[BUG] AppImage and .dev not opening. "No usable sandbox"

[prodrevgit]

Code of conduct

• I have read and agree to adhere to the Code of Conduct

Self-training on how to write a bug report

• I have learned how to write a bug report

Is there an existing issue for this?

• I have searched the existing issues

Current Behavior

Opening the AppImage brings no response when double-clicking. If I try to open in the terminal with:

SESSION_SSE42_OVERRIDE=1./session-desktop-linux-x86_64-1.17.5.AppImage

I get this message:

SESSION_SSE42_OVERRIDE=1 ./session-desktop-linux-x86_64-1.17.5.AppImage
[40109:1217/103436.638360:FATAL:zygote_host_impl_linux.cc(128)] No usable sandbox! If you are running on Ubuntu 23.10+ or another Linux distro that has disabled unprivileged user namespaces with AppArmor, see https://chromium.googlesource.com/chromium/src/+/main/docs/security/apparmor-userns-restrictions.md. Otherwise see https://chromium.googlesource.com/chromium/src/+/main/docs/linux/suid_sandbox_development.md for more information on developing with the (older) SUID sandbox. If you want to live dangerously and need an immediate workaround, you can try using --no-sandbox.
Trace/breakpoint trap (core dumped)

So I do:

SESSION_SSE42_OVERRIDE=1 ./session-desktop-linux-x86_64-1.17.5.AppImage --no-sandbox

And that opens it fine.

When I try to install with the .deb, I get an error that says there are missing dependencies. I'm assuming the missing dependency is the sandbox.

Installing the Snap package is fine.

ChatGPT says the error is related to the sandbox in Chromium (which Session is built on).

Expected Behavior

AppIimage should open upon double clicking, no terminal needed.

.deb should install without error about missing dependencies.

Steps To Reproduce

Ubuntu 23.10+
Run AppImage - see nothing happen
Run .deb installer - see error message about missing dependencies

Desktop Version

1.17.4

Anything else?

Device: Desktop Linux

OS: Kubuntu 24.04 LTS

CPU: 4 × Intel® Core™2 Quad CPU Q9550 @ 2.83GHz

Graphics: Mesa Intel® G45/G43

[DeusExIsTheGame]

Hi,
I have the same problem. I'm using Kubuntu 25.10; opening the AppImage brings no response when double-clicking for me too.

[Bilb]

@prodrevgit

When I try to install with the .deb, I get an error that says there are missing dependencies
Which ones are missing?
does a sudo apt install -f install them?

[Bilb]

@DeusExIsTheGame
Do you have the same issue with the .deb?
You'd be better off using the .deb on kubuntu. At least you'd get updates via your package manager

[DeusExIsTheGame]

@Bilb I'm sorry, I missed the .deb version... I'm pretty new in Linux. The .deb works perfectly, thanks!

[ddz95]

@prodrevgit, @DeusExIsTheGame, @Bilb, and everyone else reading this post.

I'd like to write a few words about this issue for people that are new to Linux or are just curious what's going on behind the scenes.

This error is not Session-specific. As mentioned earlier, the Chromium/Electron sandbox is failing on Ubuntu 23.10+ / 24.04 due to AppArmor restrictions on unprivileged user namespaces. The desktop version of Session is built on Electron and is using Chromium's sandbox.

On Ubuntu 23.10+ there's a security hardening feature (AppArmor “userns restrictions”) that can block unprivileged user namespaces, and Chromium then exits with an error like this:

FATAL:zygote_host_impl_linux.cc(...) No usable sandbox! ... apparmor-userns-restrictions

Chromium has official documentation explaining this exact situation and the available options (global disable vs. per-app AppArmor profile).

You can do a quick test to confirm if the issue is affecting you.

Check these:

/proc/sys/kernel/apparmor_restrict_unprivileged_userns
/proc/sys/kernel/unprivileged_userns_clone
aa-status (AppArmor enabled)

If kernel.apparmor_restrict_unprivileged_userns=1, Electron/Chromium apps downloaded from the internet (AppImage, extracted builds, etc.) may fail with a “No usable sandbox” error message.

There are some workarounds; however, they aren't great.

• For non-expert users: use the Snap.
• You can change system-wide configuration, which is less safe and not recommended. Set: kernel.apparmor_restrict_unprivileged_userns=0 and ensure kernel.unprivileged_userns_clone=1
• Use the --no-sandbox environment variable.

--no-sandbox works as a workaround, but it disables Chromium sandboxing, which is a meaningful security downgrade—not ideal for a secure messaging application like Session.

A safer workaround is to create an AppArmor profile that allows userns for the Session binary or AppImage. Chromium provides an example profile for dev Chrome builds using the userns rule (look here). Creation of an AppArmor profile for AppImage is a bit harder because it mounts to a random /tmp/.mount_* path. Targeting the AppImage location itself is the recommended approach.

On Ubuntu 23.10+, AppImages of Electron apps commonly fail unless one of the following is true:

• Unprivileged user namespaces are allowed system-wide.
• A custom AppArmor profile explicitly allows userns for the app.
• Chromium is launched with --no-sandbox (which is not the recommended way to go).

Double-clicking the AppImage often “does nothing” because the process exits immediately after the sandbox fatal error, which is only visible when launched from a terminal.

I'd like to add a few words about Snap as well. It sometimes works and sometimes doesn't. Why is that?

Snap can work as a workaround because it runs the application inside Snap’s own confinement model with predefined AppArmor profiles. This bypasses the Ubuntu 23.10+ apparmor_restrict_unprivileged_userns issue that affects:

• AppImage.
• Extracted tarballs.
• Locally installed Electron binaries.

However, Snap is not always suitable because it imposes filesystem restrictions. It can break advanced setups, and some upstream projects explicitly discourage it (Obsidian is a good example). I would treat Snap as a pragmatic workaround, not a recommended solution.

About .deb missing dependencies it's not a sandbox failure. The .deb missing dependencies error is not directly related to the Chromium “No usable sandbox” error message. Missing dependencies (libfuse, libnss, libasound, etc.) are a packaging or dynamic linking problem. “No usable sandbox” is a kernel or AppArmor or user namespaces policy issue. They can both appear on the same system, but fixing one does not automatically fix the other. In this case, the sandbox error can still occur even if all .deb dependencies are installed correctly.

Thanks.

With regards, Dave 💪