tauri-apps/tauri · error

failed to get random bytes

Error message

failed to get random bytes

What it means

The asset protocol builds multipart responses (e.g. range requests) and generates a random boundary with getrandom::fill(). The expect fires when the OS entropy source fails: getrandom(2)/ /dev/urandom blocked by a sandbox, broken device node, or unsupported kernel.

Source

Thrown at crates/tauri/src/protocol/asset.rs:230

    // avoid reading the file if we already read it
    // as part of mime type detection
    let buf = if let Some(b) = read_bytes {
      b
    } else {
      let mut local_buf = Vec::with_capacity(len as usize);
      file.read_to_end(&mut local_buf)?;
      local_buf
    };
    resp = resp.header(CONTENT_LENGTH, len);
    resp.body(buf.into())
  };

  response.map_err(Into::into)
}

fn random_boundary() -> String {
  let mut x = [0_u8; 30];
  getrandom::fill(&mut x).expect("failed to get random bytes");
  (x[..])
    .iter()
    .map(|&x| format!("{x:x}"))
    .fold(String::new(), |mut a, x| {
      a.push_str(x.as_str());
      a
    })
}

View on GitHub (pinned to 52e4b6e71d)

Solutions

1. Permit getrandom(2) and /dev/urandom in the container security profile.
2. Use a standard base image / newer kernel.
3. Disable the asset protocol for that deployment if it is not needed.

let mut probe = [0u8; 8];
if getrandom::fill(&mut probe).is_err() {
    return Err("OS entropy unavailable for asset protocol boundaries".into());
}

When it happens

Trigger: Serving assets over the custom asset protocol (asset: URL / app.asset_protocol enabled) inside a container with a seccomp profile that denies the getrandom syscall or /dev/urandom.

Common situations: Hardened Docker/seccomp or gVisor environments; minimal embedded images. Effectively unreachable on standard desktop platforms.

Related errors

• failed to get random bytes
• failed to get random bytes
• asset protocol path "{path}" is not valid: {e}
• asset protocol not configured to allow the path: {path}
• File does not exist at path: {path}

AI-assisted analysis of tauri-apps/tauri@52e4b6e71d (2026-08-20). Data as JSON: /api/errors/76646b6a5b059932. Report an issue: GitHub.