[hirntot]

Description

On LMDE 7 (amd64), Open WebUI Desktop 0.0.20 displays its shell and connection sidebar but leaves the remote webview blank. Chromium repeatedly reports Creating shared memory in /tmp/.org.chromium.Chromium.… failed: No such process (3) and Unable to access(W_OK|X_OK) /tmp: No such process (3). A run with --disable-gpu still failed and the webview exited with code 133. Both /tmp and /dev/shm had mode 1777 and available space.

Remove the unconditional app.commandLine.appendSwitch('no-sandbox') from Linux startup and update the GPU-workaround comment. A separate copy of the installed 0.0.20 application with only this runtime line removed successfully displayed the remote login page without passing --no-sandbox; its log no longer contained the shared-memory errors. The initial test used a fresh, separate profile. Subsequently, the user installed the rebuilt DEB over the original installation and confirmed that the normal app now works with their existing profile, which had failed before the package update. The installed version (0.0.20+rlfix1) and patched application archive SHA-256 were independently verified. An explicit command-line --no-sandbox also worked around the original failure, but is not needed by the patched copy.

This leaves renderer sandbox selection to Electron and preserves the existing SwiftShader, shared-memory and GPU-sandbox workarounds. It does not enable sandboxing for every desktop window or claim to resolve all Linux rendering failures. The precise Chromium startup interaction has not been proven; the patch is based on the observed behavior above.

Validation

• User-confirmed remote login display on LMDE 7, amd64, using the patched 0.0.20 runtime.
• npm run build: passes, including TypeScript and Svelte checks (0 Svelte-check errors/warnings); Vite reports warnings in untouched components.
• ESLint on src/main/index.ts: identical findings before and after the change (22 errors, 139 warnings); no new findings.
• git diff --check: passes.
• An unofficial amd64 DEB was rebuilt from the original 0.0.20 package. Its extracted application archive matches the successful test copy byte-for-byte; payload checksums and maintainer-script syntax pass. The rebuilt DEB was subsequently installed, and the user confirmed normal operation with the existing profile after the update.
• AppImage, snap, Flatpak, other Linux distributions and local-server mode have not been tested. In particular, these packaging modes may need their own narrowly scoped sandbox handling.

Related Issues

Related to #178 and #157. Overlaps the removal of the unconditional native-package no-sandbox switch in #269, but intentionally avoids that PR's broader security changes. This is a small independently reviewable fix for the reproduced DEB failure.

---

Contributor License Agreement

• By submitting this pull request, I confirm that I have read and fully agree to the Contributor License Agreement (CLA), and I am providing my contributions under its terms.

Note

Deleting the CLA section will lead to immediate closure of your PR and it will not be merged in.