Repository navigation
fix(sandbox): keep vz sockets inside the AF_UNIX path limit - #222
Merged
Merged
Conversation
A sandbox whose name pushed its socket path past 103 characters failed to start with "bind() failed ... No such file or directory". The cap is enforced by silent truncation, so the helper bound a path nobody was listening on. The app data directory alone is ~74 characters, so "codev-work" was already enough to overflow. Sockets now live in a short per-user directory keyed by a hash of the sandbox's data dir (0700, since the system temp dir is shared on Linux), which keeps them unique per sandbox and well clear of the limit. vm.json and the rest of the runtime state stay where they were. Verified: live vz e2e green (health / path api / broker), and a unit test pins socket paths under the limit for names far longer than the one that broke. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Reported from a real sandbox: creating one named
codev-workfailed withRoot cause
sun_pathis capped at 104 bytes on macOS (103 usable), and the cap is enforced by silent truncation rather than an error. That path is exactly 104 characters, so the helper bound a truncated path and everything downstream looked for a socket that was not there — surfacing as a confusing ENOENT. Reproduced directly: binding that path from Node reports success, thenunlinkof the same path fails with ENOENT because the socket actually landed elsewhere.The app data directory alone is ~74 characters, so only ~29 remain for the sandbox name plus
/runtime/server.sock. Sandbox names of 10 characters already overflow — which is why the names used during testing (e2e,work,sectest) all fit and hid the bug.Fix
Sockets move to a short per-user directory keyed by a hash of the sandbox's data dir:
<tmp>/codev-sbx-<hash10>/{server,broker}.sock, created 0700 (the system temp dir is shared on Linux, so the sockets inside must not be reachable by other users). Unique per sandbox, stable across starts, and ~83 characters on macOS — far clear of the limit.vm.jsonand the rest of the runtime state stay in the data dir.Verification
e2e-vzon the published image:health: OK / path api: OK / broker: OK / e2e OKNote on the other backends
WSL uses TCP, so it is unaffected. bubblewrap's socket lives under a much shorter base (
~/.config/...) against a higher limit (108 on Linux), so it has real headroom — left alone rather than changed blind, but worth revisiting when the Linux path gets its first real run.🤖 Generated with Claude Code