GitHub Actions · Ubuntu 26.04 · Checked November 4, 2026

bubblewrap on ubuntu-latest (Ubuntu 26.04): "No permissions to create a new namespace" and bwrap-userns-restrict

ubuntu-latest is moving from Ubuntu 24.04 to 26.04 between October 19 and November 19, 2026 (what else changes). Jobs that run bubblewrap (bwrap), directly or through an agent's sandbox, meet a change in AppArmor: on 26.04 the bwrap-userns-restrict profile is part of the apparmor package and is loaded from /etc/apparmor.d/. It lets /usr/bin/bwrap create its user namespace, but everything bwrap starts runs under a second profile, unpriv_bwrap, that denies every capability.

A sandbox inside the sandbox

A simple bwrap call still works. What fails is anything inside it that needs a capability, such as a second bwrap, or a seccomp helper that writes setgroups in a nested user namespace. From bwrap itself (Identity-md/worker #12):

bwrap: No permissions to create a new namespace, likely because the kernel does not allow non-privileged user namespaces. On e.g. debian this can be enabled with 'sysctl kernel.unprivileged_userns_clone=1'.

The hint about sysctl points the wrong way here: setting kernel.apparmor_restrict_unprivileged_userns=0 alone does not help, because the denial comes from the profile. From a sandbox runtime such as the one in Claude Code (claude-code #101946):

apply-seccomp: write /proc/self/setgroups (nested userns is capability-restricted; caller must provide CAP_SYS_ADMIN): Permission denied

The kernel log names the profile: apparmor="DENIED" operation="capable" profile="unpriv_bwrap" capname="sys_admin". On a runner the step that calls the sandbox fails, or a test that requires the sandbox is skipped or fails.

On a runner that is thrown away after the job, you can take the profile out for that job, and allow unprivileged user namespaces so that bwrap can still create its own. This is what devspace's CI does, green on image ubuntu-26.04 20261025.179.1 with its sandbox test required:

- name: Let bwrap nest
  run: |
    sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
    if [ -f /etc/apparmor.d/bwrap-userns-restrict ]; then
      sudo apparmor_parser -R /etc/apparmor.d/bwrap-userns-restrict || true
    fi

That turns off the restriction for every program on the runner for the rest of the job. Do not copy it to a machine you keep; there, the reports above disable the profile and load an unconfined profile for bwrap instead.

The 24.04 step that loaded the profile

On 24.04 the same profile is shipped disabled, in the apparmor-profiles package under /usr/share/apparmor/extra-profiles/, and many workflows loaded it to let bwrap run at all. On 26.04 it is no longer there, so this step stops the job (stashbase/cli #81: apparmor_parser exited 2):

sudo apparmor_parser -r /usr/share/apparmor/extra-profiles/bwrap-userns-restrict

Load it only where the file exists. On 26.04 the profile is already loaded, so the step has nothing to do:

profile=/usr/share/apparmor/extra-profiles/bwrap-userns-restrict
if [ -f "$profile" ]; then
  sudo apparmor_parser -r "$profile"
fi

If the job also needs the nesting from the section above, add those lines after this.

Telling it apart

• Run bwrap --ro-bind / / --dev /dev --proc /proc --unshare-user cat /proc/self/attr/current. Under the 26.04 profile it prints bwrap//&unpriv_bwrap (enforce); with the profile out of the way it prints unconfined (a comment on claude-code #101946).
• "setting up uid map: Permission denied" from the first bwrap, with no nesting, usually means the user namespace itself was restricted, for example when the profile was taken out without the sysctl line.
• Look at "Set up job": the Runner Image group says ubuntu-26.04 or ubuntu-24.04. A re-run can land on 24.04 and pass until November 19, so a green re-run proves nothing. runs-on: ubuntu-24.04 holds until GitHub retires that image.

Other 26.04 failures

• kind load docker-image on Ubuntu 26.04: Docker 29's containerd image store keeps one platform of a pulled image, so kind's import fails with "ctr: content digest ... not found".
• /etc/sysctl.conf on Ubuntu 26.04: inotify limits and vm.mmap_rnd_bits stay at the kernel defaults, so .NET hosts and kind clusters hit "too many open files" and ThreadSanitizer aborts.
• "coreutils: unknown program": most core tools are uutils.
• sudo -E on Ubuntu 26.04: sudo is sudo-rs, which ignores -E.
• apt on Ubuntu 26.04: renamed and removed packages.

See failed jobs from IntelliJ IDEA

Pipeline Inbox for GitHub Actions Workflows, a plugin by Lesstep for JetBrains IDEs 2024.1 or later, lists the runs of all your repositories in an IDE tool window, with their jobs and steps, and your current branch's runs are in the status bar. Reading is free; re-running failed jobs, cancelling, running workflows and reviewing deployments are Pro (US$1.50 a month, with a 30-day trial).

GitHub and GitHub Actions are trademarks of GitHub, Inc.; Ubuntu is a trademark of Canonical Ltd.; Claude is a trademark of Anthropic, PBC; IntelliJ IDEA is a trademark of JetBrains s.r.o. This page is not affiliated with, sponsored or endorsed by GitHub, Inc., Canonical, Anthropic or JetBrains.

More: "The ubuntu-latest label will migrate to Ubuntu 26" · "coreutils: unknown program" · sudo -E on Ubuntu 26.04 · GitHub Actions plugins for IntelliJ IDEA compared · 日本語