GitHub Actions · Ubuntu 26.04 · Checked November 4, 2026

sudo -E on ubuntu-latest (Ubuntu 26.04): "preserving the entire environment is not supported, '-E' is ignored"

ubuntu-latest is moving from Ubuntu 24.04 to 26.04 between October 19 and November 19, 2026 (what else changes). On 26.04, sudo is sudo-rs, and sudo-rs does not support -E. It prints a warning and runs the command anyway, without the variables you meant to pass:

sudo: preserving the entire environment is not supported, '-E' is ignored

Where it fails

Because it is only a warning, the failure shows up later, wherever the command needed a variable. A script with set -u stops on the first one (edge-addition-planarity-suite #378, with jirutka/setup-alpine):

Run sudo -E ./setup-alpine.sh
  sudo: preserving the entire environment is not supported, '-E' is ignored
  /home/runner/work/_actions/jirutka/setup-alpine/.../setup-alpine.sh: line 134: INPUT_APK_TOOLS_URL: unbound variable
  Error: Process completed with exit code 1.

An installer that reads its install directory from a variable puts the program somewhere else, and the next step cannot find it (dagger #15047):

dagger: command not found
##[error]Process completed with exit code 127.

The worst case is a step that stays green. A server started with sudo -E came up without its address and answered with an empty DNS record (stamhoofd #1487), and an agent job lost its API key: a log line that read Anthropic=true on 24.04 read Anthropic=false on 26.04 (agentmeter-action #32). If a job that uses sudo -E started behaving differently after October 19, search its log for the warning.

Why

sudo-rs treats -E and --preserve-env without a list the same way: it warns and ignores them (src/sudo/cli/mod.rs in sudo-rs). The request to support -E is sudo-rs #1299, still open. --preserve-env= with a list of names works. The classic sudo is still installed on the 26.04 image, as /usr/bin/sudo.ws.

Fix: name the variables

A list works with both sudo and sudo-rs, so the same line runs on 24.04 and 26.04:

sudo --preserve-env=SERVER_IP,GOCOVERDIR ./start.sh

Or hand them over through env, which runs as root with whatever you give it:

sudo env SERVER_IP="$SERVER_IP" ./start.sh

PATH is a separate matter. Ubuntu's sudoers sets secure_path, so neither sudo kept your PATH, even with -E. If you had sudo -E env "PATH=$PATH" ..., keep the env "PATH=$PATH" part and replace -E with the list.

In an action you maintain, inputs arrive as INPUT_* variables, so sudo -E ./script.sh in action.yml loses all of them. List the INPUT_* and GITHUB_* names the script reads (setup-alpine #35 does this). To pass everything, as gh-aw 1.0 does, build the list from the exported names:

sudo --preserve-env="$(compgen -e | paste -sd, -)" ./script.sh

When the sudo -E is in an action you use

jirutka/setup-alpine v1.4.1, the latest release, still runs sudo -E ./setup-alpine.sh, and the fix is an open pull request. Until a release has it, either pin that job with runs-on: ubuntu-24.04, or switch the job back to the classic sudo before the step:

- name: Use the classic sudo
  run: |
    if [ -x /usr/bin/sudo.ws ]; then
      sudo update-alternatives --set sudo /usr/bin/sudo.ws
    fi

24.04 has no sudo.ws, so the if skips it there. Many fixes in October and November pinned 24.04 instead, which holds until GitHub retires that image. Either way, look at "Set up job": the Runner Image group says ubuntu-26.04 or ubuntu-24.04. A re-run can land on 24.04 and pass until November 19, so a green re-run proves nothing.

Other sudo-rs differences on 26.04

• A sudoers file you write with a wildcard in a command's arguments is refused: syntax error: wildcards are not allowed in command arguments (safer-runner-action #5).
• Tools that read sudo's messages, such as a password prompt or "incorrect password attempt", can miss sudo-rs's wording, which is different.
• A sandbox inside bwrap fails with "No permissions to create a new namespace" under AppArmor's bwrap-userns-restrict: bubblewrap on Ubuntu 26.04.
• Most core tools are uutils on 26.04, so a renamed copy of sleep fails with "coreutils: unknown program" and timeout -k no longer kills the process group: "coreutils: unknown program" and the other uutils differences.
• The other 26.04 failures, from renamed apt packages to Playwright: apt on Ubuntu 26.04 and Playwright on Ubuntu 26.04.

See failed jobs from IntelliJ IDEA

Pipeline Inbox for GitHub Actions Workflows, a plugin by Lesstep for JetBrains IDEs 2024.1 or later, lists the runs of all your repositories in an IDE tool window, with their jobs and steps, and your current branch's runs are in the status bar. Reading is free; re-running failed jobs, cancelling, running workflows and reviewing deployments are Pro (US$1.50 a month, with a 30-day trial).

GitHub and GitHub Actions are trademarks of GitHub, Inc.; Ubuntu is a trademark of Canonical Ltd.; IntelliJ IDEA is a trademark of JetBrains s.r.o. This page is not affiliated with, sponsored or endorsed by GitHub, Inc., Canonical or JetBrains.

More: "The ubuntu-latest label will migrate to Ubuntu 26" · apt on Ubuntu 26.04 · Playwright on Ubuntu 26.04 · GitHub Actions plugins for IntelliJ IDEA compared · 日本語