tauri-apps/tauri · error

failed to get random bytes

Error message

failed to get random bytes

What it means

When the app defines a CSP, Tauri generates per-request nonces with getrandom::u64() while rewriting served HTML. The expect fires when the OS entropy source fails: the getrandom syscall / /dev/urandom is unavailable, e.g. under restrictive seccomp or gVisor sandboxes, a broken /dev/urandom, or a kernel too old for getrandom without the urandom fallback.

Source

Thrown at crates/tauri/src/manager/mod.rs:135

  for (start, part) in original.match_indices(pattern) {
    result.push_str(unsafe { original.get_unchecked(last_end..start) });
    result.push_str(&replacement());
    last_end = start + part.len();
  }
  result.push_str(unsafe { original.get_unchecked(last_end..original.len()) });
  result
}

fn replace_csp_nonce(
  asset: &mut String,
  token: &str,
  csp: &mut HashMap<String, CspDirectiveSources>,
  directive: &str,
  hashes: Vec<String>,
) {
  let mut nonces = Vec::new();
  *asset = replace_with_callback(asset, token, || {
    let nonce = getrandom::u64().expect("failed to get random bytes");
    nonces.push(nonce);
    nonce.to_string()
  });

  if !(nonces.is_empty() && hashes.is_empty()) {
    let nonce_sources = nonces
      .into_iter()
      .map(|n| format!("'nonce-{n}'"))
      .collect::<Vec<String>>();
    let sources = csp.entry(directive.into()).or_default();
    let self_source = "'self'".to_string();
    if !sources.contains(&self_source) {
      sources.push(self_source);
    }
    sources.extend(nonce_sources);
    sources.extend(hashes);
  }
}

View on GitHub (pinned to 52e4b6e71d)

Solutions

1. Allow the getrandom(2) syscall (and /dev/urandom access) in the sandbox/seccomp profile.
2. Use a standard base image or a newer kernel.
3. Nothing app-level fixes it: OS entropy access is required for CSP nonces.

// probe entropy at startup to fail fast with a clear message
let mut probe = [0u8; 8];
if getrandom::fill(&mut probe).is_err() {
    return Err("OS entropy unavailable - allow getrandom(2)/dev/urandom in the sandbox".into());
}

When it happens

Trigger: Running an app with CSP nonce injection inside a container/sandbox that blocks the getrandom(2) syscall and access to /dev/urandom, or on a minimal embedded image lacking them.

Common situations: Over-restricted Docker/seccomp profiles; gVisor runtimes; custom minimal Linux images. Virtually never on normal desktop OSes.

Related errors

• failed to get random bytes
• failed to get random bytes
• The isolation application does not contain a file setting th
• Library from {} does not include required runtime symbols. T
• state not managed for field `{}` on command `{}`. You must c

AI-assisted analysis of tauri-apps/tauri@52e4b6e71d (2026-08-20). Data as JSON: /api/errors/795ce79b8f5ab946. Report an issue: GitHub.