Failed to initialize sandbox: fchmodat with testcontainers temp directories + withFileSystemBind

[exp0nge]

Description of the bug:

When using withFileSystemBind + temp directories, Bazel cannot startup with

ERROR: Failed to initialize sandbox: fchmodat (/home/./.cache/bazel/_bazel_./c0f38c663f7c72e76f8b4734b1c3d4a1/sandbox/sandbox_stash/_NoMnemonic_/303/execroot/gemini/_tmp/85f16382a55e499ef429a6a5d629ee43/consensus10554034598184753878/beacondata) (Operation not permitted)

on shutdown:

(20:33:55) ERROR: Testing..failed: com.google.devtools.build.lib.unix.FilePermissionException: fchmodat (/home/j../_tmp/9d92db955d0ee0acd1773a8804db77fc/execution350786877263214127/geth) (Operation not permitted)

During shutdown it presents a similar permission error around not being able to clean up

Which category does this issue belong to?

Core

What's the simplest, easiest way to reproduce this bug? Please provide a minimal example if possible.

In Scala:

  private def createTempDir(name: String): String = {
    val tempDir = Files.createTempDirectory(name)
    tempDir.toFile.deleteOnExit()
    tempDir.toString
  }
...
def createContainer() = {
    val executionDirPath = createTempDir("execution")
..
      .withFileSystemBind(executionDirPath, "/execution", BindMode.READ_WRITE)
}

Which operating system are you running Bazel on?

Linux 5.10.0-33-cloud-amd64 #1 SMP Debian 5.10.226-1 (2024-10-03) x86_64 GNU/Linux

What is the output of bazel info release?

release 6.5.0

If bazel info release returns development version or (@non-git), tell us how you built Bazel.

No response

What's the output of git remote get-url origin; git rev-parse HEAD ?

If this is a regression, please try to identify the Bazel commit where the bug was introduced with bazelisk --bisect.

No response

Have you found anything relevant by searching the web?

No response

Any other information, logs, or outputs that you want to share?

No response