https://opam.ocaml.org/doc/FAQ.html#Why-does-opam-require-bwrap

"If needed, for special cases like unprivileged containers, sandboxing can be disabled on opam init with the --disable-sandboxing flag (only for non-initialised opam)".

I think that would make sense, as we never execute code from the opam root, we only read metadata files.

In T3976#79630, @olasd wrote:

https://opam.ocaml.org/doc/FAQ.html#Why-does-opam-require-bwrap

"If needed, for special cases like unprivileged containers, sandboxing can be disabled on opam init with the --disable-sandboxing flag (only for non-initialised opam)".

I think that would make sense, as we never execute code from the opam root, we only read metadata files.

ah yes, sorry about that link... I forgot to check it back, that's the one i got yesterday about bwrap indeed.
The opam loader tests now no longer triggers [1] actual call to opam init to avoid network access and that issue altogether.

I now have the 2nd error which no longer is about bwrap but about opam show which no longer works as pre 2.1.

[1] D7255