nsjail run failed cause pasta

[wjcwin]

nsjail version:3.6
pasta version:pasta 0.0~git20250503.587980c-2+deb13u1

ls -l /usr/bin | grep pas
-rwsr-xr-x 1 root root      88568 Apr 19  2025 gpasswd
-rwxr-xr-x 2 root root     269800 Jan 19 19:01 passt
-rwxr-xr-x 1 root root      14936 Jan 19 19:01 passt-repair
-rwxr-xr-x 2 root root     302568 Jan 19 19:01 passt.avx2
-rwsr-xr-x 1 root root     118168 Apr 19  2025 passwd
-rwxr-xr-x 2 root root     269800 Jan 19 19:01 pasta
-rwxr-xr-x 2 root root     302568 Jan 19 19:01 pasta.avx2
-rwxr-xr-x 1 root root      47560 Jun  4  2025 paste

pasta --version
pasta 0.0~git20250503.587980c-2+deb13u1

input command：

strace -f -o /tmp/nsjail.strace -s 256 nsjail --user 1000 --group 1000 \
  --use_pasta \
  --chroot / \
  -- /bin/bash -c "curl www.baidu.com"

log(grep -E 'execve|exit_group|clone|pasta|passt' /tmp/nsjail.strace | tail -50)

130   execve("/usr/local/bin/nsjail", ["nsjail", "--user", "1000", "--group", "1000", "--use_pasta", "--chroot", "/", "--", "/bin/bash", "-c", "curl www.baidu.com"], 0x7ffc2e9c7b80 /* 1130 vars */) = 0
130   write(3, "\33[1m[I][2026-04-06T07:27:21+0000] Jail parameters: hostname:'NSJAIL', chroot:'/', process:'/bin/bash', bind:[::]:0, max_conns:0, max_conns_per_ip:0, time_limit:600, daemonize:false, clone_newnet:true, clone_newuser:true, clone_newns:true, clone_newpid:true"..., 372) = 372
130   clone3({flags=CLONE_NEWNS|CLONE_NEWCGROUP|CLONE_NEWUTS|CLONE_NEWIPC|CLONE_NEWUSER|CLONE_NEWPID|CLONE_NEWNET|CLONE_CLEAR_SIGHAND, exit_signal=SIGCHLD, stack=NULL, stack_size=0}, 88) = 131
130   clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
130   <... clone resumed>, child_tidptr=0x7f9ade113b90) = 132
132   memfd_create("nsjail_pasta", MFD_CLOEXEC|MFD_ALLOW_SEALING|MFD_EXEC) = -1 EINVAL (Invalid argument)
132   memfd_create("nsjail_pasta", MFD_CLOEXEC|MFD_ALLOW_SEALING) = 6
132   execveat(6, "", ["pasta", "--no-dhcp", "--no-dhcpv6", "--no-ra", "--config-net", "-f", "-q", "-t", "none", "-u", "none", "-a", "10.255.255.2", "-n", "255.255.255.0", "-g", "10.255.255.1", "-a", "fc00::2", "-g", "fc00::1", "-I", "eth0", "131"], 0x7ffca8afbc30 /* 1130 vars */, AT_EMPTY_PATH <unfinished ...>
130   write(3, "\33[1m[I][2026-04-06T07:27:21+0000] Spawned pasta for pid=131, pasta_pid=132\33[0m\n", 79 <unfinished ...>
132   <... execveat resumed>)           = 0
132   <... readlink resumed>"/memfd:nsjail_pasta (deleted)", 4095) = 29
132   execve("/memfd:nsjail_pasta (deleted).avx2", ["pasta", "--no-dhcp", "--no-dhcpv6", "--no-ra", "--config-net", "-f", "-q", "-t", "none", "-u", "none", "-a", "10.255.255.2", "-n", "255.255.255.0", "-g", "10.255.255.1", "-a", "fc00::2", "-g", "fc00::1", "-I", "eth0", "131"], 0x7fffc9075450 /* 1130 vars */ <unfinished ...>
132   <... execve resumed>)             = -1 ENOENT (No such file or directory)
132   exit_group(1 <unfinished ...>
132   <... exit_group resumed>)         = ?
131   execve("/bin/bash", ["/bin/bash", "-c", "curl www.baidu.com"], NULL <unfinished ...>
131   <... execve resumed>)             = 0
130   exit_group(137)                   = ?

