Fails to run from (latest?) docker image: return code 255

[diegonc]

I've run

$ docker run --rm --ipc=none --privileged -p 8060:8060 ghcr.io/python-discord/snekbox

which downloaded the following image:

$ docker image ls
REPOSITORY                                       TAG                 IMAGE ID       CREATED         SIZE
ghcr.io/python-discord/snekbox                   latest              532712262adf   4 weeks ago     399MB

and when I call the API I get a return code of 255

$ curl -H"Content-Type:application/json" -d '{"input":"print(\"Hello World!\")"}' "http://localhost:8060/eval"
{"stdout": "", "returncode": 255, "files": []}

with the following lines in snekbox logs

2025-12-26 21:52:49,200 |     1 |                 gunicorn.error |     INFO | Starting gunicorn 23.0.0
2025-12-26 21:52:49,210 |     1 |                 gunicorn.error |     INFO | Listening at: http://0.0.0.0:8060 (1)
2025-12-26 21:52:49,211 |     1 |                 gunicorn.error |     INFO | Using worker: sync
2025-12-26 21:52:49,234 |     8 |                 gunicorn.error |     INFO | Booting worker with pid: 8
2025-12-26 21:52:49,286 |     9 |                 gunicorn.error |     INFO | Booting worker with pid: 9
2025-12-26 21:52:49,387 |     9 |                 snekbox.nsjail |     INFO | Assuming cgroup version 2.
2025-12-26 21:52:49,389 |     8 |                 snekbox.nsjail |     INFO | Assuming cgroup version 2.
2025-12-26 21:52:58,937 |     9 |                 snekbox.nsjail |     INFO | Executing code...
2025-12-26 21:52:59,011 |     1 |                 gunicorn.error |    ERROR | Worker (pid:11) exited with code 255
2025-12-26 21:52:59,022 |     9 |                 snekbox.nsjail |     INFO | Found 0 files.
2025-12-26 21:52:59,023 |     9 |                 snekbox.nsjail |    ERROR | execve('/snekbin/python/default/bin/python') failed: No such file or directory
2025-12-26 21:52:59,056 |     1 |                 gunicorn.error |    ERROR | Worker (pid:11) exited with code 255.
2025-12-26 21:52:59,064 |     9 |                 snekbox.nsjail |    ERROR | Launching child process failed
2025-12-26 21:52:59,066 |     9 |                 snekbox.nsjail |  WARNING | Received error message from the child process before it has been executed
2025-12-26 21:52:59,066 |     9 |                 snekbox.nsjail |    ERROR | Couldn't launch the child process
2025-12-26 21:52:59,067 |     9 |                 snekbox.nsjail |     INFO | NsJail return code: 255
^C2025-12-26 21:55:39,927 |     1 |                 gunicorn.error |     INFO | Handling signal: int
2025-12-26 21:55:40,035 |     9 |                 gunicorn.error |     INFO | Worker exiting (pid: 9)
2025-12-26 21:55:40,059 |     8 |                 gunicorn.error |     INFO | Worker exiting (pid: 8)
2025-12-26 21:55:40,848 |     1 |                 gunicorn.error |     INFO | Shutting down: Master

[diegonc]

Image ghcr.io/python-discord/snekbox:3.11 works as expected. Except for args+files which is probably not yet implemented in that version:

{"title": "Request data failed validation", "description": "'input' is a required property"}

[diegonc]

The culprit is probably this mount which contains links to /usr/local which is no longer mounted:

snekbox/config/snekbox.cfg

Lines 84 to 89 in 866e9b9

	mount {
	src: "/snekbin"
	dst: "/snekbin"
	is_bind: true
	rw: false
	}

[diegonc]

Adding the following mounts seems to fix it (or workaround it)

mount {
    src: "/usr/local/bin/python"
    dst: "/usr/local/bin/python"
    is_bind: true
    rw: false
}

mount {
    src: "/usr/local/bin/python3"
    dst: "/usr/local/bin/python3"
    is_bind: true
    rw: false
}

mount {
    src: "/usr/local/bin/python3.14"
    dst: "/usr/local/bin/python3.14"
    is_bind: true
    rw: false
}

mount {
    src: "/usr/local/lib/libpython3.14.so.1.0"
    dst: "/usr/local/lib/libpython3.14.so.1.0"
    is_bind: true
    rw: false
}

mount {
    src: "/usr/local/lib/python3.14"
    dst: "/usr/local/lib/python3.14"
    is_bind: true
    rw: false
}

Unfortunately mounting the other .so links in the local/lib directory makes the application crash with a

 OSError: [Errno 16] Device or resource busy

[jb3]

I suspect this is probably an artefact from #248 which changed what binaries get loaded automatically, if you were to use the latest-pydis version tag you'd probably have the binaries there correctly.

We wanted to try move our specific bundling of a bunch of interpreters into it's own tag so that the main tag is left fairly minimal for other people to build on and expand, therefore it's advised that you build a custom image based off snekbox:latest where you configure the contents of /snekbin/ and add interpreters as necessary (see https://github.com/python-discord/snekbox/blob/main/Dockerfile.pydis for an idea of what this might look like).

In theory though, the :latest tag should have a functioning interpreter (just using the system one that snekbox runs with), so I'll note down a task to investigate why that is the case.