---
name: strix-sandbox-container-crash-fix
description: Fix Docker sandbox container crashing immediately due to daemon-level no-new-privileges blocking sudo in the entrypoint
---

# Fix Strix Sandbox Container Crash (no-new-privileges)

## Symptoms
- Sandbox container exits within seconds of creation (exit code 1)
- Logs show: `sudo: The "no new privileges" flag is set, which prevents sudo from running as root.`
- Strix scan logs show: `container ... is not running` after initial Caido bootstrap

## Root Cause
Docker daemon has `"no-new-privileges": true` in `/etc/docker/daemon.json`. The strix-sandbox image's entrypoint runs `sudo` to configure system-wide proxy settings inside the container — this fails under no-new-privileges, the entrypoint exits, and the container dies.

## Fix
Patch `strix/runtime/docker_client.py` to add `--security-opt no-new-privileges:false` to the container create kwargs:

```python
# In StrixDockerSandboxClient._create_container(), before cap_add:
security_opt = create_kwargs.setdefault("security_opt", [])
if "no-new-privileges" not in str(security_opt):
    security_opt.append("no-new-privileges:false")
```

File location (pipx install):
```
~/.local/share/pipx/venvs/strix-agent/lib/python3.13/site-packages/strix/runtime/docker_client.py
```

## Verification
```bash
# Container should stay up indefinitely:
docker run -d --name strix-test \
  --security-opt no-new-privileges:false \
  ghcr.io/usestrix/strix-sandbox:1.0.0 tail -f /dev/null
sleep 10
docker ps --filter "name=strix-test"
docker rm -f strix-test
```

## Alternative Fixes
1. Remove `"no-new-privileges": true` from `/etc/docker/daemon.json` and restart Docker (system-wide, affects all containers)
2. Set `STRIX_IMAGE` env var to a custom sandbox image without the sudo requirement
3. Patch the sandbox image's entrypoint to handle sudo failure gracefully

## Caido Noise (Harmless)
The sandbox container produces `ERROR` logs about Caido SDK connection failures at startup:
```
scope_rules failed: Cannot connect to host 127.0.0.1:10XX
list_sitemap failed: A network error occured
```
This is **harmless noise**. Strix has two Caido integrations:
- **In-container Caido sidecar** (port 48080) — works automatically, proxies all HTTP traffic.
- **Host-side Caido SDK tools** — try to connect via `STRIX_CAIDO_URL` env var *before* the sandbox fully resolves its exposed Docker port. Once the sandbox is ready and `caido_client` is injected into the run context, subsequent calls succeed. The errors do not block the scan.

## Scan Output
Results are saved under `~/strix_runs/<run-name>/`:
- `run.json` — scan metadata (status, LLM usage, targets)
- `strix.log` — full agent execution log
- `.state/agents.json` — agent topology and statuses
- `.state/agents.db` — agent state SQLite

## Persistence
The pipx-based fix survives `strix` package upgrades only until the next `pipx upgrade strix-agent`. After upgrade, re-apply the patch. File location:
```
~/.local/share/pipx/venvs/strix-agent/lib/python3.13/site-packages/strix/runtime/docker_client.py
```