Bazel "process terminated" in sandbox (missing /dev, path) in CI

The sandbox exposes only declared inputs plus a minimal filesystem. When an action reads a file, device, or path that was not declared or mounted, it fails inside the sandbox even though it works unsandboxed. The error names what the process could not find.

What this error means

An action fails with "process terminated" and a missing path such as "/dev/... not found" or "No such file or directory" that exists outside the sandbox but was not made an input.

bazel

ERROR: foo/BUILD.bazel:3:8: Action foo/out failed: process terminated:
/bin/sh: 1: /usr/local/bin/tool: not found
(sandbox: /dev/fd not found)

Common causes

An undeclared input or absolute path

The action reads a file or tool by absolute path that is not a declared input, so the sandbox does not include it.

A device or special path not mounted in the sandbox

The action expects a device like /dev/fd that the minimal sandbox filesystem does not provide.

How to fix it

Declare the missing input

Identify the missing file, tool, or path from the error.
Add it as a declared input (srcs, data, or tools) so the sandbox includes it.
Re-run so the action finds everything inside the sandbox.

foo/BUILD.bazel

genrule(
    name = "gen",
    srcs = ["input.txt"],
    tools = ["//tools:mytool"],
    outs = ["out.txt"],
    cmd = "$(location //tools:mytool) $< > $@",
)

Add the needed path or relax the sandbox

Expose a required path with --sandbox_add_mount_pair, or fall back to a local strategy for actions that genuinely need host paths.

.bazelrc

build --sandbox_add_mount_pair=/usr/local/bin

How to prevent it

Declare every file, tool, and device an action needs as an input.
Avoid absolute host paths in action commands.
Use --sandbox_add_mount_pair only for genuinely required host paths.