{"record":{"id":"0099f43eb9614f01","repo":"openai/codex","slug":"failed-to-normalize-bundled-bubblewrap-path-e","errorCode":null,"errorMessage":"failed to normalize bundled bubblewrap path {}: {err}","messagePattern":"failed to normalize bundled bubblewrap path (.+?): (.+?)","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"codex-rs/linux-sandbox/src/bundled_bwrap.rs","lineNumber":86,"sourceCode":"            \"failed to exec bundled bubblewrap {} via {fd_path}: {err}\",\n            self.program.as_path().display()\n        );\n    }\n}\n\nfn find_for_install_context(context: &InstallContext) -> Option<AbsolutePathBuf> {\n    context\n        .bundled_resource(\"bwrap\")\n        .filter(|path| is_executable_file(path))\n}\n\nfn find_legacy_for_exe(exe: &Path) -> Option<AbsolutePathBuf> {\n    legacy_candidates_for_exe(exe)\n        .into_iter()\n        .find(|candidate| is_executable_file(candidate))\n        .map(|path| {\n            AbsolutePathBuf::from_absolute_path(&path).unwrap_or_else(|err| {\n                panic!(\n                    \"failed to normalize bundled bubblewrap path {}: {err}\",\n                    path.display()\n                )\n            })\n        })\n}\n\nfn legacy_candidates_for_exe(exe: &Path) -> Vec<PathBuf> {\n    let Some(exe_dir) = exe.parent() else {\n        return Vec::new();\n    };\n\n    let mut candidates = Vec::new();\n    candidates.push(exe_dir.join(\"codex-resources\").join(\"bwrap\"));\n    if let Some(package_target_dir) = exe_dir.parent() {\n        candidates.push(package_target_dir.join(\"codex-resources\").join(\"bwrap\"));\n    }\n    candidates.push(exe_dir.join(\"bwrap\"));","sourceCodeStart":68,"sourceCodeEnd":104,"githubUrl":"https://github.com/openai/codex/blob/339751715c64496cb86246bfb3935f40e309dd3d/codex-rs/linux-sandbox/src/bundled_bwrap.rs#L68-L104","documentation":"launcher() discovers a bundled bwrap in legacy locations relative to the current executable (exe_dir/codex-resources/bwrap, the package-target directory, an adjacent bwrap, bazel runfiles). find_legacy_for_exe converts the first executable candidate to AbsolutePathBuf and panics if the path is not absolute. Because candidates are joined onto the exe's parent directory, this only fires when std::env::current_exe() itself resolves to a relative path.","triggerScenarios":"Running the binary in an environment where current_exe() yields a relative path: exotic kernels, or chroots/containers where /proc/self/exe is unavailable or relative, so the join produces a relative candidate that AbsolutePathBuf::from_absolute_path rejects.","commonSituations":"Containers or chroots without /proc mounted; unusual FUSE/overlay filesystems; extremely rare on mainstream Linux and macOS where /proc/self/exe is absolute.","solutions":["Invoke the binary via an absolute path so exe-relative discovery yields absolute candidates.","Mount /proc in the container or chroot so current_exe() resolves absolutely.","Install via the supported package layout so InstallContext resolves codex-resources absolutely instead of falling back to legacy exe-relative discovery."],"exampleFix":"# before\n$ ./codex-linux/bin/codex ...   # relative invocation; current_exe() may stay relative without /proc\n\n# after\n$ /opt/codex/bin/codex ...      # absolute argv and /proc mounted","handlingStrategy":"validation","validationCode":"// Before sandboxed commands, confirm exe resolution is absolute\nmatch std::env::current_exe() {\n    Ok(exe) if exe.is_absolute() => { /* legacy discovery is safe */ }\n    Ok(_relative) => { /* re-exec self via an absolute path or refuse sandboxing */ }\n    Err(_) => { /* /proc missing; mount it or disable the sandbox */ }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always launch the binary by absolute path in service definitions and container entrypoints.","Ensure /proc is mounted in any container or chroot that runs the sandbox."],"tags":["rust","linux","path-resolution","sandbox","panic"],"backgroundTag":"relative-path-resolution-failed","analyzedSha":"339751715c64496cb86246bfb3935f40e309dd3d","analyzedAt":"2026-08-25T05:35:09.876Z","schemaVersion":2},"datasetVersion":"2026-08-25T06:17:31.827Z"}