panic: could not create filter

[Ykubernetes]

Self Checks

• I have read the Contributing Guide and Language Policy.
• This is only for bug report, if you would like to ask a question, please head to Discussions.
• I have searched for existing issues search for existing issues, including closed ones.
• I confirm that I am using English to submit this report, otherwise it will be closed.
• 【中文用户 & Non English User】请使用英语提交，否则会被关闭 ：）
• Please do not modify this template :) and fill in all the required fields.

Dify version

1.14.2

Cloud or Self Hosted

Self Hosted (Docker)

Steps to reproduce

worker-1 | 2026-05-28 15:09:13.019 INFO [Dummy-3172] [workflow_execute_task.py:266] 0b0a657e985759ccbfa5f7b0c2fa3624 - workflow_based_app_execution_task run with params: app_id='1748df2a-1348-4863-884f-0c81b59d5097' workflow_id='9d731f16-c3a2-4094-b4ee-488609fe056a' tenant_id='e646e725-edd3-4984-b372-0c5f5a830160' app_mode=<AppMode.ADVANCED_CHAT: 'advanced-chat'> user=_Account(TYPE=<_UserType.ACCOUNT: 'account'>, user_id='2812d893-0900-4ae3-b9d2-654a6a7e1416') args={'files': [], 'inputs': {}, 'query': '你好啊', 'conversation_id': ''} invoke_from=<InvokeFrom.DEBUGGER: 'debugger'> streaming=True call_depth=0 root_node_id=None workflow_run_id='a753804e-937a-4d12-aa4a-1623b28bfd68'
worker-1 | 2026-05-28 15:09:13.100 INFO [Thread-3173 (_generate_worker)] [_client.py:1025] 0b0a657e985759ccbfa5f7b0c2fa3624 - HTTP Request: GET http://plugin_daemon:5002/plugin/e646e725-edd3-4984-b372-0c5f5a830160/management/models?page=1&page_size=256 "HTTP/1.1 200 OK"
worker-1 | 2026-05-28 15:09:14.155 INFO [GraphWorker-1] [_client.py:1025] 0b0a657e985759ccbfa5f7b0c2fa3624 - HTTP Request: POST http://sandbox:8194/v1/sandbox/run "HTTP/1.1 200 OK"
worker-1 | 2026-05-28 15:09:14.251 ERROR [GraphDispatcher] [error_handler.py:104] - Node 1779952118403 failed with ABORT strategy: panic: could not create filter
worker-1 |
worker-1 | goroutine 17 [running, locked to thread]:
worker-1 | main.DifySeccomp(...)
worker-1 | /home/runner/work/dify-sandbox/dify-sandbox/cmd/lib/python/main.go:11
worker-1 | error: signal: aborted (core dumped)
worker-1 |
worker-1 | 2026-05-28 15:09:14.334 INFO [Dummy-3172] [trace.py:128] 0b0a657e985759ccbfa5f7b0c2fa3624 - Task tasks.app_generate.workflow_execute_task.workflow_based_app_execution_task[eaf446f3-c40b-4081-b2a7-ba525d4701ee] succeeded in 1.3156074434518814s: None
worker-1 | 2026-05-28 15:09:14.357 ERROR [Thread-3173 (_generate_worker)] [workflow_entry.py:232] 0b0a657e985759ccbfa5f7b0c2fa3624 - Unknown Error when workflow entry running
worker-1 | Traceback (most recent call last):
worker-1 | File "/app/api/core/workflow/workflow_entry.py", line 228, in run
worker-1 | yield from generator
worker-1 | File "/app/api/.venv/lib/python3.12/site-packages/graphon/graph_engine/graph_engine.py", line 278, in run
worker-1 | yield from self._emit_terminal_events()
worker-1 | File "/app/api/.venv/lib/python3.12/site-packages/graphon/graph_engine/graph_engine.py", line 322, in _emit_terminal_events
worker-1 | raise error
worker-1 | RuntimeError: panic: could not create filter
worker-1 |
worker-1 | goroutine 17 [running, locked to thread]:
worker-1 | main.DifySeccomp(...)
worker-1 | /home/runner/work/dify-sandbox/dify-sandbox/cmd/lib/python/main.go:11
worker-1 | error: signal: aborted (core dumped)
worker-1 |
worker-1 | 2026-05-28 15:10:00.507 INFO [MainThread] [strategy.py:161] - Task schedule.trigger_provider_refresh_task.trigger_provider_refresh[d3fdd8a7-7078-409b-9d64-f8fd30bf84b5] received

