Sandbox container error: “python lib path is not available”; and “process finished with error”, “status”: “exit status 255”

快速结论：该报错通常发生在 Dify 1.14.x/1.15.x 版本中，开启 Code Node 的工作流执行时。优先排查 sandbox 容器的 seccomp 过滤器是否拦截了 Python 运行所需的系统调用（syscall），导致进程异常退出或超时。

问题场景

用户在自托管（Docker）部署的 Dify 1.14.2 版本中执行 Workflow，其中的 Code Node（代码节点）运行缓慢或超时，并伴随 sandbox 容器反复报错，提示 python lib path is not available 和 process finished with error, status: exit status 255。

报错原文

Sandbox container error: "python lib path is not available"
process finished with error, "status": "exit status 255"

原因分析

这是一个已知的 sandbox 问题。Dify Sandbox 内部使用了 seccomp 过滤器来限制容器允许执行的系统调用。Dify 1.14.x/1.15.x 版本中默认的 syscall 白名单不完整，会阻止现代 Python/glibc 所需的某些系统调用，导致 Python 解释器启动异常，表现为进程异常退出（exit status 255）或间歇性超时。尽管 sandbox 容器看起来处于正常状态，但内部代码执行已失败。

环境排查

Dify 版本：1.14.x 或 1.15.x
部署方式：Docker (Self Hosted)
Sandbox 镜像版本：默认最新版（如 0.2.15+）
配置文件路径：docker/volumes/sandbox/conf/config.yaml
Sandbox 容器日志：docker compose logs sandbox，检查是否出现 operation not permitted、panic: could not create filter 等关键信息

解决步骤

步骤一：扩大 sandbox 配置中的系统调用白名单

编辑 docker/volumes/sandbox/conf/config.yaml 文件，添加一个广泛的 syscall 白名单（包含 0 到 450 号系统调用）。配置示例如下：

allowed_syscalls: [0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,301,302,303,304,305,306,307,308,309,310,311,312,313,314,315,316,317,318,319,320,321,322,323,324,325,326,327,328,329,330,331,332,333,334,335,336,337,338,339,340,341,342,343,344,345,346,347,348,349,350,351,352,353,354,355,356,357,358,359,360,361,362,363,364,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385,386,387,388,389,390,391,392,393,394,395,396,397,398,399,400,401,402,403,404,405,406,407,408,409,410,411,412,413,414,415,416,417,418,419,420,421,422,423,424,425,426,427,428,429,430,431,432,433,434,435,436,437,438,439,440,441,442,443,444,445,446,447,448,449,450]

步骤二：重启 sandbox 容器使配置生效

执行命令：docker compose restart sandbox
步骤三（可优先尝试）：如果 sandbox 日志报错 panic: could not create filter，降级 sandbox 镜像版本

在 docker-compose.yaml 中将 sandbox 服务的镜像设置为 langgenius/dify-sandbox:0.2.14，然后重新部署或重启容器。
可选步骤：调整并发参数

如果工作流中有大量并发的 Code Node，可以在 config.yaml 中调整并发配置：

max_workers: 8
max_requests: 100

验证方法

修改配置并重启 sandbox 容器后，重新执行之前失败的工作流。观察 Code Node 是否能正常执行完毕，不再出现超时或 exit status 255 报错。同时关注 sandbox 容器日志（docker compose logs sandbox），确认不再出现 operation not permitted 或 could not create filter 等错误。