open-webui/desktop

Fork 0

mirror of https://github.com/open-webui/desktop.git synced 2026-11-05 01:27:46 +00:00

[PR #272] fix(linux): stop appending no-sandbox to fix blank webviews #238

New issue

Open

opened 2026-10-18 14:07:14 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-18 14:07:14 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/open-webui/desktop/pull/272
Author: @hirntot
Created: 9/18/2026
Status: 🔄 Open

Base: main ← Head: codex/fix-linux-webview-sandbox

📝 Commits (1)

5f55f00 fix(linux): stop appending no-sandbox during startup

📊 Changes

1 file changed (+4 additions, -3 deletions)

View changed files

📝 src/main/index.ts (+4 -3)

📄 Description

Description

On LMDE 7 (amd64), Open WebUI Desktop 0.0.20 displays its shell and connection sidebar but leaves the remote webview blank. Chromium repeatedly reports Creating shared memory in /tmp/.org.chromium.Chromium.… failed: No such process (3) and Unable to access(W_OK|X_OK) /tmp: No such process (3). A run with --disable-gpu still failed and the webview exited with code 133. Both /tmp and /dev/shm had mode 1777 and available space.

Remove the unconditional app.commandLine.appendSwitch('no-sandbox') from Linux startup and update the GPU-workaround comment. A separate copy of the installed 0.0.20 application with only this runtime line removed successfully displayed the remote login page without passing --no-sandbox; its log no longer contained the shared-memory errors. The initial test used a fresh, separate profile. Subsequently, the user installed the rebuilt DEB over the original installation and confirmed that the normal app now works with their existing profile, which had failed before the package update. The installed version (0.0.20+rlfix1) and patched application archive SHA-256 were independently verified. An explicit command-line --no-sandbox also worked around the original failure, but is not needed by the patched copy.

This leaves renderer sandbox selection to Electron and preserves the existing SwiftShader, shared-memory and GPU-sandbox workarounds. It does not enable sandboxing for every desktop window or claim to resolve all Linux rendering failures. The precise Chromium startup interaction has not been proven; the patch is based on the observed behavior above.

Validation

User-confirmed remote login display on LMDE 7, amd64, using the patched 0.0.20 runtime.
npm run build: passes, including TypeScript and Svelte checks (0 Svelte-check errors/warnings); Vite reports warnings in untouched components.
ESLint on src/main/index.ts: identical findings before and after the change (22 errors, 139 warnings); no new findings.
git diff --check: passes.
An unofficial amd64 DEB was rebuilt from the original 0.0.20 package. Its extracted application archive matches the successful test copy byte-for-byte; payload checksums and maintainer-script syntax pass. The rebuilt DEB was subsequently installed, and the user confirmed normal operation with the existing profile after the update.
AppImage, snap, Flatpak, other Linux distributions and local-server mode have not been tested. In particular, these packaging modes may need their own narrowly scoped sandbox handling.

Related to #178 and #157. Overlaps the removal of the unconditional native-package no-sandbox switch in #269, but intentionally avoids that PR's broader security changes. This is a small independently reviewable fix for the reproduced DEB failure.

Contributor License Agreement

By submitting this pull request, I confirm that I have read and fully agree to the Contributor License Agreement (CLA), and I am providing my contributions under its terms.

Note

Deleting the CLA section will lead to immediate closure of your PR and it will not be merged in.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/open-webui/desktop/pull/272 **Author:** [@hirntot](https://github.com/hirntot) **Created:** 9/18/2026 **Status:** 🔄 Open **Base:** `main` ← **Head:** `codex/fix-linux-webview-sandbox` --- ### 📝 Commits (1) - [`5f55f00`](https://github.com/open-webui/desktop/commit/5f55f00b584e2b9befa28fd0ce38e5cdba7c02bf) fix(linux): stop appending no-sandbox during startup ### 📊 Changes **1 file changed** (+4 additions, -3 deletions) <details> <summary>View changed files</summary> 📝 `src/main/index.ts` (+4 -3) </details> ### 📄 Description ## Description On LMDE 7 (amd64), Open WebUI Desktop 0.0.20 displays its shell and connection sidebar but leaves the remote webview blank. Chromium repeatedly reports `Creating shared memory in /tmp/.org.chromium.Chromium.… failed: No such process (3)` and `Unable to access(W_OK|X_OK) /tmp: No such process (3)`. A run with `--disable-gpu` still failed and the webview exited with code 133. Both `/tmp` and `/dev/shm` had mode 1777 and available space. Remove the unconditional `app.commandLine.appendSwitch('no-sandbox')` from Linux startup and update the GPU-workaround comment. A separate copy of the installed 0.0.20 application with only this runtime line removed successfully displayed the remote login page without passing `--no-sandbox`; its log no longer contained the shared-memory errors. The initial test used a fresh, separate profile. Subsequently, the user installed the rebuilt DEB over the original installation and confirmed that the normal app now works with their existing profile, which had failed before the package update. The installed version (0.0.20+rlfix1) and patched application archive SHA-256 were independently verified. An explicit command-line `--no-sandbox` also worked around the original failure, but is not needed by the patched copy. This leaves renderer sandbox selection to Electron and preserves the existing SwiftShader, shared-memory and GPU-sandbox workarounds. It does not enable sandboxing for every desktop window or claim to resolve all Linux rendering failures. The precise Chromium startup interaction has not been proven; the patch is based on the observed behavior above. ## Validation - User-confirmed remote login display on LMDE 7, amd64, using the patched 0.0.20 runtime. - `npm run build`: passes, including TypeScript and Svelte checks (0 Svelte-check errors/warnings); Vite reports warnings in untouched components. - ESLint on `src/main/index.ts`: identical findings before and after the change (22 errors, 139 warnings); no new findings. - `git diff --check`: passes. - An unofficial amd64 DEB was rebuilt from the original 0.0.20 package. Its extracted application archive matches the successful test copy byte-for-byte; payload checksums and maintainer-script syntax pass. The rebuilt DEB was subsequently installed, and the user confirmed normal operation with the existing profile after the update. - AppImage, snap, Flatpak, other Linux distributions and local-server mode have not been tested. In particular, these packaging modes may need their own narrowly scoped sandbox handling. ## Related Issues Related to #178 and #157. Overlaps the removal of the unconditional native-package `no-sandbox` switch in #269, but intentionally avoids that PR's broader security changes. This is a small independently reviewable fix for the reproduced DEB failure. --- ## Contributor License Agreement - [x] By submitting this pull request, I confirm that I have read and fully agree to the [Contributor License Agreement (CLA)](https://github.com/open-webui/desktop/blob/main/CONTRIBUTOR_LICENSE_AGREEMENT), and I am providing my contributions under its terms. > [!NOTE] > Deleting the CLA section will lead to immediate closure of your PR and it will not be merged in. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi added the

pull-request

label

2026-10-18 14:07:14 +00:00

No labels

help wanted

pull-request

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

open-webui/desktop#238

No description provided.

Rows
Columns