openai/codex · error

failed to normalize system bubblewrap path {}: {err}

Error message

failed to normalize system bubblewrap path {}: {err}

What it means

After the capability probe accepts a system bwrap, its path is normalized with AbsolutePathBuf::from_absolute_path, which only accepts absolute paths. When bwrap is resolved through a relative PATH entry (for example '.', an empty segment, or a relative directory), the discovered path is relative, normalization fails, and system_bwrap_launcher_for_path_with_probe panics with this message.

Source

Thrown at codex-rs/linux-sandbox/src/launcher.rs:166

fn system_bwrap_launcher_for_path_with_probe(
    system_bwrap_path: &Path,
    system_bwrap_capabilities: impl FnOnce(&Path) -> Option<SystemBwrapCapabilities>,
) -> Option<SystemBwrapLauncher> {
    if !system_bwrap_path.is_file() {
        return None;
    }

    let Some(SystemBwrapCapabilities {
        supports_argv0,
        supports_perms: true,
        supports_ro_bind_fd,
    }) = system_bwrap_capabilities(system_bwrap_path)
    else {
        return None;
    };
    let system_bwrap_path = match AbsolutePathBuf::from_absolute_path(system_bwrap_path) {
        Ok(path) => path,
        Err(err) => panic!(
            "failed to normalize system bubblewrap path {}: {err}",
            system_bwrap_path.display()
        ),
    };
    Some(SystemBwrapLauncher {
        program: system_bwrap_path,
        supports_argv0,
        supports_ro_bind_fd,
    })
}

pub(crate) fn preferred_bwrap_supports_argv0() -> bool {
    match preferred_bwrap_launcher() {
        BubblewrapLauncher::System(launcher) => launcher.supports_argv0,
        BubblewrapLauncher::Bundled(_) | BubblewrapLauncher::Unavailable => true,
    }
}

View on GitHub (pinned to 339751715c)

Solutions

1. Make every PATH entry absolute, e.g. export PATH="$PWD/bin:/usr/bin:$PATH"
2. Fix the service unit or container environment so PATH contains no relative or empty segments
3. Launch codex with a sanitized, fully absolute PATH

Example fix

# before -- relative PATH entry, discovered bwrap path is relative
PATH=bin:/usr/bin ./bin/codex

# after -- absolute entries only
PATH="$PWD/bin:/usr/bin" "$PWD/bin/codex"

fn path_entries_are_absolute() -> bool {
    std::env::var_os("PATH")
        .map(|v| {
            v.to_string_lossy()
                .split(':')
                .all(|p| p.starts_with('/'))
        })
        .unwrap_or(false)
}

if !path_entries_are_absolute() {
    return Err("PATH contains relative entries; bwrap lookup would panic");
}

When it happens

Trigger: A $PATH containing a relative directory that resolves to bwrap, for example launching with PATH=bin:/usr/bin from a directory that holds bin/bwrap.

Common situations: Launch scripts exporting relative PATH entries; systemd units with malformed Environment=PATH values; embedded or portal environments that assemble PATH dynamically.

Related errors

• invalid legacy bubblewrap fd mount: {error}
• bubblewrap is unavailable: no system bwrap was found on PATH
• failed to open bundled bubblewrap {}: {err}
• failed to exec bundled bubblewrap {} via {fd_path}: {err}
• InvalidInput

AI-assisted analysis of openai/codex@339751715c (2026-08-25). Data as JSON: /api/errors/53665b8337daedf9. Report an issue: GitHub.