bwrap launches abort with `Can't mount on symlink destination /etc/ssl/certs` on Fedora

[ErikAouizerate]

Summary

On distributions where a CA directory is a symlink — the Fedora/RHEL family has /etc/ssl/certs -> /etc/pki/tls/certs — every bwrap launch aborts before the workload starts.

Environment

• devsandbox 0.22.0 (00f175c) and main, both affected
• Fedora 43, kernel 7.1.12-100.fc43.x86_64
• bubblewrap 0.12.0 (system) and 0.13.0 (embedded) both reproduce it
• No zsh/oh-my-zsh needed

Steps to reproduce

ls -l /etc/ssl/certs
# lrwxrwxrwx ... /etc/ssl/certs -> /etc/pki/tls/certs

cd ~/any/project
devsandbox true      # any command reproduces it

Actual

bwrap: Can't mount on symlink destination /etc/ssl/certs

Exit code 1, the workload never runs.

Minimal bwrap repro (without devsandbox)

bwrap --ro-bind / / --ro-bind /etc/ssl/certs /etc/ssl/certs /bin/true
# bwrap: Can't mount on symlink destination /etc/ssl/certs

This shows the failure is bubblewrap refusing a symlink mount destination, not a devsandbox-specific mount.

Expected

The launch starts, and certificates stay readable at /etc/ssl/certs.

Root cause

• AddNetworkBindings (internal/sandbox/builder.go) binds /etc/ssl whole, so /etc/ssl/certs is the host symlink inside the namespace.
• AddCABindings then emits --ro-bind /etc/ssl/certs /etc/ssl/certs, and bubblewrap refuses a destination whose final component is a symlink.

This is the same class of problem the code already handles for custom mount rules — see the resolveMountRulePath comment: "a destination whose final component is not a symlink, which is what bubblewrap 0.12.0 rejects".

Docker/krun are unaffected: they do not bind /etc/ssl/certs (only the MITM certificate under /etc/ssl/certs when proxy mode is on).

Suggested fix

In AddCABindings, Lstat each path. When it is a symlink, bind the resolved target (reusing resolveMountRulePath) instead of the link, and skip a target already emitted by an earlier entry. The symlink itself stays visible through the /etc/ssl bind and resolves inside the sandbox, and the resolved mount is what keeps it from dangling. On Fedora the target /etc/pki/tls/certs is already in the CA list, so the symlinked entry becomes a no-op after dedup.

Tests

• TestAddCABindings_SymlinkedPathBindsResolvedTarget — a symlinked CA path mounts its resolved target.
• TestAddCABindings_TargetListedOnce — the target and its symlink in the same list emit one mount.
• TestAddCABindings_MissingPathIsSkipped — a missing CA directory stays unmounted.

Additional context

Verified end to end on Fedora 43: the launch succeeds and inside the sandbox

$ devsandbox sh -c 'readlink /etc/ssl/certs; ls /etc/ssl/certs | wc -l'
/etc/pki/tls/certs
245

[zekker6]

#183 Was merged and will be available as a part of the next release.