bwrap sandbox broken on usrmerge Linux (WSL2/Ubuntu): missing /bin /lib /lib64 compat symlinks → every command fails with execvp: No such file or directory

Environment

• WSL2, Ubuntu 22.04 (Jammy)
• bubblewrap 0.6.1
• usrmerge layout (/bin, /lib, /lib64 are symlinks into /usr)

Symptom

With sandbox enabled, every Bash command fails:

bwrap: execvp /bin/bash: No such file or directory

Setting SHELL=/usr/bin/bash changes the target to /usr/bin/bash but it still fails — confirming $SHELL is honored, but the real problem is deeper.

Root cause

The sandbox binds /usr into the namespace but does NOT recreate the usrmerge compatibility symlinks /bin -> usr/bin, /lib -> usr/lib, /lib64 -> usr/lib64. Dynamically-linked binaries request their ELF interpreter at /lib64/ld-linux-x86-64.so.2, which doesn't resolve in-sandbox. execvp returns ENOENT (reported as "No such file") for the loader, not the executable.

Proof (bwrap 0.6.1, same machine)

# fails - mimics current behavior
bwrap --ro-bind /usr /usr --proc /proc --dev /dev /usr/bin/bash -c 'echo OK'
  -> bwrap: execvp /usr/bin/bash: No such file or directory

# works - add usrmerge symlinks
bwrap --ro-bind /usr /usr --symlink usr/lib64 /lib64 --symlink usr/lib /lib \
      --proc /proc --dev /dev /usr/bin/bash -c 'echo OK-withlibs'
  -> OK-withlibs

# also works - bind whole root (symlinks preserved)
bwrap --ro-bind / / --proc /proc --dev /dev /bin/bash -c 'echo OK'
  -> OK

Fix

When setting up the bwrap namespace on usrmerge systems, add --symlink usr/bin /bin, --symlink usr/lib /lib, --symlink usr/lib64 /lib64 (detect by checking whether /bin, /lib, /lib64 are symlinks on the host). bwrap version is not a factor — 0.6.1 works once the symlinks exist.

Workaround until fixed

Disable sandbox (sandbox.enabled: false).