zed-industries/zed · error · anyhow::Error

no usable `bwrap` binary was found on PATH

Error message

no usable `bwrap` binary was found on PATH

What it means

Raised in wrap_invocation when locating the bubblewrap executable: no non-setuid `bwrap` usable by Zed was found on PATH. Zed refuses setuid-root bwrap binaries, so if the only candidate is setuid (or none exists) sandboxing fails closed with this error before the command runs.

Source

Thrown at crates/sandbox/src/linux_bubblewrap.rs:633

    // inodes were pinned at policy-construction time, so a missing path here
    // means the location vanished since capture. Never create it with the
    // agent's ambient permissions — recreating from path text would bind a
    // fresh, unapproved object in place of the pinned one (and historically
    // this materialized bogus paths, e.g. a granted *file* path springing into
    // existence as a directory). Running anyway would give the command silently
    // less access than it believes it has — so fail closed with a clear error.
    if !permissions.allow_fs_write {
        for directory in writable_dirs {
            if !directory.exists() {
                bail!(
                    "failed to provide writable sandbox path {}: it no longer exists",
                    directory.display()
                );
            }
        }
    }

    let bwrap = resolve_bwrap().map_err(|status| anyhow!(status.describe()))?;
    let proxy_socket_sandbox_path = match permissions.network {
        NetworkAccess::LocalhostPort(_) => Some(unique_proxy_socket_sandbox_path()),
        NetworkAccess::None | NetworkAccess::All => None,
    };
    let mut bwrap_args = build_bwrap_args_with_sandbox_paths(
        writable_dirs,
        protected_paths,
        permissions,
        cwd,
        proxy_socket_path,
        proxy_socket_sandbox_path.as_deref(),
        validation_socket.map(|socket| socket.host_socket_path),
        validation_socket.map(|socket| socket.sandbox_socket_path),
    );
    bwrap_args.push("--".to_string());

    let bridge = match permissions.network {
        NetworkAccess::LocalhostPort(port) => {

View on GitHub (pinned to 5a9b9558db)

Solutions

1. Install a non-setuid bubblewrap package (e.g. bubblewrap from distro repos)
2. Ensure unprivileged user namespaces are enabled
3. Disable the sandbox only if acceptable

When it happens

Trigger: Thrown at crates/sandbox/src/linux_bubblewrap.rs:633 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of zed-industries/zed@5a9b9558db (2026-08-20). Data as JSON: /api/errors/2fd6685cab9364ff. Report an issue: GitHub.