Open file descriptors leaked to subprocesses

[mdickopp]

Reproduction steps

1. Start Zed on Linux
2. Open a terminal panel
3. Type ls -al /proc/self/fd into the terminal and press Enter

Current vs. Expected behavior

Observed behavior: The following open file descriptors can be seen from the output:

total 0
dr-x------ 2 martin martin  7 Jun 13 14:45 .
dr-xr-xr-x 9 martin martin  0 Jun 13 14:45 ..
lrwx------ 1 martin martin 64 Jun 13 14:45 0 -> /dev/pts/3
lrwx------ 1 martin martin 64 Jun 13 14:45 1 -> /dev/pts/3
lrwx------ 1 martin martin 64 Jun 13 14:45 2 -> /dev/pts/3
lr-x------ 1 martin martin 64 Jun 13 14:45 3 -> /proc/10073/fd
lrwx------ 1 martin martin 64 Jun 13 14:45 39 -> /home/martin/.local/share/zed/prompts/prompts-library-db.0.mdb/data.mdb
lrwx------ 1 martin martin 64 Jun 13 14:45 70 -> /dev/udmabuf
lrwx------ 1 martin martin 64 Jun 13 14:45 71 -> '/memfd:lp_dma_buf (deleted)'

Expected behavior: File descriptors 39, 70, and 71 should not be open in a subprocess spawned by Zed.

Zed version and system specs

Zed: v1.6.3+stable.306.601ecb3ee5c16940191818ee7f244837abf6983c (Zed)
OS: Linux Wayland debian unknown
Memory: 31.3 GiB
Architecture: x86_64
GPU: AMD Radeon RX 590 Series (RADV POLARIS10) || radv || Mesa 26.0.8-1

