Diagnostic code

ZBX-W0101

user namespaces work, but only for unconfined users

Kind

warning

Blame

environment

Exit code

2

What it means

zbx doctor created a user namespace, so zbx works for this process. The host also sets kernel.apparmor_restrict_unprivileged_userns = 1, which refuses the same call to processes that no AppArmor profile confines. The check passed because this process runs under a profile that allows it.

Run from a terminal or another service, zbx may meet the refusal as ZBX-E0101. To allow user namespaces system-wide, set the sysctl to 0 as root; "zbx doctor" shows the same host as a failure when this process is not confined by a permissive profile.

Offline

The same text, without a network:

zbx explain W0101