{"record":{"id":"bccae2f1e4e7e4f1","repo":"openai/codex","slug":"failed-to-open-bundled-bubblewrap-err","errorCode":null,"errorMessage":"failed to open bundled bubblewrap {}: {err}","messagePattern":"failed to open bundled bubblewrap (.+?): (.+?)","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"codex-rs/linux-sandbox/src/bundled_bwrap.rs","lineNumber":38,"sourceCode":"const SHA256_HEX_LEN: usize = 64;\nconst NULL_SHA256_DIGEST: [u8; 32] = [0; 32];\n\n#[derive(Debug, Clone, PartialEq, Eq)]\npub(crate) struct BundledBwrapLauncher {\n    program: AbsolutePathBuf,\n}\n\npub(crate) fn launcher() -> Option<BundledBwrapLauncher> {\n    let current_exe = std::env::current_exe().ok()?;\n    find_for_install_context(InstallContext::current())\n        .or_else(|| find_legacy_for_exe(&current_exe))\n        .map(|program| BundledBwrapLauncher { program })\n}\n\nimpl BundledBwrapLauncher {\n    pub(crate) fn exec(&self, argv: Vec<String>, preserved_files: Vec<File>) -> ! {\n        let bwrap_file = File::open(self.program.as_path()).unwrap_or_else(|err| {\n            panic!(\n                \"failed to open bundled bubblewrap {}: {err}\",\n                self.program.as_path().display()\n            )\n        });\n        if let Err(err) = verify_digest(&bwrap_file, expected_sha256(), self.program.as_path()) {\n            eprintln!(\"{err}\");\n            std::process::exit(crate::BUNDLED_BWRAP_DIGEST_VERIFICATION_FAILURE_EXIT_CODE);\n        }\n\n        make_files_inheritable(&preserved_files);\n\n        let fd_path = format!(\"/proc/self/fd/{}\", bwrap_file.as_raw_fd());\n        let program_cstring = CString::new(fd_path.as_str())\n            .unwrap_or_else(|err| panic!(\"invalid bundled bubblewrap fd path: {err}\"));\n        let cstrings = argv_to_cstrings(&argv);\n        let mut argv_ptrs: Vec<*const c_char> = cstrings\n            .iter()\n            .map(CString::as_c_str)","sourceCodeStart":20,"sourceCodeEnd":56,"githubUrl":"https://github.com/openai/codex/blob/339751715c64496cb86246bfb3935f40e309dd3d/codex-rs/linux-sandbox/src/bundled_bwrap.rs#L20-L56","documentation":"The Linux sandbox can exec a bundled copy of bubblewrap instead of a system one. BundledBwrapLauncher::exec() opens the previously resolved bwrap path (from the install context's codex-resources directory or legacy locations next to the binary) and panics if File::open fails: the launcher found an executable file during discovery, but it cannot be opened when the sandbox is about to start.","triggerScenarios":"Between launcher() discovery and exec(), the bwrap file was deleted, renamed, or had permissions/ownership changed; the installation directory sits on a mount that went away (unmounted FUSE/archive); EIO/ENXIO from a failing disk; EACCES after the file mode or a parent directory's search permission changed.","commonSituations":"Broken or partially extracted npm/package installs where codex-resources/bwrap exists but is unreadable; antivirus/EDR quarantining the binary mid-session; resources on removable or network mounts; system cleaners removing unknown executables.","solutions":["Inspect the path printed in the panic: ls -l it and confirm the file still exists and is readable and executable by the running user.","Reinstall the codex package so the bundled resources are re-extracted intact.","Check security software and audit logs (SELinux denials, EDR quarantine) and restore or exclude the binary.","If the environment cannot host the bundled binary, install system bubblewrap so the sandbox uses the system path instead."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"use std::os::unix::fs::PermissionsExt;\nfn bundled_bwrap_usable(path: &std::path::Path) -> bool {\n    let Ok(meta) = std::fs::metadata(path) else { return false; };\n    meta.is_file()\n        && meta.permissions().mode() & 0o111 != 0\n        && std::fs::File::open(path).is_ok()\n}\nif !bundled_bwrap_usable(&path) {\n    // repair the installation or fall back to system bwrap before launching\n}","typeGuard":null,"tryCatchPattern":"The panic happens inside exec() immediately before execv; catch_unwind does not help because the surrounding flow expects exec to replace the process. Validate the path beforehand and repair or fall back instead of catching.","preventionTips":["Verify codex-resources/bwrap exists and is executable right after install or upgrade (a digest check runs when CODEX_BWRAP_SHA256 is set).","Exclude the installation directory from system cleaners and EDR quarantine.","Smoke-test one sandboxed command after install so a broken bundle surfaces immediately."],"tags":["rust","linux","sandbox","bubblewrap","panic","filesystem"],"backgroundTag":"missing-executable","analyzedSha":"339751715c64496cb86246bfb3935f40e309dd3d","analyzedAt":"2026-08-25T05:35:09.876Z","schemaVersion":2},"datasetVersion":"2026-08-25T06:17:31.827Z"}