tauri-apps/tauri · critical

unable to generate cryptographically secure keys for Tauri \

Error message

unable to generate cryptographically secure keys for Tauri \"Isolation\" Pattern

What it means

Runtime panic in code generated by tauri-codegen for apps using the Tauri Isolation pattern. Keys::new() builds the AES-GCM encryption key by calling getrandom::fill() on the OS CSPRNG (crates/tauri-utils/src/pattern/isolation.rs); if the system randomness source is unavailable, .expect("unable to generate cryptographically secure keys ...") panics while the app Context is created at startup.

Source

Thrown at crates/tauri-codegen/src/context.rs:388

        // we check if `__TAURI_ISOLATION_HOOK__` exists in the isolation code
        // before modifying the files since we inject our own `__TAURI_ISOLATION_HOOK__` reference in HTML files
        if String::from_utf8_lossy(input).contains("__TAURI_ISOLATION_HOOK__") {
          sets_isolation_hook = true;
        }
        map_isolation(key, path, input, csp_hashes)
      })?;

      if !sets_isolation_hook {
        panic!("The isolation application does not contain a file setting the `window.__TAURI_ISOLATION_HOOK__` value.");
      }

      let schema = options.isolation_schema;

      quote!(#root::Pattern::Isolation {
        assets: ::std::sync::Arc::new(#assets),
        schema: #schema.into(),
        key: #key.into(),
        crypto_keys: std::boxed::Box::new(::tauri::utils::pattern::isolation::Keys::new().expect("unable to generate cryptographically secure keys for Tauri \"Isolation\" Pattern")),
      })
    }
  };

  let acl_file_path = out_dir.join(ACL_MANIFESTS_FILE_NAME);
  let acl: BTreeMap<String, Manifest> = if acl_file_path.exists() {
    let acl_file =
      std::fs::read_to_string(acl_file_path).expect("failed to read plugin manifest map");
    serde_json::from_str(&acl_file).expect("failed to parse plugin manifest map")
  } else {
    Default::default()
  };

  let capabilities_file_path = out_dir.join(CAPABILITIES_FILE_NAME);
  let capabilities_from_files = if capabilities_file_path.exists() {
    let capabilities_json =
      std::fs::read_to_string(&capabilities_file_path).expect("failed to read capabilities");
    serde_json::from_str(&capabilities_json).expect("failed to parse capabilities")

View on GitHub (pinned to 52e4b6e71d)

Solutions

1. Confirm the OS CSPRNG is reachable in the target environment: `ls -l /dev/urandom` and `head -c 16 /dev/urandom | xxd`
2. Allow the getrandom(2) syscall and reads of /dev/urandom in the container's seccomp / AppArmor / sandbox profile
3. Upgrade the container runtime or kernel — very old kernels or outdated runc/seccomp versions lack getrandom support
4. If the environment cannot provide entropy, switch the app off the Isolation pattern (default Brownfield pattern) in tauri.conf.json

Example fix

// tauri.conf.json — before
"security": { "pattern": { "use": "Isolation" } }

// after (environment cannot supply entropy)
"security": { "csp": "default-src 'self'" } // drop Isolation

// probe the OS CSPRNG in the exact deployment environment before enabling Isolation
fn os_rng_ok() -> bool {
    let mut buf = [0u8; 1];
    getrandom::fill(&mut buf).is_ok()
}

When it happens

Trigger: Starting an app configured with `app > security > pattern > use: "Isolation"` on a system where getrandom fails: /dev/urandom missing or unreadable, the getrandom(2) syscall blocked by a seccomp/AppArmor profile, a container runtime or sandbox denying it, or a kernel/VM with no usable entropy source.

Common situations: Hardened Docker/gVisor/Kata containers with syscall allowlists written before getrandom was common; custom minimal VM images without /dev/urandom; restricted CI executors; seccomp profiles that omit getrandom(2).

Related errors

• unable to create thread with 8MiB stack
• asset protocol path "{path}" is not valid: {e}
• File does not exist at path: {path}
• default_runtime only supports `struct`, `enum`, `type`, or `
• Could not read binary file.

AI-assisted analysis of tauri-apps/tauri@52e4b6e71d (2026-08-20). Data as JSON: /api/errors/f7d41f609184b0a8. Report an issue: GitHub.