[GH-ISSUE #6701] python3: --timeout does not kill the program (docker)

gitea-mirror commented

2026-05-05 09:55:37 -06:00

Owner

Originally created by @NoonePauseferg on GitHub (Apr 5, 2025).
Original GitHub issue: https://github.com/netblue30/firejail/issues/6701

Description

Describe the bug

Steps to Reproduce

Steps to reproduce the behavior

Run in bash

firejail \
    --debug \
    --private \
    --profile=pip \
    --seccomp=socket \
    --rlimit-nproc=8 \
    --rlimit-nofile=8 \
    --rlimit-fsize=200m \
    --rlimit-as=4096m \
    --timeout=00:00:01 \
    python3 -c 'import time; time.sleep(1000000)'

it will not exit

Expected behavior

after 1s command exit

Actual behavior

inf running proc, which do not exit

Behavior without a profile

same

Additional context

Compile time support:
        - always force nonewprivs support is disabled
        - AppArmor support is enabled
        - AppImage support is enabled
        - chroot support is enabled
        - D-BUS proxy support is enabled
        - file transfer support is enabled
        - firetunnel support is disabled
        - IDS support is enabled
        - networking support is enabled
        - output logging is enabled
        - overlayfs support is disabled
        - private-home support is enabled
        - private-cache and tmpfs as user enabled
        - SELinux support is enabled
        - user namespace support is enabled
        - X11 sandboxing support is enabled

Environment

Name/version/arch of the Linux kernel (uname -srm): Linux 5.15.0-1044-nvidia x86_64
Version of Firejail (firejail --version): 0.9.72

Log

Output of LC_ALL=C firejail /path/to/program

Output of LC_ALL=C firejail --debug /path/to/program

Building quoted command line: 'python3' '-c' 'import time; time.sleep(1000000)' 
Warning: an existing sandbox was detected. python3 will run without any additional sandboxing features
Starting application
LD_PRELOAD=(null)
execvp argument 0: python3
execvp argument 1: -c
execvp argument 2: import time; time.sleep(1000000)
Searching $PATH for python3
trying #/home/user/conda_envs/verl_env/bin/python3#
^CTraceback (most recent call last):
  File "<string>", line 1, in <module>
KeyboardInterrupt

Originally created by @NoonePauseferg on GitHub (Apr 5, 2025). Original GitHub issue: https://github.com/netblue30/firejail/issues/6701  ### Description _Describe the bug_ ### Steps to Reproduce _Steps to reproduce the behavior_ 1. Run in bash ``` firejail \ --debug \ --private \ --profile=pip \ --seccomp=socket \ --rlimit-nproc=8 \ --rlimit-nofile=8 \ --rlimit-fsize=200m \ --rlimit-as=4096m \ --timeout=00:00:01 \ python3 -c 'import time; time.sleep(1000000)' ``` 2. it will not exit ### Expected behavior after 1s command exit ### Actual behavior inf running proc, which do not exit ### Behavior without a profile same ### Additional context ``` Compile time support: - always force nonewprivs support is disabled - AppArmor support is enabled - AppImage support is enabled - chroot support is enabled - D-BUS proxy support is enabled - file transfer support is enabled - firetunnel support is disabled - IDS support is enabled - networking support is enabled - output logging is enabled - overlayfs support is disabled - private-home support is enabled - private-cache and tmpfs as user enabled - SELinux support is enabled - user namespace support is enabled - X11 sandboxing support is enabled ``` ### Environment - Name/version/arch of the Linux kernel (`uname -srm`): Linux 5.15.0-1044-nvidia x86_64 - Version of Firejail (`firejail --version`): 0.9.72 ### Log <details> <summary>Output of <code>LC_ALL=C firejail /path/to/program</code></summary> <p> ``` ``` </p> </details> <details> <summary>Output of <code>LC_ALL=C firejail --debug /path/to/program</code></summary> <p>  ``` Building quoted command line: 'python3' '-c' 'import time; time.sleep(1000000)' Warning: an existing sandbox was detected. python3 will run without any additional sandboxing features Starting application LD_PRELOAD=(null) execvp argument 0: python3 execvp argument 1: -c execvp argument 2: import time; time.sleep(1000000) Searching $PATH for python3 trying #/home/user/conda_envs/verl_env/bin/python3# ^CTraceback (most recent call last): File "<string>", line 1, in <module> KeyboardInterrupt ``` </p> </details>

gitea-mirror added the

needinfo

label 2026-05-05 09:55:37 -06:00

gitea-mirror commented

2026-05-05 09:55:39 -06:00

Author

Owner

@rusty-snake commented on GitHub (Apr 5, 2025):

