Sandbox 0.2.15 crashes with "signal: aborted (core dumped)" on Node.js execution — regression from 0.2.14

[dsw520]

Self Checks

• I have read the Contributing Guide and Language Policy.
• This is only for bug report, if you would like to ask a question, please head to Discussions.
• I have searched for existing issues search for existing issues, including closed ones.
• I confirm that I am using English to submit this report, otherwise it will be closed.
• 【中文用户 & Non English User】请使用英语提交，否则会被关闭 ：）
• Please do not modify this template :) and fill in all the required fields.

Dify version

1.14.0

Cloud or Self Hosted

Self Hosted (Docker)

Steps to reproduce

Environment

• Dify Version: 1.14.0
• Sandbox Version: 0.2.15 ❌ | 0.2.14 ✅
• Deployment: Docker Compose
• OS: CentOS / RHEL

Description

Sandbox version 0.2.15 consistently crashes when executing any Node.js code with signal: aborted (core dumped).

The crash originates from DifySeccomp() in the Node.js runner initialization. Rolling back to sandbox 0.2.14 fixes the issue completely.

This is a regression introduced in 0.2.15.

Steps to Reproduce

1. Deploy Dify 1.14.0 with Docker Compose
2. Use sandbox image langgenius/dify-sandbox:0.2.15
3. Create a workflow with a code node containing any valid Node.js code

Example Code (triggers the crash):

function main({arg1, arg2}) {
    const now = new Date();
    const now_str = `${now.getFullYear()}-${String(now.getMonth()+1).padStart(2,'0')}-${String(now.getDate()).padStart(2,'0')}`;
    
    if (!arg1) {
        const mapping = {
            'A': '甲方',
            'B': '乙方',
            'C': '丙方',
            'D': '丁方'
        };
        return {
            our_party: mapping[arg2] || ''
        };
    }
    return {
        our_party: arg1,
        now_str: now_str,
    }
}

Verified Fix

Downgrading sandbox to 0.2.14 resolves the issue.

# docker-compose.yaml
sandbox:
  image: langgenius/dify-sandbox:0.2.14  # ✅ works
  # image: langgenius/dify-sandbox:0.2.15  # ❌ crashes

After rollback to 0.2.14, all Node.js code executes successfully without any changes to the code or configuration.

✔️ Expected Behavior

Node.js code should execute normally and return the expected output.

❌ Actual Behavior

Sandbox crashes with signal: aborted (core dumped).

Error Log

goroutine 17 [running, locked to thread]:
main.DifySeccomp(...)
    /home/runner/work/dify-sandbox/dify-sandbox/cmd/lib/nodejs/main.go:9
error: signal: aborted (core dumped)

Full log entry:

{
    "time": "2026-05-06T08:51:17.364972614Z",
    "level": "ERROR",
    "msg": "process finished with error",
    "status": "signal: aborted (core dumped)"
}```

[BeautyyuYanli]

Thanks for the report. This does look like a real regression exposed by the stricter sandbox initialization checks in 0.2.15.

In 0.2.14, failures from InitSeccomp(...) in the Node.js bootstrap could be ignored. In 0.2.15, those failures now abort execution, so this may indicate that seccomp/chroot/privilege-drop setup is failing on this host rather than the JavaScript code itself.

Could you please share the following details from the affected environment?

uname -a
docker version
docker info | grep -i rootless
docker inspect <sandbox-container> --format '{{json .HostConfig.SecurityOpt}} {{json .HostConfig.CapAdd}}'

CentOS/RHEL host kernel compatibility is especially relevant here because the sandbox currently loads seccomp with SECCOMP_FILTER_FLAG_TSYNC. We should also improve the Node.js seccomp wrapper so it reports the exact errno instead of only surfacing signal: aborted (core dumped).

For now, rolling back to 0.2.14 is a valid temporary workaround, but we do not want to simply ignore sandbox setup failures again because that could mean running with incomplete isolation.