Attach Zed log file

Zed.log

2026-06-13T14:40:45+02:00 INFO  [zed] ========== starting zed version 1.6.3+stable.306.601ecb3ee5c16940191818ee7f244837abf6983c, sha 601ecb3 ==========
2026-06-13T14:40:45+02:00 INFO  [gpui_linux::linux::platform] Compositor GPU hint: vendor=0x1002, device=0x67df (from dev 226:128)
2026-06-13T14:40:45+02:00 INFO  [crashes] spawning crash handler process
2026-06-13T14:40:45+02:00 INFO  [extension_host] extensions updated. loading 4, reloading 0, unloading 0
2026-06-13T14:40:45+02:00 INFO  [util] set environment variables from shell:/bin/bash, path:/usr/lib/ccache:/home/martin/.local/bin:/home/martin/bin:/usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games:/home/martin/.cargo/bin:/home/martin/.local/share/pnpm/bin
2026-06-13T14:40:45+02:00 INFO  [prompt_store::rules_to_skills_migration] Rules-to-skills migration already marked done; skipping startup migration
2026-06-13T14:40:45+02:00 INFO  [gpui_linux::linux::platform] activate is not implemented on Linux, ignoring the call
2026-06-13T14:40:45+02:00 INFO  [gpui_linux::linux::platform] activate is not implemented on Linux, ignoring the call
2026-06-13T14:40:45+02:00 INFO  [auto_update] Auto Update: checking for updates
2026-06-13T14:40:46+02:00 INFO  [crashes] connected to crash handler process after 100ms
2026-06-13T14:40:46+02:00 INFO  [crashes] panic handler registered
2026-06-13T14:40:46+02:00 INFO  [crashes] crash signal handlers installed
2026-06-13T14:40:46+02:00 INFO  [crashes] crash handler registered
2026-06-13T14:40:46+02:00 INFO  [wgpu_hal::vulkan::adapter] Found 2 cooperative matrix configurations supported by wgpu
2026-06-13T14:40:46+02:00 INFO  [gpui_wgpu::wgpu_context] Found 3 GPU adapter(s):
2026-06-13T14:40:46+02:00 INFO  [gpui_wgpu::wgpu_context]   - AMD Radeon RX 590 Series (RADV POLARIS10) (vendor=0x1002, device=0x67df, backend=Vulkan, type=DiscreteGpu)
2026-06-13T14:40:46+02:00 INFO  [gpui_wgpu::wgpu_context]   - AMD Radeon RX 590 Series (radeonsi, polaris10, ACO, DRM 3.64, 7.0.10+deb14-amd64) (vendor=0x1002, device=0x0000, backend=Gl, type=Other)
2026-06-13T14:40:46+02:00 INFO  [gpui_wgpu::wgpu_context]   - llvmpipe (LLVM 21.1.8, 256 bits) (vendor=0x10005, device=0x0000, backend=Vulkan, type=Cpu)
2026-06-13T14:40:46+02:00 INFO  [gpui_wgpu::wgpu_context] Testing adapter: AMD Radeon RX 590 Series (RADV POLARIS10) (Vulkan)...
2026-06-13T14:40:46+02:00 INFO  [gpui_wgpu::wgpu_context] Selected GPU (passed configuration test): AMD Radeon RX 590 Series (RADV POLARIS10) (Vulkan)
2026-06-13T14:40:46+02:00 INFO  [gpui_wgpu::wgpu_context] Selected GPU adapter: "AMD Radeon RX 590 Series (RADV POLARIS10)" (Vulkan)
2026-06-13T14:40:46+02:00 INFO  [workspace] Rendered first frame
2026-06-13T14:40:46+02:00 INFO  [zed::zed] Using GPU: GpuSpecs { is_software_emulated: false, device_name: "AMD Radeon RX 590 Series (RADV POLARIS10)", driver_name: "radv", driver_info: "Mesa 26.0.8-1" }
2026-06-13T14:40:46+02:00 INFO  [client] set status on client 0: Authenticating
2026-06-13T14:40:46+02:00 INFO  [agent_ui::agent_panel] last active thread is archived or missing, skipping restoration
2026-06-13T14:40:46+02:00 ERROR [gpui_linux::linux::wayland::client] activation token received with no pending activation
2026-06-13T14:40:46+02:00 INFO  [git::repository] opening git repository at "/home/martin/xxxx/.git" using git binary "/usr/bin/git"
2026-06-13T14:40:46+02:00 INFO  [git::repository] opening git repository at "/home/martin/xxxx/client/.git" using git binary "/usr/bin/git"
2026-06-13T14:40:47+02:00 INFO  [client] set status on client 667494: Authenticated
2026-06-13T14:40:48+02:00 ERROR [agent] Failed to authenticate provider: ChatGPT Subscription: Sign in with your ChatGPT Plus or Pro subscription to use this provider.
