

​
Disk filling up

Stopped sandboxes keep their workspaces on purpose — that is the warm cache. But nothing reclaims a workspace unless something calls remove().
Reclaiming covers the automatic deadlines. Note that neither of them deletes a workspace: stopIdle() stops the container and retireExpired() removes the container, and both keep the directory. If your fleet is long-lived, you need a policy for removing workspaces that will never be used again — the library will not guess it for you. For the engine’s own accumulated layers, podman system df shows usage and podman system prune reclaims it.

​
A container this package will not clean up

If you created a container through Engine directly, it carries none of this package’s labels, so list(), sweep() and removeAll() cannot see it. That is deliberate — the label scope is what stops a sweep touching a container it does not own — but it means anything you create by hand is yours to remove by hand.