Fix Nautilus Thumbnails on Ubuntu 24.04+

Nautilus shows generic placeholders instead of image thumbnails across all folders. The gdk-pixbuf-thumbnailer binary works fine — it’s the bubblewrap sandbox that’s broken.

The Problem

Ubuntu 24.04+ enables kernel.apparmor_restrict_unprivileged_userns = 1 by default. This blocks unprivileged user namespaces via AppArmor.

Nautilus 46 uses bubblewrap to sandbox thumbnail generation. Bubblewrap needs user namespaces to function. When AppArmor blocks them, every thumbnail fails silently and gets cached as a failure.

# Check if this is your issue:
$ bwrap --ro-bind / / --dev /dev /bin/echo "test"
bwrap: setting up uid map: Permission denied

You’ll also see entries piling up in ~/.cache/thumbnails/fail/gnome-thumbnail-factory/.

The Fix

Immediate (resets on reboot):

sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
nautilus -q

Permanent:

echo 'kernel.apparmor_restrict_unprivileged_userns = 0' | sudo tee /etc/sysctl.d/99-allow-userns.conf
sudo sysctl --system
nautilus -q

Optionally clear stale failures:

rm -rf ~/.cache/thumbnails/*

Why It Happens

The chain: Nautilus → libgnome-desktop → bwrap sandbox → gdk-pixbuf-thumbnailer. The sandbox can’t start because AppArmor denies the UID mapping. Nautilus caches the failure and never retries — so thumbnails stay broken permanently until you clear the cache or change the setting.

This same restriction also affects Flatpak and other desktop apps using bubblewrap. Disabling it is the standard fix for desktop Linux systems.