failed to read synthetic bubblewrap mount marker directory {

Error message

failed to read synthetic bubblewrap mount marker directory {}: {err}

What it means

synthetic_mount_marker_dir_has_active_process_matching (linux_run_main.rs:1050) enumerates the marker directory to map marker filenames to PIDs, reap stale markers of dead PIDs, and decide whether the target still has active owners. read_dir failing with NotFound returns no-owners; every other errno panics: EACCES when directory permissions changed, ENOTDIR when a regular file exists where the hash-named directory should be (foreign file in the registry), or an I/O error.

Source

Thrown at codex-rs/linux-sandbox/src/linux_run_main.rs:1057

                "failed to read synthetic bubblewrap mount marker {}: {err}",
                path.display()
            ),
        }
    })
}

fn synthetic_mount_marker_dir_has_active_process(marker_dir: &Path) -> bool {
    synthetic_mount_marker_dir_has_active_process_matching(marker_dir, |_| true)
}

fn synthetic_mount_marker_dir_has_active_process_matching(
    marker_dir: &Path,
    matches_marker: impl Fn(&Path) -> bool,
) -> bool {
    let entries = match fs::read_dir(marker_dir) {
        Ok(entries) => entries,
        Err(err) if err.kind() == std::io::ErrorKind::NotFound => return false,
        Err(err) => panic!(
            "failed to read synthetic bubblewrap mount marker directory {}: {err}",
            marker_dir.display()
        ),
    };
    for entry in entries {
        let entry = entry.unwrap_or_else(|err| {
            panic!(
                "failed to read synthetic bubblewrap mount marker in {}: {err}",
                marker_dir.display()
            )
        });
        let path = entry.path();
        let Some(pid) = path
            .file_name()
            .and_then(|name| name.to_str())
            .and_then(|name| name.parse::<libc::pid_t>().ok())
        else {
            continue;

View on GitHub (pinned to 339751715c)

Solutions

Inspect the printed path: if it is a regular file, remove it so the launcher can recreate the directory.
Restore directory permissions (chmod u+rx) on the marker dir.
With sessions stopped, reset the entire registry root.
Find and stop whatever writes foreign files into the registry.

Example fix

# before: a plain file squats on the hash-named marker directory
file /tmp/codex-bwrap-synthetic-mount-targets-1000/0123abcd4567
# ASCII text

# after: remove the impostor (registry resets cleanly on next run)
rm /tmp/codex-bwrap-synthetic-mount-targets-1000/0123abcd4567

Defensive patterns

Strategy: validation

Validate before calling

fn registry_layout_ok() -> bool {
    let root = std::env::temp_dir().join(format!(
        "codex-bwrap-synthetic-mount-targets-{}",
        unsafe { libc::geteuid() }
    ));
    match std::fs::read_dir(&root) {
        Ok(entries) => entries.flatten().all(|e| e.path().is_dir() || e.file_name() == "lock"),
        Err(_) => true,
    }
}

Prevention

Forbid foreign processes from creating files inside the registry root.
Never place files with 16-hex-character names in the registry.
Reset the registry with sessions stopped instead of mutating it by hand.

When it happens

Trigger: Any registration or cleanup of synthetic or protected targets whose hash-named registry entry exists as a file instead of a directory, has tightened permissions, or sits on failing storage.

Common situations: External tooling or debugging creating files inside the registry root; hand-placed artifacts; tmp cleaners leaving partial state; degraded disks.

Related errors

AI-assisted analysis of openai/codex@339751715c (2026-08-25). Data as JSON: /api/errors/044f3e0673f46d32. Report an issue: GitHub.