tauri-apps/tauri · error

failed to get random bytes

Error message

failed to get random bytes

What it means

ResourceTable assigns each resource a random 32-bit id (rid) via getrandom::fill() when a resource is added. The expect fires when the OS entropy source fails: getrandom(2)/ /dev/urandom unavailable in the execution environment.

Source

Thrown at crates/tauri/src/resources/mod.rs:83

/// Map-like data structure storing Tauri's resources (equivalent to file
/// descriptors).
///
/// Provides basic methods for element access. A resource can be of any type.
/// Different types of resources can be stored in the same map, and provided
/// with a name for description.
///
/// Each resource is identified through a _resource ID (rid)_, which acts as
/// the key in the map.
#[derive(Default)]
pub struct ResourceTable {
  index: BTreeMap<ResourceId, Arc<dyn Resource>>,
}

impl ResourceTable {
  fn new_random_rid() -> u32 {
    let mut bytes = [0_u8; 4];
    getrandom::fill(&mut bytes).expect("failed to get random bytes");
    u32::from_ne_bytes(bytes)
  }

  /// Inserts resource into the resource table, which takes ownership of it.
  ///
  /// The resource type is erased at runtime and must be statically known
  /// when retrieving it through `get()`.
  ///
  /// Returns a unique resource ID, which acts as a key for this resource.
  pub fn add<T: Resource>(&mut self, resource: T) -> ResourceId {
    self.add_arc(Arc::new(resource))
  }

  /// Inserts a `Arc`-wrapped resource into the resource table.
  ///
  /// The resource type is erased at runtime and must be statically known
  /// when retrieving it through `get()`.
  ///

View on GitHub (pinned to 52e4b6e71d)

Solutions

1. Allow the getrandom(2) syscall and /dev/urandom in the sandbox profile.
2. Use a standard base image or newer kernel.
3. Entropy access is mandatory for ResourceTable ids; no app-level workaround.

let mut probe = [0u8; 4];
if getrandom::fill(&mut probe).is_err() {
    return Err("OS entropy unavailable - resource ids cannot be generated".into());
}

When it happens

Trigger: Adding any resource to the resource table (e.g. fs/http plugin resources) in a sandbox that blocks the getrandom syscall or /dev/urandom, or on minimal embedded systems.

Common situations: Restrictive seccomp/gVisor container profiles; custom minimal Linux images. Essentially never on normal desktop OSes.

Related errors

• failed to get random bytes
• failed to get random bytes
• failed to read resource file name
• failed to read resource folder name
• cannot use both `resources` and `resources_map`

AI-assisted analysis of tauri-apps/tauri@52e4b6e71d (2026-08-20). Data as JSON: /api/errors/c3d11c1966d62788. Report an issue: GitHub.