diff --git a/bin/opencode-sandbox b/bin/opencode-sandbox
index e6b17e6..f2199d4 100755
--- a/bin/opencode-sandbox
+++ b/bin/opencode-sandbox
@@ -2,7 +2,10 @@
 # opencode-sandbox — run OpenCode 2 for a project inside a sandbox:
 #   egress filter (squid in a container) + netlock (nftables by group) + bubblewrap.
 # See README.md. Start with: opencode-sandbox help
-set -euo pipefail
+set -Eeuo pipefail
+# A failure nobody handled: say where, instead of exiting silently. Main process only: in
+# subshells ($(...), <(...)) a non-zero status is the parent's to judge
+trap '[[ ${BASHPID} != "$$" ]] || echo "opencode-sandbox: unexpected failure at ${BASH_SOURCE[0]##*/}:${LINENO}: ${BASH_COMMAND}" >&2' ERR
 
 OCSB_HOME="$(cd "$(dirname "$(readlink -f "${BASH_SOURCE[0]}")")/.." && pwd)"
 export OCSB_HOME
diff --git a/lib/common.sh b/lib/common.sh
index 01b32c7..8018aaf 100644
--- a/lib/common.sh
+++ b/lib/common.sh
@@ -21,7 +21,7 @@ OCSB_SCALARS=(
   OCSB_NAME OCSB_WEB_PORT OCSB_EGRESS_PORT OCSB_NETLOCK_GROUP OCSB_SANDBOX OCSB_PANEL
   OCSB_NOTIFICATIONS OCSB_TMP OCSB_DISPLAY OCSB_OPENCODE_BIN OCSB_ENV_FILE OCSB_KUBECONFIG OCSB_PASSWORD_FILE
   OCSB_WORKTREES_DIR OCSB_WT_PREFIX OCSB_WT_BASE OCSB_WT_SLUG_REGEX OCSB_DOCKER_GW
-  OCSB_STATE_DIR OCSB_OPENCODE_CONFIG OCSB_EGRESS_BASE
+  OCSB_STATE_DIR OCSB_OPENCODE_CONFIG
 )
 OCSB_ARRAYS=(OCSB_RW OCSB_RW_HOME OCSB_HIDE OCSB_HIDE_HOME OCSB_SKILLS OCSB_SKILL_DIRS OCSB_PLUGINS OCSB_ENV)
 
@@ -140,7 +140,8 @@ ocsb_derive() {
     OCSB_WORKTREES_DIR=$(ocsb_abs "${OCSB_WORKTREES_DIR}")
   fi
   if [[ -z ${OCSB_DOCKER_GW} ]]; then
-    OCSB_DOCKER_GW=$(ip -4 -o addr show docker0 2>/dev/null | awk '{print $4}' | cut -d/ -f1 | head -1)
+    # docker0 appears only once dockerd runs (socket activation starts it on first use)
+    OCSB_DOCKER_GW=$(ip -4 -o addr show docker0 2>/dev/null | awk '{print $4}' | cut -d/ -f1 | head -1) || true
     OCSB_DOCKER_GW=${OCSB_DOCKER_GW:-172.17.0.1}
   fi
   OCSB_CONTAINER="opencode-sandbox-egress-${OCSB_NAME}"
diff --git a/lib/egress.sh b/lib/egress.sh
index e631c7c..f97c4ed 100644
--- a/lib/egress.sh
+++ b/lib/egress.sh
@@ -26,6 +26,7 @@ ocsb_egress_layers() {
     "${OCSB_PROJECT_DIR}/.opencode-sandbox/local/egress.conf"; do
     [[ -f ${f} ]] && echo "${f}"
   done
+  return 0
 }
 
 # Prints "directive<TAB>arg" for every argument of every rule line