Project won't start or stop

What you see

• You click Start on a project and get an error message instead.
• The project starts, but with a notice that it "started without" something.
• Stop or Delete fails with a message about the sandbox not being confirmed shut down.

Why it happens

Starting a project sets up a sandbox around your folder of work: the container, the controls on web, model and database access, and the connection to files you shared. If any part that protects your computer cannot be set up, Levee does not start the project at all, rather than start it unprotected.

Find your message below. Messages are shown exactly as Levee writes them.

What you can try

"Another project is already running. Stop it, then start this one."

Only one project can run at a time on a computer. Stop the other project, then start this one.

If the message is "Another user's project is running on this computer. Try again once it has stopped.", someone else signed in to this computer has a project running. You cannot see or stop it. Try again once they have stopped it.

"Project is already running" or "This project is stopping. Try again in a moment."

The project is already running, perhaps from another window, or it is still shutting down. Open it from the project list, or wait a moment and try again.

"Container runtime is downloading (N%)." or other "Container runtime..." messages

Levee is still preparing what sandboxes run on, usually on first use. Wait until it finishes, then start the project. If it never finishes, see Runtime image won't download.

"Project not found" or "Project directory not found"

The project was deleted, or its folder was moved or renamed outside Levee. Put the folder back where it was, or create a new project. See Projects.

"The project folder was moved and its file access could not be verified."

The full message continues: "Restore the folder to its original location, or remove the project from Levee and create it again. Contact your administrator for help."

Files you shared with a project are tied to the project folder's location. Move the folder back, or create the project again and share your files again. See Sharing files.

"Project directory is outside approved root"

The project folder is not inside your project directory, for example because it was replaced with a link to another place. Move the files into a normal folder inside your project directory and create the project there.

When you change the project directory in Settings, the related message is "Project root path is not allowed": the project directory must be a folder on a local drive, inside your own user profile. Network shares and folders outside your profile are refused.

The project started "without" something

The project runs, but Levee shows a notice that starts with "started without" and names what is missing:

Stop fails: "The sandbox could not be confirmed shut down, so its network restrictions have been kept in place."

Levee could not confirm the sandbox is gone. To be safe, it keeps the sandbox cut off from the network. Click Stop again: Levee retries.

If the message becomes "The sandbox still could not be confirmed shut down, so its network restrictions have been kept in place. Contact your administrator.", contact your IT team. Your files are safe.

Delete fails: "Levee cannot confirm that this sandbox has no container still running, so it will not delete the project's files. Contact your administrator."

Retrying does not help. Contact your IT team. Your project files are untouched.

"Cannot rename a running project" or "A project named '...' already exists"

Stop the project before renaming it, and pick a name that is not already used.

Any other message

Copy the exact message and send it to your IT team. Messages such as "Container engine is not running.", "Network proxy unavailable", "Failed to establish network enforcement for the sandbox." and "Container creation failed" need an administrator.

For your IT team

The CLI shows the same messages as the app:

levee project start my-project
levee project status my-project

One active project per computer

Levee runs one project at a time per computer. A start is refused while another project is starting or running, before any proxy, container or filesystem action. The service log records project-busy and the project holding the slot. A failed start, a stop, a delete and a service shutdown release it.

Runtime not ready

Messages: "Container runtime is not ready.", "Container runtime is downloading (N%).", "Container runtime is being verified.", "Container runtime is being expanded.", "Container runtime is being loaded.", "Container runtime image is not installed.", "Container runtime provisioning failed.", "Not enough free disk space to provision the container runtime."

See Runtime image won't download.

"Container engine is not running."

The LeveeContainerEngine service is stopped. Start it from an elevated PowerShell, and check the Windows Containers feature:

Start-Service LeveeContainerEngine
levee doctor

See Startup Doctor checks.

Image version mismatch

Message: "This project requires container runtime image 'levee-base:X', but a different version is installed (levee-base:Y). Reprovision the runtime or set the configured base image to the installed version, then try again."

The policy pins a runtime image version (container.baseImage) that is not installed. Levee provisions the version the policy requires, so on a connected machine run:

levee runtime ensure --wait

Or set Container & Runtime > Base image in policy to the installed version shown in the message (or clear it to use the release default), then sync policy. On offline machines, stage the exact version the policy names, as described in Runtime image won't download.

If the message instead reads "Image 'X' is not loaded in Docker", no runtime image of that kind is installed. Run levee runtime ensure --wait.

Levee releases before 0.64.0 could show this mismatch on every start of a fresh install, because they downloaded the ring's newest image instead of the version the release requires. Update Levee.

"Network proxy unavailable" ("Reinstall or repair Levee.")

Levee could not start the web access proxy for the project. Every connection from the sandbox must go through it, so the project does not start. Typical causes:

• A Levee component is missing or was quarantined by security software. Check your antivirus or EDR quarantine for files under %ProgramFiles%\Vediram\Levee\bin\.
• The ASP.NET Core 8 runtime was removed from the machine.

Repair Levee by running the MSI again. Then check the proxy log:

levee log tail --component proxy.http --since 1h

"Failed to establish network enforcement for the sandbox."

Levee could not apply the operating-system network enforcement that keeps the container's traffic on the Levee proxies. The container is removed and the project does not start. This is usually caused by third-party network filtering software (VPN clients, host firewalls, EDR network modules), or by a service restart during start-up. Try again. If it keeps failing, collect logs and contact support:

levee log tail --component service --since 1h --level Warning

"Levee could not record a security event, so the sandbox was not started."

The full message continues: "Repair or reinstall Levee, or contact support." Levee refuses to start a project whose start it cannot audit. Run levee doctor, check free disk space, and repair Levee.

"Failed to prepare sandbox agent configuration."

Levee could not prepare the configuration it gives the agent for this project. Check that the disk is not full, then start again. If it recurs, collect logs.

"Failed to prepare the sandbox filesystem."

An unexpected error happened while attaching the shared-files view, and Levee stopped the container. Start the project again. If it recurs, collect logs.

"started without the workspace view"

The project started, but the view that holds the user's shared files (L:\ in the sandbox) was left unmounted, never unrestricted. The rest of the notice says why:

See Agent can't see shared files.

"Container creation failed", "Container attach failed", "Container start failed"

The container engine refused the request. The rest of the message is the engine's own error. Common ones:

• "The container operating system does not match the host operating system." Windows on this machine and the runtime image are out of step. See Projects fail after a Windows update.
• Path too long. The full path of the project folder is longer than 260 characters. Use a shorter project directory location.

Stop or delete not confirmed

When Levee cannot confirm that a project's container is gone, it keeps the container's network restrictions in place. If a second Stop also fails, restart the container engine, then the Levee service:

Restart-Service LeveeContainerEngine
Restart-Service LeveeService

When the service restarts, it finishes shutting down any sandbox it could not remove earlier.

For the delete message ("Levee cannot confirm that this sandbox has no container still running"), Levee cannot read its own record of which containers are still contained, so it will not delete the project folder. Contact Vediram Support with logs.

Before you open a request

See Collecting logs for support.