Adobe Acrobat AppContainer cannot access cppcryptfs when mounted to an NTFS directory #230

Description

I am experiencing an interoperability issue between cppcryptfs/Dokany and Adobe Acrobat on Windows.

I use cppcryptfs to mount the decrypted view of an encrypted filesystem into an empty NTFS directory, rather than assigning it a drive letter.

Example mount point:

C:\cppcryptfs\JoSa\

The filesystem itself works correctly. Files can be accessed normally through Windows Explorer and applications such as Microsoft Edge can open PDFs without any problems.

However, Adobe Acrobat fails to open PDF files from this directory when Acrobat's AppContainer option is enabled.

Acrobat displays:

There was an error opening this document.
Access denied.

Test results

I performed several tests to isolate the issue:

Therefore, the problem appears to be specifically related to the combination of:

Dokany/cppcryptfs directory mount
+
Adobe Acrobat AppContainer

It does not appear to be a general Acrobat Protected Mode issue.

Acrobat Protected Mode log

With AppContainer enabled, Acrobat repeatedly reports errors such as:

Failed to process path:C:\cppcryptfs\JoSa\ error code:3
Failed to process path:C:\cppcryptfs\JoSa\SUT Umrechnungstabelle.pdf error code:3

error code 3 corresponds to ERROR_PATH_NOT_FOUND.

Interestingly, Acrobat does not report a normal sandbox file-access denial for the cppcryptfs path. Instead, it appears to fail while processing/resolving the path itself.

I also tested an Acrobat Protected Mode whitelist (FILES_ALLOW_READONLY) for the cppcryptfs mount point. This did not change the behavior.

Important detail: directory mount is required

Using a drive letter is unfortunately not a suitable workaround in my environment.

The decrypted cppcryptfs filesystem is intentionally mounted into an NTFS directory because the decrypted view is backed up by Backblaze. This provides an independent clear-text backup in addition to the encrypted files stored in Dropbox.

The setup is therefore approximately:

Dropbox

└─ encrypted cppcryptfs filesystem

cppcryptfs / Dokany

└─ decrypted view

mounted at:

C:\cppcryptfs\JoSa\
Backblaze

└─ backs up the decrypted directory

Mounting the cppcryptfs filesystem as a drive instead would prevent this backup setup from working as intended.

Enabling cppcryptfs' "Enable Mount Manager (Recycle Bin)" option is also not desirable because the encrypted filesystem resides inside Dropbox.

Expected behavior

Applications running inside Windows AppContainer should be able to access files through a Dokany filesystem mounted into an NTFS directory, just as they can when the same filesystem is mounted using a drive letter.

Actual behavior

With the filesystem mounted into an NTFS directory, Adobe Acrobat running in AppContainer cannot resolve/access the path and returns "Access denied".

Disabling only:

Run in AppContainer

in Adobe Acrobat immediately fixes the issue, while Acrobat's regular Protected Mode remains enabled.

Question

Is this a known limitation of Dokany directory mount points when accessed from a Windows AppContainer?

Is there a mount option or Dokany configuration that would make a directory-mounted filesystem accessible from AppContainer applications without enabling the Windows Mount Manager or assigning a drive letter?

I would be happy to provide the complete Adobe Protected Mode log or perform additional tests if useful.