✔️ Expected Behavior

none

❌ Actual Behavior

[root@dify-node-01 docker]# docker logs -f docker-sandbox-1
[GIN] 2026/05/28 - 07:33:55 | 200 | 63.406µs | ::1 | GET "/health"
{"time":"2026-05-28T07:34:06.274504529Z","level":"WARN","msg":"python lib path is not available","path":"/usr/local/lib/python3.14"}
{"time":"2026-05-28T07:34:06.274634776Z","level":"WARN","msg":"python lib path is not available","path":"/usr/lib/python3.14"}
{"time":"2026-05-28T07:34:06.274658672Z","level":"WARN","msg":"python lib path is not available","path":"/usr/lib/python3"}
{"time":"2026-05-28T07:34:15.600978751Z","level":"WARN","msg":"python lib path is not available","path":"/etc/nsswitch.conf"}
{"time":"2026-05-28T07:34:15.637480248Z","level":"WARN","msg":"python lib path is not available","path":"/run/systemd/resolve/stub-resolv.conf"}
{"time":"2026-05-28T07:34:15.637554695Z","level":"WARN","msg":"python lib path is not available","path":"/run/resolvconf/resolv.conf"}
{"time":"2026-05-28T07:34:15.637578894Z","level":"WARN","msg":"python lib path is not available","path":"/etc/localtime"}
{"time":"2026-05-28T07:34:18.758904191Z","level":"WARN","msg":"python lib path is not available","path":"/etc/timezone"}
{"time":"2026-05-28T07:34:18.759208805Z","level":"INFO","msg":"Python dependencies updated successfully"}
[GIN] 2026/05/28 - 07:34:25 | 200 | 155.802µs | ::1 | GET "/health"
[GIN] 2026/05/28 - 07:34:55 | 200 | 56.184µs | ::1 | GET "/health"
[GIN] 2026/05/28 - 07:35:25 | 200 | 60.753µs | ::1 | GET "/health"
[GIN] 2026/05/28 - 07:35:55 | 200 | 46.295µs | ::1 | GET "/health"
[GIN] 2026/05/28 - 07:36:25 | 200 | 39.877µs | ::1 | GET "/health"
[GIN] 2026/05/28 - 07:36:55 | 200 | 48.374µs | ::1 | GET "/health"
[GIN] 2026/05/28 - 07:37:25 | 200 | 42.213µs | ::1 | GET "/health"
[GIN] 2026/05/28 - 07:37:55 | 200 | 56.976µs | ::1 | GET "/health"
[GIN] 2026/05/28 - 07:38:25 | 200 | 53.357µs | ::1 | GET "/health"
[GIN] 2026/05/28 - 07:38:55 | 200 | 62.14µs | ::1 | GET "/health"
[GIN] 2026/05/28 - 07:39:26 | 200 | 52.054µs | ::1 | GET "/health"
[GIN] 2026/05/28 - 07:39:56 | 200 | 40.171µs | ::1 | GET "/health"
[GIN] 2026/05/28 - 07:40:26 | 200 | 49.339µs | ::1 | GET "/health"
[GIN] 2026/05/28 - 07:40:56 | 200 | 65.664µs | ::1 | GET "/health"
[GIN] 2026/05/28 - 07:41:26 | 200 | 45.999µs | ::1 | GET "/health"
[GIN] 2026/05/28 - 07:41:56 | 200 | 70.192µs | ::1 | GET "/health"
[GIN] 2026/05/28 - 07:42:26 | 200 | 420.864µs | ::1 | GET "/health"
[GIN] 2026/05/28 - 07:42:56 | 200 | 50.584µs | ::1 | GET "/health"

[dosubot]

This is a known regression in dify-sandbox version 0.2.15. The DifySeccomp() function fails to create the seccomp filter during initialization, causing the panic you're seeing [1].

Workaround: Downgrade the sandbox image to version 0.2.14 in your docker-compose.yaml:

sandbox:
  image: langgenius/dify-sandbox:0.2.14

Then restart the sandbox container (docker compose up -d sandbox). This resolves the issue without any additional configuration changes [1].

The regression was introduced when the sandbox was bumped from 0.2.14 to 0.2.15 and appears to still be present in the 1.14.2 release [1]. An official fix in a newer sandbox version has not been confirmed yet.

To reply, just mention @dosu.

---

Docs are dead. Just use Dosu.