{"record":{"id":"c00bf273e878f49d","repo":"openai/codex","slug":"failed-to-create-synthetic-bubblewrap-mount-marker","errorCode":null,"errorMessage":"failed to create synthetic bubblewrap mount marker directory {}: {err}","messagePattern":"failed to create synthetic bubblewrap mount marker directory (.+?): (.+?)","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"error","filePath":"codex-rs/linux-sandbox/src/linux_run_main.rs","lineNumber":954,"sourceCode":"        }\n        let err = std::io::Error::last_os_error();\n        if err.raw_os_error() == Some(libc::EINTR) {\n            continue;\n        }\n        panic!(\"waitpid failed for bubblewrap child: {err}\");\n    }\n}\n\nfn register_synthetic_mount_targets(\n    targets: &[crate::bwrap::SyntheticMountTarget],\n) -> Vec<SyntheticMountTargetRegistration> {\n    with_synthetic_mount_registry_lock(|| {\n        targets\n            .iter()\n            .map(|target| {\n                let marker_dir = synthetic_mount_marker_dir(target.path());\n                fs::create_dir_all(&marker_dir).unwrap_or_else(|err| {\n                    panic!(\n                        \"failed to create synthetic bubblewrap mount marker directory {}: {err}\",\n                        marker_dir.display()\n                    )\n                });\n                let target = if target.preserves_pre_existing_path()\n                    && synthetic_mount_marker_dir_has_active_synthetic_owner(&marker_dir)\n                {\n                    match target.kind() {\n                        crate::bwrap::SyntheticMountTargetKind::EmptyFile => {\n                            crate::bwrap::SyntheticMountTarget::missing(target.path())\n                        }\n                        crate::bwrap::SyntheticMountTargetKind::EmptyDirectory => {\n                            crate::bwrap::SyntheticMountTarget::missing_empty_directory(\n                                target.path(),\n                            )\n                        }\n                    }\n                } else {","sourceCodeStart":936,"sourceCodeEnd":972,"githubUrl":"https://github.com/openai/codex/blob/339751715c64496cb86246bfb3935f40e309dd3d/codex-rs/linux-sandbox/src/linux_run_main.rs#L936-L972","documentation":"register_synthetic_mount_targets (linux_run_main.rs:945) creates a marker directory per target under the per-uid registry ${TMPDIR}/codex-bwrap-synthetic-mount-targets-<euid>/<16-hex FNV-1a hash of the target path> (synthetic_mount_marker_dir, linux_run_main.rs:1332), holding one marker file per live PID so concurrent codex processes coordinate ownership and cleanup. create_dir_all panics when that root is not creatable or writable: TMPDIR unwritable or read-only, ENOSPC, or a non-directory component on the path.","triggerScenarios":"Any sandboxed run with synthetic mount targets (empty files or dirs the sandbox must materialize) where TMPDIR or /tmp is read-only, permission-denied for the effective uid, or full; TMPDIR inherited from a hardened service; a stale registry root with restrictive permissions.","commonSituations":"Hosts mounting /tmp read-only for hardening; TMPDIR pointed at a locked-down path; tmpfs size= limits reached; leftover registry roots with bad ownership after uid changes or restores.","solutions":["Point TMPDIR at a writable directory with free space and rerun.","Run ls -ld on the marker dir path printed in the panic to find the failing read-only or permission component.","Free space or enlarge the tmpfs backing TMPDIR (mount -o remount,size=... /tmp).","With no codex processes running, clear a stale registry: rm -rf ${TMPDIR:-/tmp}/codex-bwrap-synthetic-mount-targets-$(id -u)."],"exampleFix":"# before: TMPDIR resolves to a read-only location\nTMPDIR=/mnt/ro-tmp codex exec --sandbox linux ...\n\n# after: TMPDIR on a writable filesystem\nTMPDIR=/var/tmp/codex codex exec --sandbox linux ...","handlingStrategy":"validation","validationCode":"fn temp_registry_writable() -> std::io::Result<()> {\n    let root = std::env::temp_dir().canonicalize()?;\n    let probe = root.join(format!(\"codex-probe-{}\", std::process::id()));\n    std::fs::create_dir_all(&probe)?;\n    std::fs::write(probe.join(\"p\"), b\"x\")?;\n    std::fs::remove_dir_all(&probe)?;\n    Ok(())\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Validate TMPDIR writability at startup of any service that will launch the sandbox.","Keep /tmp writable and adequately sized on hosts running the linux sandbox.","Exclude the registry root from tmp cleaners and permission sweeps."],"tags":["sandbox","registry","tmpdir","permissions","filesystem","enospc","bubblewrap"],"backgroundTag":"tmp-dir-not-writable","analyzedSha":"339751715c64496cb86246bfb3935f40e309dd3d","analyzedAt":"2026-08-25T05:35:09.876Z","schemaVersion":2},"datasetVersion":"2026-08-25T06:17:31.827Z"}