Electron-based AppImages fail on Deepin Linux

[probonopd]

Solution: Deepin Linux should be configured to allow unprivileged namespaces:
https://docs.appimage.org/user-guide/troubleshooting.html#i-have-issues-with-electron-based-appimages-and-their-sandboxing

Please create a file /etc/sysctl.d/00-local-userns.conf with the following content:

echo kernel.unprivileged_userns_clone = 1

Then, Electron-based AppImages should work.

cc @shouhuanxiaoji

[andersruneson]

I'm not sure this is related, but it looks like the same error, see below.

I get this when trying to run newer versions of Cursor.com, issue at cursor forum.

How do I run these appimages with go-appimage? @probonopd I already have kernel.unprivileged_userns_clone=1, so I don't think that's the issue.

Currently I need to start cursor by running from the commandline to get the argument --no-sandbox.

The setuid sandbox is not running as root. Common causes:
  * An unprivileged process using ptrace on it, like a debugger.
  * A parent process set prctl(PR_SET_NO_NEW_PRIVS, ...)
Failed to move to new namespace: PID namespaces supported, Network namespace supported, but failed: errno = Operation not permitted
[3616548:0311/112540.445877:FATAL:zygote_host_impl_linux.cc(201)] Check failed: . : Invalid argument (22)
Trace/breakpoint trap (core dumped)

[asvishnyakov]

Just run into the same issue, but in my case AppImage itself works fine (when called from console or by double-click), but I can't launch application from a list of applications or icon pinned at Dash in Ubuntu

UPD. Only double click or Run command work, running from console cause the same issue.

[probonopd]

@asvishnyakov which exact Ubuntu version are you using? Can you reproduce this with one of the Ubuntu Live ISOs? Which one? Using which exact AppImage? Thank you very much.

[Samueru-sama]

The issue is this restriction of namespaces that ubuntu added on 24.04: linuxmint/mint22-beta#82

TLDR: The fix is echo 'kernel.apparmor_restrict_unprivileged_userns = 0' | sudo tee /etc/sysctl.d/20-canonical-moment.conf