Troubleshooting
What to do when the sandbox can't start here, a program in it can't write, run or reach what it needs, or your agent's grants don't hold (Sandbox, Permissions).
It can't start here
Told "the sandbox needs bubblewrap", run sudo apt install bubblewrap.
On Ubuntu, when bubblewrap can't make the sandbox, run lnk sandbox ready, and let it add the profile.
It can't write its cache or temp files
--write a folder, and point TMPDIR there, so the program keeps them
in a folder it may change.
A program is refused
"Permission denied" running a program: add it to [commands] allow, or
--command. gdb, strace or Docker failing on Linux are refused
inside, so run them outside.
A commit or git config fails, read only
--write-dot-files ., or [files] write_dot_files. Told "... is a
link" on Linux, make the dot file a folder or file, or name it with
--write-dot-files.
A spec "hasn't run here before" without a terminal
Read it, then add --yes, which answers the question a terminal would
have asked.
It can't resolve names or connect
Add --internet-host '*', or the hosts it needs. A program still
offline with --internet-host ignores HTTPS_PROXY, so set its own
proxy setting. git over SSH failing with --internet-host needs --tcp github.com:22 too.
A program gets 407 from the proxy on a Mac
It drops the user and password HTTPS_PROXY names, the run's secret:
give it its proxy setting with them.
A call hangs, then is refused
It asked you and got no answer: answer it with lnk sandbox asks, or
for an agent's sandbox by replying with its code on your chat. A
login that can't open a browser needs --browser-host <host> ('*'
for any).
Every call is refused
lnk sandbox log shows if it's stopped or paused. Then lnk sandbox stop --off or lnk sandbox resume.
Your agent's permissions
What to do when your agent's sandbox refuses a debugger, a start or a server it should reach, as Permissions grants them.
Linux: gdb or strace fails in the sandbox
Expected, since the sandbox refuses ptrace, which debuggers and tracers
need: run them outside the sandbox.
A start refuses to run with no sandbox
One of three: ~/.lnk/machine.toml says unsandboxed = false; the
machine is a box (root's /etc/lnk/kind.toml), whose agents always run
in their sandbox; or machine.toml, or a folder on its way, is one
others than you and root could write (or could have removed it from).
Use a harness that runs in the sandbox, or fix the folder's mode.
It can't reach a server on this computer, a NAS or Home Assistant
For a server here, lnk agent allow --port <port>. For a NAS or Home
Assistant, lnk agent allow --lan-host nas.local, or --network-mode host for what ignores its proxy.
Something works only with --network-mode host
It ignores HTTPS_PROXY, so its calls never reach the proxy: keep that
grant for it, and please report it.
It answers nothing since deny --internet-host '*'
Its proxy then reaches only the hosts you allow after it: add its
model's and connections' hosts with lnk agent allow --internet-host,
or allow '*' again. An allow beside "*" changes nothing, since
"*" holds every host already.
lnk agent allow network says unexpected argument
allow and deny take a spec's flags: --internet-host '*', --read '~', --network-mode host.