Recent releases of apparmor (at least, as packaged by ubuntu) have an "unprivileged_userns" profile which blocks applications from creating new user namespaces.

This means bitbake will fail to enable the network isolation with an error like this:

Traceback (most recent call last):
  File "bitbake/bin/bitbake-worker", line 268, in child
    bb.utils.disable_network(uid, gid)
  File "/bitbake/lib/bb/utils.py", line 1653, in disable_network
    with open("/proc/self/uid_map", "w") as f:
PermissionError: [Errno 1] Operation not permitted

For system binaries it possible to write profiles to allow the specific binaries to create user namespaces, but as bitbake is fetched by the user there's no way of specifying a path that upstream would accept.

https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/2056555 is the upstream apparmor bug tracking this issue, but we will not be getting a profile to allow any binary called 'bitbake-worker' to create a user namespace as that would compromise the security improvements intended by this change.

https://discourse.ubuntu.com/t/ubuntu-24-04-lts-noble-numbat-release-notes/39890#unprivileged-user-namespace-restrictions talks about this feature and has several approaches to resolve it.