{"record":{"id":"0ecae3e00adc6338","repo":"openai/codex","slug":"bubblewrap-is-unavailable-no-system-bwrap-was-fou","errorCode":null,"errorMessage":"bubblewrap is unavailable: no system bwrap was found on PATH and no bundled codex-resources/bwrap binary was found next to the Codex executable","messagePattern":"bubblewrap is unavailable: no system bwrap was found on PATH and no bundled codex-resources/bwrap binary was found next to the Codex executable","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"codex-rs/linux-sandbox/src/launcher.rs","lineNumber":51,"sourceCode":"    supports_argv0: bool,\n    supports_perms: bool,\n    supports_ro_bind_fd: bool,\n}\n\npub(crate) fn exec_bwrap(mut argv: Vec<String>, preserved_files: Vec<File>) -> ! {\n    argv.insert(1, \"--as-pid-1\".to_string());\n\n    match preferred_bwrap_launcher() {\n        BubblewrapLauncher::System(launcher) => {\n            if !launcher.supports_ro_bind_fd {\n                translate_legacy_bwrap_fd_mounts(&mut argv)\n                    .unwrap_or_else(|error| panic!(\"invalid legacy bubblewrap fd mount: {error}\"));\n            }\n            exec_system_bwrap(&launcher.program, argv, preserved_files)\n        }\n        BubblewrapLauncher::Bundled(launcher) => launcher.exec(argv, preserved_files),\n        BubblewrapLauncher::Unavailable => {\n            panic!(\n                \"bubblewrap is unavailable: no system bwrap was found on PATH and no bundled \\\n                 codex-resources/bwrap binary was found next to the Codex executable\"\n            )\n        }\n    }\n}\n\nfn translate_legacy_bwrap_fd_mounts(argv: &mut Vec<String>) -> Result<(), String> {\n    let command_separator = argv\n        .iter()\n        .position(|argument| argument == \"--\")\n        .ok_or_else(|| \"bubblewrap argv is missing the command separator '--'\".to_string())?;\n    let mut verification_args = Vec::new();\n    let mut verified_fds = Vec::new();\n    let mut argument_index = 0;\n\n    while argument_index < command_separator {\n        if argv[argument_index] != \"--ro-bind-fd\" {","sourceCodeStart":33,"sourceCodeEnd":69,"githubUrl":"https://github.com/openai/codex/blob/339751715c64496cb86246bfb3935f40e309dd3d/codex-rs/linux-sandbox/src/launcher.rs#L33-L69","documentation":"exec_bwrap requires a bubblewrap launcher: a system bwrap discovered on PATH (a file whose --help advertises --as-pid-1 and --perms) or a bundled codex-resources/bwrap binary next to the Codex executable. When neither is found, preferred_bwrap_launcher() returns Unavailable and exec_bwrap panics, so the Linux sandbox cannot start on that host at all.","triggerScenarios":"Invoking sandboxed execution on a host with no bubblewrap installed; a service or container whose PATH omits the directory containing bwrap; a bwrap binary that fails its --help probe or lacks --perms; packaging that ships the codex binary without codex-resources/.","commonSituations":"Minimal Docker or CI images (slim, distroless); systemd units with a reset PATH; ancient or broken bubblewrap installs; relocating the codex executable away from its bundled resources.","solutions":["Install bubblewrap: apt-get install -y bubblewrap (Debian/Ubuntu), dnf install -y bubblewrap (Fedora), pacman -S bubblewrap (Arch)","Verify the probe passes: bwrap --help must list --as-pid-1 and --perms","Fix the PATH of the service or container to include the bwrap directory","If you distribute codex, bundle codex-resources/bwrap next to the executable"],"exampleFix":"# before -- slim container, no bubblewrap\nFROM debian:bookworm-slim\n\n# after -- bubblewrap present and on PATH\nFROM debian:bookworm-slim\nRUN apt-get update \\\n    && apt-get install -y --no-install-recommends bubblewrap \\\n    && rm -rf /var/lib/apt/lists/*","handlingStrategy":"fallback","validationCode":"fn bubblewrap_usable() -> bool {\n    std::process::Command::new(\"bwrap\")\n        .arg(\"--help\")\n        .output()\n        .map(|o| {\n            let t = format!(\n                \"{}{}\",\n                String::from_utf8_lossy(&o.stdout),\n                String::from_utf8_lossy(&o.stderr)\n            );\n            t.contains(\"--as-pid-1\") && t.contains(\"--perms\")\n        })\n        .unwrap_or(false)\n}\n\nif !bubblewrap_usable() {\n    run_without_linux_sandbox()?; // graceful degradation instead of panic\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Preflight bwrap availability before enabling sandboxed execution paths","Install and pin bubblewrap in Dockerfiles and CI images","Ship codex-resources with release artifacts","Alert when bwrap --help output changes across distro upgrades"],"tags":["bubblewrap","linux-sandbox","missing-dependency","panic","rust"],"backgroundTag":"executable-not-found","analyzedSha":"339751715c64496cb86246bfb3935f40e309dd3d","analyzedAt":"2026-08-25T05:35:09.876Z","schemaVersion":2},"datasetVersion":"2026-08-25T06:17:31.827Z"}