2026-06-13T14:42:44+02:00 INFO  [zed] ========== starting zed version 1.6.3+stable.306.601ecb3ee5c16940191818ee7f244837abf6983c, sha 601ecb3 ==========
2026-06-13T14:42:44+02:00 INFO  [gpui_linux::linux::platform] Compositor GPU hint: vendor=0x1002, device=0x67df (from dev 226:128)
2026-06-13T14:42:44+02:00 INFO  [crashes] spawning crash handler process
2026-06-13T14:42:44+02:00 INFO  [extension_host] extensions updated. loading 4, reloading 0, unloading 0
2026-06-13T14:42:44+02:00 INFO  [util] set environment variables from shell:/bin/bash, path:/usr/lib/ccache:/home/martin/.local/bin:/home/martin/bin:/usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games:/home/martin/.cargo/bin:/home/martin/.local/share/pnpm/bin
2026-06-13T14:42:44+02:00 INFO  [prompt_store::rules_to_skills_migration] Rules-to-skills migration already marked done; skipping startup migration
2026-06-13T14:42:44+02:00 INFO  [gpui_linux::linux::platform] activate is not implemented on Linux, ignoring the call
2026-06-13T14:42:44+02:00 INFO  [gpui_linux::linux::platform] activate is not implemented on Linux, ignoring the call
2026-06-13T14:42:44+02:00 INFO  [auto_update] Auto Update: checking for updates
2026-06-13T14:42:44+02:00 INFO  [crashes] connected to crash handler process after 100ms
2026-06-13T14:42:44+02:00 INFO  [crashes] panic handler registered
2026-06-13T14:42:44+02:00 INFO  [crashes] crash signal handlers installed
2026-06-13T14:42:44+02:00 INFO  [crashes] crash handler registered
2026-06-13T14:42:44+02:00 INFO  [wgpu_hal::vulkan::adapter] Found 2 cooperative matrix configurations supported by wgpu
2026-06-13T14:42:44+02:00 INFO  [gpui_wgpu::wgpu_context] Found 3 GPU adapter(s):
2026-06-13T14:42:44+02:00 INFO  [gpui_wgpu::wgpu_context]   - AMD Radeon RX 590 Series (RADV POLARIS10) (vendor=0x1002, device=0x67df, backend=Vulkan, type=DiscreteGpu)
2026-06-13T14:42:44+02:00 INFO  [gpui_wgpu::wgpu_context]   - AMD Radeon RX 590 Series (radeonsi, polaris10, ACO, DRM 3.64, 7.0.10+deb14-amd64) (vendor=0x1002, device=0x0000, backend=Gl, type=Other)
2026-06-13T14:42:44+02:00 INFO  [gpui_wgpu::wgpu_context]   - llvmpipe (LLVM 21.1.8, 256 bits) (vendor=0x10005, device=0x0000, backend=Vulkan, type=Cpu)
2026-06-13T14:42:44+02:00 INFO  [gpui_wgpu::wgpu_context] Testing adapter: AMD Radeon RX 590 Series (RADV POLARIS10) (Vulkan)...
2026-06-13T14:42:44+02:00 INFO  [gpui_wgpu::wgpu_context] Selected GPU (passed configuration test): AMD Radeon RX 590 Series (RADV POLARIS10) (Vulkan)
2026-06-13T14:42:44+02:00 INFO  [gpui_wgpu::wgpu_context] Selected GPU adapter: "AMD Radeon RX 590 Series (RADV POLARIS10)" (Vulkan)
2026-06-13T14:42:44+02:00 INFO  [workspace] Rendered first frame
2026-06-13T14:42:44+02:00 INFO  [zed::zed] Using GPU: GpuSpecs { is_software_emulated: false, device_name: "AMD Radeon RX 590 Series (RADV POLARIS10)", driver_name: "radv", driver_info: "Mesa 26.0.8-1" }
2026-06-13T14:42:44+02:00 INFO  [client] set status on client 0: Authenticating
2026-06-13T14:42:44+02:00 INFO  [agent_ui::agent_panel] last active thread is archived or missing, skipping restoration
2026-06-13T14:42:44+02:00 ERROR [gpui_linux::linux::wayland::client] activation token received with no pending activation
2026-06-13T14:42:44+02:00 INFO  [git::repository] opening git repository at "/home/martin/xxxx/.git" using git binary "/usr/bin/git"
2026-06-13T14:42:44+02:00 INFO  [git::repository] opening git repository at "/home/martin/xxxx/client/.git" using git binary "/usr/bin/git"
2026-06-13T14:42:45+02:00 INFO  [client] set status on client 667494: Authenticated
2026-06-13T14:42:47+02:00 ERROR [agent] Failed to authenticate provider: ChatGPT Subscription: Sign in with your ChatGPT Plus or Pro subscription to use this provider.
