opam sandbox "bwrap: ... failed" in a container in CI

By Kaveh Alemi·Latchkey

opam wraps package builds in a bubblewrap (bwrap) sandbox. Inside a Docker container without the required user namespaces or privileges, bwrap cannot set up its sandbox and every build aborts.

What this error means

opam init or install fails with "bwrap: Creating new namespace failed: Operation not permitted" or "bwrap: setting up uid map: Permission denied" inside a container.

opam

[ERROR] Sandboxing is not working on your platform ...
bwrap: Creating new namespace failed: Operation not permitted
[ERROR] The compiler build failed

Common causes

The container blocks the namespaces bwrap needs

Unprivileged containers often disallow user namespaces or the required syscalls, so bubblewrap cannot create its sandbox.

bubblewrap is missing or restricted in the image

A slim image without bwrap, or a seccomp profile that blocks it, prevents the sandbox from starting.

How to fix it

Initialize opam with sandboxing disabled

In a container you trust, disable the bwrap sandbox at init time so builds run without namespaces.

Terminal

opam init --disable-sandboxing --yes
export OPAMYES=1

Use setup-ocaml, which handles containers

The setup-ocaml action configures opam correctly for CI; when you must run raw opam in Docker, --disable-sandboxing is the standard remedy.

.github/workflows/ci.yml

- uses: ocaml/setup-ocaml@v3
  with:
    ocaml-compiler: '5.1'

How to prevent it

Disable sandboxing when running opam in unprivileged containers.
Prefer setup-ocaml, which sets up opam correctly for CI.
Set OPAMYES=1 so container installs do not stall on prompts.

Frequently asked questions

What causes ""bwrap: ... failed""?