mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-15 14:16:14 -06:00
[GH-ISSUE #7116] vscode: no window shows up on wayland (hyprland/gentoo) #3490
Labels
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/firejail#3490
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @nuclear06 on GitHub (Mar 27, 2026).
Original GitHub issue: https://github.com/netblue30/firejail/issues/7116
Description
I am using Gentoo with Hyprland and an NVIDIA GPU. VSCode gets stuck at startup and no window is shown when using the default code profile under Wayland.
Steps to Reproduce
I can launch VSCode successfully using XWayland with the following command:
firejail code --ozone-platform=x11However, the following command gets stuck at startup and no window appears:
firejail code --ozone-platform=wayland --enable-features=UseOzonePlatformIf I bypass the device isolation by adding ignore private-dev, VSCode opens normally under Wayland:
firejail --ignore=private-dev code --ozone-platform=wayland --enable-features=UseOzonePlatformFurther debugging shows that the issue is specifically caused by the blocking of /dev/nvidiactl. If I ignore private-dev but manually blacklist /dev/nvidiactl, VSCode fails to open again:
firejail --ignore=private-dev --blacklist=/dev/nvidiactl code --ozone-platform=wayland --enable-features=UseOzonePlatformExpected behavior
VSCode should open normally
Behavior without a profile
vscode opens normally
Environment
Name/version/arch of the Linux kernel (
uname -srm):Linux 6.18.18-gentoo-dist x86_64
Name/version of the Linux distribution (e.g. "Ubuntu 20.04" or "Arch Linux"):
Gentoo
Name/version of the relevant program(s)/package(s) (e.g. "firefox 134.0-1,
mesa 1:24.3.3-2"):
vscode 1.112.0
Version of Firejail (
firejail --version):firejail version 0.9.76
Compile time support:
- always force nonewprivs support is disabled
- AppArmor support is disabled
- AppImage support is enabled
- chroot support is enabled
- D-BUS proxy support is enabled
- file transfer support is enabled
- IDS support is disabled
- Landlock support is enabled
- networking support is enabled
- output logging is enabled
- overlayfs support is disabled
- private-home support is enabled
- private-lib support is disabled
- private-cache and tmpfs as user enabled
- sandbox check is enabled
- SELinux support is disabled
- user namespace support is enabled
- X11 sandboxing support is enabled
was compiled (
git rev-parse HEAD):Checklist
firejail /usr/bin/vlcinstead offirejail vlc; seehttps://github.com/netblue30/firejail/issues/2877)/usr/bin/vlc) "fixes" it).https://github.com/netblue30/firejail/issues/1139)browser-allow-drm yes/browser-disable-u2f noinfirejail.configto allow DRM/U2F in browsers.--profile=PROFILENAMEto set the right profile. (Only relevant for AppImages)Log
Output of
LC_ALL=C firejail /usr/bin/codeOutput of
% LC_ALL=C firejail --debug /usr/bin/code@kmk3 commented on GitHub (Mar 27, 2026):
Note that we do not maintain that version of firejail:
Versions other than the latest usually have outdated profiles and may contain
bugs and security vulnerabilities that were fixed in later versions.
See also:
What happens with the latest released version?
@kmk3 commented on GitHub (Mar 27, 2026):
That is not the case.
What changes when using
/usr/bin/codein all commands?Does it work with sway or another compositor?
/dev/nvidiactlshould appear in the sandbox withprivate-devunlessno3dis used.
Does it work with the following?
What is the output of the following?
@nuclear06 commented on GitHub (Mar 27, 2026):
I upgraded to
0.9.80, but the behavior remains exactly the same.I tried the following command and it works:
This still does not work:
no it also gets stuck
Additionally, I can confirm that
/dev/nvidiactldoes show up when using thecodeprofile. I don't know how to explain my previous test results 😐:@nuclear06 commented on GitHub (Mar 27, 2026):
I tried sway and it works normally, so does this relate to Hyprland?
@kmk3 commented on GitHub (Mar 27, 2026):
In here gfx devices seem to be owned by
root:video, which is unusual.Usually gfx devices are owned by
root:renderand webcam devices byroot:video.These groups are used when implementing
no3dandnovideo, respectively.Does it work with the following?
Using
root:videoinstead ofroot:rendercould be a quirk of gentoo (such aspatches in udev rules) or hyprland.
What is the output of the following?
What is the output of the following on hyprland and on sway?
@nuclear06 commented on GitHub (Mar 27, 2026):
Sadly no
It might be caused by the following rules:
On Hyprland:
On Sway:
@nuclear06 commented on GitHub (Mar 30, 2026):
After further testing, I found that the issue seems to be caused by the lack of
/dev/char.firejail --profile=code ls /dev/charStuck:
firejail --ignore=private-dev --blacklist=/dev/char --profile=code /usr/bin/codeNot stuck:
firejail --noprofile --blacklist=/dev/char /usr/bin/codeDo you have any ideas?