2026-06-13T14:47:01+02:00 INFO  [node_runtime] using Node.js from `node.path` in settings: SystemNodeRuntime { node: "/home/martin/.local/share/pnpm/bin/node", npm: "/home/martin/.local/share/pnpm/bin/npm", scratch_dir: "/home/martin/.local/share/zed/node" }
2026-06-13T14:47:01+02:00 INFO  [lsp] starting language server process. binary path: "/home/martin/.local/share/pnpm/bin/node", working directory: "/home/martin/xxxx", args: ["--max-old-space-size=8192", "/home/martin/.local/share/zed/languages/eslint/vscode-eslint-3.0.24/vscode-eslint/server/out/eslintServer.js", "--stdio"]
2026-06-13T14:47:01+02:00 INFO  [lsp] Language server with id 2 sent unhandled notification window/logMessage:
{
  "type": 3,
  "message": "ESLint server running in node v24.16.0"
}
2026-06-13T14:47:03+02:00 INFO  [lsp] starting language server process. binary path: "/home/martin/.local/share/pnpm/bin/node", working directory: "/home/martin/xxxx", args: ["/home/martin/.local/share/zed/languages/vtsls/node_modules/@vtsls/language-server/bin/vtsls.js", "--stdio"]
2026-06-13T14:47:04+02:00 INFO  [lsp] Language server with id 2 sent unhandled notification eslint/status:
{
  "uri": "file:///home/martin/xxxx",
  "state": 1,
  "validationTime": 1822
}
2026-06-13T14:47:04+02:00 INFO  [lsp] Language server with id 2 sent unhandled notification eslint/status:
{
  "uri": "file:///home/martin/xxxx",
  "state": 1,
  "validationTime": 58
}
2026-06-13T14:47:04+02:00 INFO  [lsp] Language server with id 2 sent unhandled notification eslint/status:
{
  "uri": "file:///home/martin/xxxx",
  "state": 1,
  "validationTime": 36
}
2026-06-13T14:47:05+02:00 INFO  [lsp] Language server with id 2 sent unhandled notification eslint/status:
{
  "uri": "file:///home/martin/xxxx",
  "state": 1,
  "validationTime": 88
}
2026-06-13T14:47:10+02:00 INFO  [lsp] Language server with id 2 sent unhandled notification eslint/status:
{
  "uri": "file:///home/martin/xxxx",
  "state": 1,
  "validationTime": 77
}
2026-06-13T14:47:10+02:00 WARN  [project.format.local.code-actions] No edits resolved from LSP
2026-06-13T14:47:10+02:00 INFO  [project::prettier_store] Found prettier in "/home/martin/xxxx", starting.
2026-06-13T14:47:10+02:00 INFO  [project::prettier_store] Starting prettier at path "/home/martin/xxxx"
2026-06-13T14:47:10+02:00 INFO  [lsp] starting language server process. binary path: "/home/martin/.local/share/pnpm/bin/node", working directory: "/home/martin/xxxx", args: ["/home/martin/.local/share/zed/prettier/prettier_server.js", "/home/martin/xxxx"]
2026-06-13T14:47:10+02:00 INFO  [prettier] Found prettier ignore at "/home/martin/xxxx/.prettierignore"
2026-06-13T14:47:10+02:00 INFO  [project::prettier_store] Started prettier in "/home/martin/xxxx"

Relevant Zed settings

Relevant Keymap

No response

(for AI issues) Model provider details

No response

If you are using WSL on Windows, what flavor of Linux are you using?

None

[mdickopp]

Motivation: This is an issue to me because I run Zed as well as tools such as npm under AppArmor mandatory access control. For npm, this is a critical element in my defense-in-depth strategy, as NPM packages become victims of supply-chain attacks regularly.

When Zed inherits the open file descriptors to its child processes that run under AppArmor, I would either have to tolerate many log entries pertaining to the files (making it hard to spot log entries that indicate a real issue), or add custom deny rules to every AppArmor profile of every program that Zed may execute in a child process (messy).

[LordMikkel]

Hey @mdickopp, I saw your issue, thought it was quite important, and decided to open a PR with a fix to solve it. Hopefully, someone from the team can review it soon. Any feedback is welcome!

[mdickopp]

@LordMikkel Thanks! I tested your branch and can confirm that it fixes the issue for me.