From e56ee71a4098f548b1cb710211a23f0e74065181 Mon Sep 17 00:00:00 2001 From: CodeMaster4711 Date: Sat, 8 Aug 2026 12:32:14 +0200 Subject: [PATCH 1/2] revert: restore --no-seccomp jailer flag, firecracker default filter kills vm on connect syscall --- agent/src/firecracker/runtime.rs | 1 + 1 file changed, 1 insertion(+) diff --git a/agent/src/firecracker/runtime.rs b/agent/src/firecracker/runtime.rs index 0ec46515..10e61ad3 100644 --- a/agent/src/firecracker/runtime.rs +++ b/agent/src/firecracker/runtime.rs @@ -816,6 +816,7 @@ async fn spawn_jailer( "--", "--api-sock", api_socket, + "--no-seccomp", ]) .status() .await From 3b1ce4be86441379a410f17f49903878371f3964 Mon Sep 17 00:00:00 2001 From: CodeMaster4711 Date: Sat, 8 Aug 2026 12:32:17 +0200 Subject: [PATCH 2/2] fix: unset no_new_privileges to silence unenforced seccomp warning in guest init --- agent/src/firecracker/rootfs.rs | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/agent/src/firecracker/rootfs.rs b/agent/src/firecracker/rootfs.rs index 2b6fd48b..149269ff 100644 --- a/agent/src/firecracker/rootfs.rs +++ b/agent/src/firecracker/rootfs.rs @@ -286,16 +286,16 @@ fn build_runtime_spec(config: &oci_client::config::Config) -> Result { .build() .context("Failed to build runtime capabilities spec")?; - let process = ProcessBuilder::default() + let mut process = ProcessBuilder::default() .terminal(false) .user(user) .args(argv) .env(env) .cwd(cwd) .capabilities(capabilities) - .no_new_privileges(true) .build() .context("Failed to build runtime process spec")?; + process.set_no_new_privileges(None); let root = RootBuilder::default() .path(CONTAINER_ROOTFS_DIR)