From 85be3b8de26fbb27328daf40d93b27ab979cd967 Mon Sep 17 00:00:00 2001
From: ed <s@ocv.me>
Date: Sat, 4 Jul 2026 21:46:41 +0000
Subject: [PATCH] detect bwrap init-fail; prisonparty et al

---
 bin/README.md       |  1 +
 bin/prisonparty.sh  |  3 +++
 copyparty/mtag.py   |  8 ++++++++
 copyparty/th_srv.py | 14 +++++++++++++-
 4 files changed, 25 insertions(+), 1 deletion(-)

diff --git a/bin/README.md b/bin/README.md
index b6a033b8..787d5047 100644
--- a/bin/README.md
+++ b/bin/README.md
@@ -78,6 +78,7 @@ cd /mnt/nas/music/.hist
 # [`prisonparty.sh`](prisonparty.sh)
 * run copyparty in a chroot, preventing any accidental file access
 * creates bindmounts for /bin, /lib, and so on, see `sysdirs=`
+* **not compatible with:** `--th-bwrap`
 
 # [`bubbleparty.sh`](bubbleparty.sh)
 * run copyparty in an isolated process, preventing any accidental file access and more
diff --git a/bin/prisonparty.sh b/bin/prisonparty.sh
index 403f1588..eb561878 100755
--- a/bin/prisonparty.sh
+++ b/bin/prisonparty.sh
@@ -20,6 +20,8 @@ example:
 example for running straight from source (instead of using an sfx):
   PYTHONPATH=$PWD ./prisonparty.sh /var/lib/copyparty-jail cpp cpp /mnt/nas/music -- python3 -um copyparty -v /mnt/nas/music::rwmd
 
+NOT COMPATIBLE WITH: --th-bwrap
+
 note that if you have python modules installed as --user (such as bpm/key detectors),
   you should add /home/foo/.local as a VOLDIR
 
@@ -97,6 +99,7 @@ jail="${jail%/}"
 
 
 # bind-mount system directories and volumes
+mkdir -p "$jail"
 for a in {1..30}; do mkdir "$jail/.prisonlock" && break; sleep 0.1; done
 printf '%s\n' "${sysdirs[@]}" "${vols[@]}" | sed -r 's`/$``' | LC_ALL=C sort | uniq |
 while IFS= read -r v; do
diff --git a/copyparty/mtag.py b/copyparty/mtag.py
index dd86caa9..37e36eea 100644
--- a/copyparty/mtag.py
+++ b/copyparty/mtag.py
@@ -15,6 +15,7 @@ from .authsrv import VFS
 from .bos import bos
 from .util import (
     FFMPEG_URL,
+    LOG,
     REKOBO_LKEY,
     VF_CAREFUL,
     expand_osenv_c,
@@ -236,6 +237,11 @@ def bwrap(prog: bytes, ap_in: bytes, ap_out: bytes) -> list[bytes]:
     return ret
 
 
+def bwrap_fail(serr: str) -> None:
+    if "bwrap:" in serr:
+        LOG[0]("root", "ffmpeg failed due to --th-bwrap;\n  " + serr, 3)
+
+
 def ffprobe(
     abspath: str, timeout: int = 60
 ) -> tuple[dict[str, tuple[int, Any]], dict[str, list[Any]], list[Any], dict[str, Any]]:
@@ -249,6 +255,8 @@ def ffprobe(
         bap,
     ]
     rc, so, se = runcmd(cmd, timeout=timeout, nice=True, oom=200)
+    if rc and TH_BWRAP:
+        bwrap_fail(se)
     retchk(rc, cmd, se)
     return parse_ffprobe(so)
 
diff --git a/copyparty/th_srv.py b/copyparty/th_srv.py
index 9174c633..9a1376a7 100644
--- a/copyparty/th_srv.py
+++ b/copyparty/th_srv.py
@@ -18,7 +18,16 @@ from queue import Queue
 from .__init__ import ANYWIN, PY2, TYPE_CHECKING, unicode
 from .authsrv import VFS
 from .bos import bos
-from .mtag import HAVE_FFMPEG, HAVE_FFPROBE, au_unpk, bwrap, ffprobe, have_ff
+from .mtag import (
+    HAVE_FFMPEG,
+    HAVE_FFPROBE,
+    TH_BWRAP,
+    au_unpk,
+    bwrap,
+    bwrap_fail,
+    ffprobe,
+    have_ff,
+)
 from .util import BytesIO  # type: ignore
 from .util import (
     FFMPEG_URL,
@@ -906,6 +915,9 @@ class ThumbSrv(object):
         if not ret:
             return
 
+        if TH_BWRAP:
+            bwrap_fail(serr)
+
         c: Union[str, int] = "90"
         t = "FFmpeg failed (probably a corrupt file):\n"