Warning: an existing sandbox was detected. python3 will run without any additional sandboxing features

@rusty-snake commented on GitHub (Apr 5, 2025): > Warning: an existing sandbox was detected. python3 will run without any additional sandboxing features

gitea-mirror commented

2026-05-05 09:55:40 -06:00

Author

Owner

@NoonePauseferg commented on GitHub (Apr 5, 2025):

hm, how can i disable it?

@NoonePauseferg commented on GitHub (Apr 5, 2025): hm, how can i disable it?

gitea-mirror commented

2026-05-05 09:55:40 -06:00

Author

Owner

@rusty-snake commented on GitHub (Apr 5, 2025):

Check what you have running firejail --list (or --tree).

@rusty-snake commented on GitHub (Apr 5, 2025): Check what you have running `firejail --list` (or `--tree`).

gitea-mirror commented

2026-05-05 09:55:42 -06:00

Author

Owner

@NoonePauseferg commented on GitHub (Apr 5, 2025):

(/home/user/conda_envs/verl_env) user@14a7bbee147c:~$ firejail --list
Warning: an existing sandbox was detected. /bin/bash will run without any additional sandboxing features

(/home/user/conda_envs/verl_env) user@14a7bbee147c:~$ firejail --tree
Warning: an existing sandbox was detected. /bin/bash will run without any additional sandboxing features
Error: --shell=none configured, but no program specified

@NoonePauseferg commented on GitHub (Apr 5, 2025): ``` (/home/user/conda_envs/verl_env) user@14a7bbee147c:~$ firejail --list Warning: an existing sandbox was detected. /bin/bash will run without any additional sandboxing features ``` ``` (/home/user/conda_envs/verl_env) user@14a7bbee147c:~$ firejail --tree Warning: an existing sandbox was detected. /bin/bash will run without any additional sandboxing features Error: --shell=none configured, but no program specified ```

gitea-mirror commented

2026-05-05 09:55:43 -06:00

Author

Owner

@NoonePauseferg commented on GitHub (Apr 5, 2025):

Install it like this

RUN apt-get update \
    && apt-get install -y software-properties-common \
    && apt-get update \
    && add-apt-repository ppa:deki/firejail \
    && apt-get install -y firejail firejail-profiles

@NoonePauseferg commented on GitHub (Apr 5, 2025): Install it like this ``` RUN apt-get update \ && apt-get install -y software-properties-common \ && apt-get update \ && add-apt-repository ppa:deki/firejail \ && apt-get install -y firejail firejail-profiles ```

gitea-mirror commented

2026-05-05 09:55:44 -06:00

Author

Owner

@rusty-snake commented on GitHub (Apr 5, 2025):

You are running inside docker?!

@rusty-snake commented on GitHub (Apr 5, 2025): You are running inside docker?!

gitea-mirror commented

2026-05-05 09:55:45 -06:00

Author

Owner

@NoonePauseferg commented on GitHub (Apr 5, 2025):

yeah, I use cloud for gpu training and need firejail there for code testing

i cant do it?

@NoonePauseferg commented on GitHub (Apr 5, 2025): yeah, I use cloud for gpu training and need firejail there for code testing i cant do it?

gitea-mirror commented

2026-05-05 09:55:46 -06:00

Author

Owner

@kmk3 commented on GitHub (Apr 5, 2025):

Version of Firejail (firejail --version): 0.9.72

Note that we do not maintain that version of firejail:

https://github.com/netblue30/firejail/blob/master/SECURITY.md

Versions other than the latest usually have outdated profiles and may contain
bugs and security vulnerabilities that were fixed in later versions.

Rows
Columns

[GH-ISSUE #6701] python3: --timeout does not kill the program (docker) #3341

Description

Steps to Reproduce

Expected behavior

Actual behavior

Behavior without a profile

Additional context

Environment

Log