19 days ago
Hello,
Does Railway support running an unprivileged bubblewrap document worker inside a normal service? The worker needs separate user, mount and network namespaces, read-only program files, one input document and bounded temporary storage. It currently stops with:
bwrap: Failed to make / slave: Permission denied
We want to keep document processing isolated, without privileged containers or disabling host security. Is there a supported service configuration for this?
If not, can a Railway Sandbox in an EU region support this worker with outbound internet and private-network access blocked for the worker? ISOLATED mode appears to retain internet access. Are Sandboxes available on Trial accounts, and are there supported restrictions and spending limits for this use case?
Thank you.
1 Replies
19 days ago
Railway service containers do not support the unshare calls bubblewrap needs to create new namespaces, which is why you see the "Permission denied" error, and there is no service setting to enable them. Sandboxes are a better fit: each is a fully isolated Linux VM where you have broader control inside the guest. They are available on every plan including Trial, with Trial limits of 10 per environment, 2 vCPU / 2 GB max, and a 1-5 minute idle timeout. Both ISOLATED and PRIVATE networking modes retain outbound internet through a NAT gateway per the docs, so blocking egress for the worker would need to be handled within the VM itself. Region is configurable via the SDK's region parameter at creation; see docs.railway.com/deployments/regions for EU options. Sandbox usage bills at VM rates and counts toward your plan's included usage and usage limits.
Status changed to Awaiting User Response Railway • 19 days ago
12 days ago
This thread has been marked as solved automatically due to a lack of recent activity. Please re-open this thread or create a new one if you require further assistance. Thank you!
Status changed to Solved Railway • 12 days ago