AIKIDO-2026-74644

TL;DR

On Linux the secure Bubblewrap branch isolates the PID namespace and mounts a fresh /proc but relies on bubblewrap auto-creating a user namespace, which only happens when the parent process runs with a non-zero effective UID. When the sandbox is launched from a root parent (effective UID 0, such as a container running as the default root user), the sandboxed command keeps CAP_SYS_ADMIN in the initial user namespace and can remount the read-only root bind read-write, escaping the filesystem restrictions the sandbox is meant to enforce. The fix forces --unshare-user and --cap-drop ALL in the secure branch so all capabilities are dropped regardless of the parent's effective UID. This closes the sandbox escape path for root-parent deployments.