{"record":{"id":"6bfe29cdeb55fea6","repo":"openai/codex","slug":"invalid-legacy-bubblewrap-fd-mount-error","errorCode":null,"errorMessage":"invalid legacy bubblewrap fd mount: {error}","messagePattern":"invalid legacy bubblewrap fd mount: (.+?)","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"error","filePath":"codex-rs/linux-sandbox/src/launcher.rs","lineNumber":45,"sourceCode":"    supports_argv0: bool,\n    supports_ro_bind_fd: bool,\n}\n\n#[derive(Debug, Clone, Copy, PartialEq, Eq)]\nstruct SystemBwrapCapabilities {\n    supports_argv0: bool,\n    supports_perms: bool,\n    supports_ro_bind_fd: bool,\n}\n\npub(crate) fn exec_bwrap(mut argv: Vec<String>, preserved_files: Vec<File>) -> ! {\n    argv.insert(1, \"--as-pid-1\".to_string());\n\n    match preferred_bwrap_launcher() {\n        BubblewrapLauncher::System(launcher) => {\n            if !launcher.supports_ro_bind_fd {\n                translate_legacy_bwrap_fd_mounts(&mut argv)\n                    .unwrap_or_else(|error| panic!(\"invalid legacy bubblewrap fd mount: {error}\"));\n            }\n            exec_system_bwrap(&launcher.program, argv, preserved_files)\n        }\n        BubblewrapLauncher::Bundled(launcher) => launcher.exec(argv, preserved_files),\n        BubblewrapLauncher::Unavailable => {\n            panic!(\n                \"bubblewrap is unavailable: no system bwrap was found on PATH and no bundled \\\n                 codex-resources/bwrap binary was found next to the Codex executable\"\n            )\n        }\n    }\n}\n\nfn translate_legacy_bwrap_fd_mounts(argv: &mut Vec<String>) -> Result<(), String> {\n    let command_separator = argv\n        .iter()\n        .position(|argument| argument == \"--\")\n        .ok_or_else(|| \"bubblewrap argv is missing the command separator '--'\".to_string())?;","sourceCodeStart":27,"sourceCodeEnd":63,"githubUrl":"https://github.com/openai/codex/blob/339751715c64496cb86246bfb3935f40e309dd3d/codex-rs/linux-sandbox/src/launcher.rs#L27-L63","documentation":"When the system bubblewrap's --help does not advertise --ro-bind-fd, exec_bwrap falls back to translate_legacy_bwrap_fd_mounts, which rewrites --ro-bind-fd FD DEST into --ro-bind /proc/self/fd/FD DEST plus --verify-fd-mount FD:DEST arguments for the trusted inner stage. Any argv that cannot be translated (missing '--' separator, missing or non-numeric fd, standard or duplicate fd, relative destination, missing inner command, or an inner command lacking --apply-seccomp-then-exec) makes the translation return Err, and exec_bwrap panics with this message before exec.","triggerScenarios":"An older distro bubblewrap without --ro-bind-fd combined with a malformed argv: dropping the '--' between bwrap flags and the inner command, or replacing the codex-linux-sandbox --apply-seccomp-then-exec stage with a plain command.","commonSituations":"Ubuntu 20.04/22.04-era bwrap packages; forks or scripts that assemble their own bwrap argv; refactors that reorder flags or remove the separator.","solutions":["Upgrade bubblewrap to a build whose --help lists --ro-bind-fd, which skips the legacy translation entirely","Restore the required shape: bwrap flags ... -- codex-linux-sandbox --apply-seccomp-then-exec -- command","Let the launcher emit --ro-bind-fd flags instead of injecting them yourself","Pin bwrap in CI and assert on its --help capabilities"],"exampleFix":"# before -- no '--' separator, translation fails and exec_bwrap panics\nbwrap --as-pid-1 --ro-bind-fd 7 /tmp/socket-root /usr/bin/env -- true\n\n# after -- separator and trusted inner stage present\nbwrap --as-pid-1 --ro-bind-fd 7 /tmp/socket-root -- codex-linux-sandbox --apply-seccomp-then-exec -- true","handlingStrategy":"validation","validationCode":"use std::process::Command;\n\nfn bwrap_supports_ro_bind_fd(program: &std::path::Path) -> bool {\n    match Command::new(program).arg(\"--help\").output() {\n        Ok(out) => {\n            let text = format!(\n                \"{}{}\",\n                String::from_utf8_lossy(&out.stdout),\n                String::from_utf8_lossy(&out.stderr)\n            );\n            text.contains(\"--ro-bind-fd\")\n        }\n        Err(_) => false,\n    }\n}\n\nif !bwrap_supports_ro_bind_fd(&bwrap_path) {\n    validate_legacy_translatable_argv(&argv)?;\n}","typeGuard":null,"tryCatchPattern":"let pid = unsafe { libc::fork() };\nif pid == 0 {\n    exec_bwrap(argv, preserved_files); // diverges: execs or panics\n}\nlet mut status = 0;\nunsafe { libc::waitpid(pid, &mut status, 0) };\nif !libc::WIFEXITED(status) || libc::WEXITSTATUS(status) != 0 {\n    // child panicked before exec: surface bwrap capability and argv diagnostics\n}","preventionTips":["Probe bwrap --help capabilities during environment setup, not at exec time","Never hand-assemble --ro-bind-fd argv","Keep the launcher.rs translation unit tests green when touching argv code"],"tags":["bubblewrap","linux-sandbox","argv","panic","rust"],"backgroundTag":"unsupported-tool-version","analyzedSha":"339751715c64496cb86246bfb3935f40e309dd3d","analyzedAt":"2026-08-25T05:35:09.876Z","schemaVersion":2},"datasetVersion":"2026-08-25T06:17:31.827Z"}