Support for unprivileged mount namespaces in Linux VMs

[AlexTkDev]

I’m using an Ubuntu 22.04 VM inside OrbStack and found that unprivileged mount namespaces are not available.

This affects applications that rely on Bubblewrap / sandboxing. In my case, Cursor IDE Terminal Sandbox cannot start.

Observed behavior:

unshare --user --map-root-user id
works

unshare --mount
returns:
Operation not permitted

Running the same command with sudo works.

Kernel:
Linux 7.0.14-orbstack

Kernel config includes:
CONFIG_NAMESPACES=y
CONFIG_USER_NS=y
CONFIG_SECCOMP=y
CONFIG_SECCOMP_FILTER=y
CONFIG_SECURITY_LANDLOCK=y
CONFIG_BPF_LSM=y

AppArmor is not present.

Cursor’s sandbox fails during the mount namespace stage, so it looks like OrbStack blocks unprivileged mount namespaces in this environment.

My questions:
Is this an intentional limitation of OrbStack?
Is there any configuration option to allow unprivileged mount namespaces?
Is support for this planned in a future release?

If needed, I can provide more logs and a minimal reproduction.