fix: AppImage required --no-sandbox

Not tested enough but works on my machine
2026-08-14 03:51:23 +02:00
parent e45e165a6f
commit 718f4a99f0
8 changed files with 293 additions and 15 deletions
@@ -78,4 +78,5 @@ Tags help grepping: `rg '\\[attachments\\]' agents-docs/LESSONS-INDEX.md`
 - Record whether the user is in a call before calling zero RTP a failure — `[testing] [voice] [verification]`
 - Assert continuity when the state you broke repairs itself — `[testing] [voice] [verification]`
 - Missing gossip about a peer is not evidence it left voice — `[voice] [webrtc] [realtime]`
+- `app.commandLine.appendSwitch` cannot disable the Chromium sandbox — `[electron] [packaging] [linux]`

@@ -25,6 +25,13 @@ Durable rules for AI agents working on this project.

 ## Lessons

+### `app.commandLine.appendSwitch` cannot disable the Chromium sandbox [electron] [packaging] [linux]
+
+- **Trigger:** a packaged Linux build shows only the window background and spams `Unable to access(W_OK|X_OK) /tmp` / `Creating shared memory in /tmp/... failed`, while the same build works when the user types `--no-sandbox`.
+- **Rule:** sandbox and Ozone switches only count when they are on the real command line at process start. Never pair a runtime `appendSwitch('no-sandbox')` with `appendSwitch('disable-dev-shm-usage')` — the first is a no-op because the zygote has already forked, the second takes effect and redirects shared memory into `/tmp`, which the still-active sandbox denies forever.
+- **Why:** electron-builder's AppImage `AppRun` is a bash script that execs `$APPDIR/<executableName> "$@"` and ignores the bundled desktop entry, so `linux.executableArgs` never reaches a double-click or terminal launch. Only an installed `.desktop` file passes those arguments.
+- **Example:** `electron/app/linux-launcher.rules.ts` generates the launcher that `tools/after-pack.js` installs in place of the real binary (renamed `<name>-bin`); it enables `--no-sandbox` only where unprivileged user namespaces are denied (Ubuntu 24.04+ AppArmor, hardened kernels), since an AppImage payload is mounted `nosuid` and cannot fall back to the SUID helper.
+
 ### A hold-on-unknown rule needs every attach site behind it [voice] [webrtc] [realtime]

 - **Trigger:** replacing a strict media gate with "hold an established path when nothing confirms the peer", while some fast path still attaches the track without asking the rule.