I am a newcomer to nsjail. I don't know what happened? Can someone tell me? please

[robertswiecki]

I suggest using branch 4.0 (it's experimental)

./nsjail --user 1000 --group 1000 --user_net --chroot / -- /bin/bash -c "curl www.baidu.com"
[I][2026-04-10T20:24:46+0200] Mode: STANDALONE_ONCE
[I][2026-04-10T20:24:46+0200] Jail parameters: hostname:'NSJAIL', chroot:'/', process:'/bin/bash', bind:[::]:0, max_conns:0, max_conns_per_ip:0, time_limit:600, daemonize:false, clone_newnet:true, clone_newuser:true, clone_newns:true, clone_newpid:true, clone_newipc:true, clone_newuts:true, cgroupv2:false, keep_caps:false, disable_no_new_privs:false, max_cpus:0
[I][2026-04-10T20:24:46+0200] Mount: '/' -> '/' type:'' options:'' dir:true
[I][2026-04-10T20:24:46+0200] Mount: '/proc' type:'proc' options:'' dir:true
[I][2026-04-10T20:24:46+0200] Uid map: inside_uid:1000 outside_uid:1000 count:1 newuidmap:false
[I][2026-04-10T20:24:46+0200] Gid map: inside_gid:1000 outside_gid:1000 count:1 newgidmap:false
[I][2026-04-10T20:24:46+0200] Monitor thread started for pid=1568578 (ipc_fd=5, pidfd=6) '[STANDALONE MODE]'
[I][2026-04-10T20:24:46+0200] Executing '/bin/bash' for '[STANDALONE MODE]'
<!DOCTYPE html>
<!--STATUS OK--><html> ...
[I][2026-04-10T20:24:46+0200] pid=1568578 ([STANDALONE MODE]) exited with status: 0, (PIDs left: 0)

[robertswiecki]

For your original question, I'm not sure - it looks like pasta tries to re-execute itself? Is your linux ld.so somehow non-standard - or is it regular glibc?

 <... readlink resumed>"/memfd:nsjail_pasta (deleted)", 4095) = 29
execve("/memfd:nsjail_pasta (deleted).avx2", ["pasta", "--no-dhcp", "--no-dhcpv6", "--no-ra", "--config-net", "-f", "-q", "-t", "none", "-u", "none", "-a", "10.255.255.2", "-n", "255.255.255.0", "-g", "10.255.255.1", "-a", "fc00::2", "-g", "fc00::1", "-I", "eth0", "131"], 0x7fffc9075450 /* 1130 vars */ <unfinished ...>
<... execve resumed>)             = -1 ENOENT (No such file or directory)

Update: Ah.. I see, it tries to execute .avx2 version. Can you change this in net.cc from

        argv.push_back("pasta");

to

        argv.push_back("pasta.avx2");

[wjcwin]

For your original question, I'm not sure - it looks like pasta tries to re-execute itself? Is your linux ld.so somehow non-standard - or is it regular glibc?针对你最初的问题，我不太确定——看起来意大利面会试图重新执行？你的 Linux 是不是不标准 ld.so，还是普通的 glibc？

<... readlink resumed>"/memfd:nsjail_pasta (deleted)", 4095) = 29
execve("/memfd:nsjail_pasta (deleted).avx2", ["pasta", "--no-dhcp", "--no-dhcpv6", "--no-ra", "--config-net", "-f", "-q", "-t", "none", "-u", "none", "-a", "10.255.255.2", "-n", "255.255.255.0", "-g", "10.255.255.1", "-a", "fc00::2", "-g", "fc00::1", "-I", "eth0", "131"], 0x7fffc9075450 /* 1130 vars */ <unfinished ...>
<... execve resumed>) = -1 ENOENT (No such file or directory)
Update: Ah.. I see, it tries to execute .avx2 version. Can you change this in net.cc from更新：啊......我明白了，它尝试执行.avx2 版本。你能不能改成 net.cc

    argv.push_back("pasta");

to  到

    argv.push_back("pasta.avx2");

Thank you. I'll try this solution later