From 3189430ad0e37ea35abb54a832190b2a878ad41d Mon Sep 17 00:00:00 2001
From: artale <arosstale1@gmail.com>
Date: Sat, 14 Feb 2026 23:07:10 +0100
Subject: [PATCH] fix(sandbox): switch to root user for package installation in
 sandbox-common-setup

The base image (Dockerfile.sandbox) sets USER sandbox at the end, so
when sandbox-common-setup.sh builds FROM it, apt-get runs as the
unprivileged sandbox user and fails with 'Permission denied'.

Add USER root before apt-get/npm/curl install steps, and restore
USER sandbox at the end to preserve the non-root runtime default.

Fixes #16420
---
 scripts/sandbox-common-setup.sh | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/scripts/sandbox-common-setup.sh b/scripts/sandbox-common-setup.sh
index 1291d27a8da..eac7ea84afc 100755
--- a/scripts/sandbox-common-setup.sh
+++ b/scripts/sandbox-common-setup.sh
@@ -27,6 +27,7 @@ docker build \
   --build-arg BREW_INSTALL_DIR="${BREW_INSTALL_DIR}" \
   - <<EOF
 FROM ${BASE_IMAGE}
+USER root
 ENV DEBIAN_FRONTEND=noninteractive
 ARG INSTALL_PNPM=1
 ARG INSTALL_BUN=1
@@ -55,6 +56,7 @@ RUN if [ "\${INSTALL_BREW}" = "1" ]; then \\
   if [ ! -x "\${BREW_INSTALL_DIR}/bin/brew" ]; then echo "brew install failed"; exit 1; fi; \\
   ln -sf "\${BREW_INSTALL_DIR}/bin/brew" /usr/local/bin/brew; \\
 fi
+USER sandbox
 EOF
 
 cat <<NOTE