Cursor sandbox cant establish userns network

[Omer_Teomim]

When using Cursor’s agent over a Remote-SSH connection to my EC2 machine, the sandbox cannot establish its user namespace (userns). As a result the cursorsandbox helper gets stuck during initialization and the agent hangs on even the simplest commands, producing zero output until the process is killed. This happens only over the SSH/remote connection — not in a normal local session.
My configuration (unprivileged userns already enabled):

kernel.apparmor_restrict_unprivileged_userns = 0

kernel.unprivileged_userns_clone = 1

[Colin]

Hey @Omer_Teomim

This looks a lot like the issue reported over here. Can you have a look and see if it’s a match?

Agent CLI: Linux sandbox preflight fails (unshare EPERM) unless run under strace; apparmor_restrict_unprivileged_userns=1

Hey, thanks for the report. The analysis and the repro tests really help because they cut out all the noise. You’re right about the root cause. The AppArmor profile for the Agent CLI cursor_sandbox_agent_cli, which matches ~/.local/share/cursor-agent/versions/*/cursorsandbox, is shipped with userns commented out, the line #userns, for compatibility with AppArmor < 4.0. On AppArmor 4.0+ with apparmor_restrict_unprivileged_userns=1, a confined process must have an explicit userns rule to call uns…