diff --git a/doc/frc971.conf b/doc/frc971.conf
new file mode 100644
index 0000000..743ca69
--- /dev/null
+++ b/doc/frc971.conf
@@ -0,0 +1,5 @@
+# Put this file in /etc/sysctl.d/ to enable Bazel's sandboxing on Debian
+# kernels.
+# Run `sudo sysctl --system` to load it without rebooting.
+
+kernel.unprivileged_userns_clone = 1