---
title: "MGS2012: sandbox required"
description: magus refused to run because the sandbox mode is required and the kernel cannot confine the run's children, the case MGS2005 only warns about in best-effort mode.
tags: [MGS2012, sandbox, landlock, kernel, required, merge queue, fail closed]
---

# MGS2012: sandbox required

`sandbox.mode` is `required` (or `MAGUS_SANDBOX=required`, or
`--sandbox=required`), and the kernel cannot confine the processes the run
starts. magus stops before running anything.

```text
[MGS2012] sandbox mode is required for /tmp/mergequeue-apply-1/candidate-7/checkout,
and the kernel cannot confine its children: sandbox: kernel sandbox unsupported on this host;
run it on Linux 6.2 or newer with landlock enabled (/sys/kernel/security/landlock)
```

## Why

Without kernel landlock the sandbox falls back to magus's own binding checks
([MGS2005](MGS2005.md)). Those confine what goes through magus's bindings, and
nothing a subprocess does: a tool writing through a symlink, or any native code,
is out of their reach. That fallback is a fair trade for a developer's own build.
It is not one for code nobody trusts running in a job that holds a credential, so
a caller that needs the kernel's guarantee says so and magus refuses rather than
degrade.

`required` also needs landlock ABI 3 (Linux 6.2) or newer. Below it the kernel
cannot deny truncation, so a confined child could still empty any file its user
owns, inside the rules or not.

It fires in two places, with the same meaning:

- when the workspace's sandbox is applied, before any target or script runs;
- when a child would start under a required policy, so no path starts one
  unconfined.

## Resolution

- Run on Linux 6.2 or newer with landlock enabled; check that
  `/sys/kernel/security/landlock` exists. GitHub's hosted Ubuntu runners have it.
- Where kernel enforcement is not available and you accept binding-level checks,
  use `best-effort` instead.