WSL: No solution to "Error: The combination of seccomp/landlock that Codex uses for sandboxing is not supported in this environment."?

We are seeing this happen in privileged kube containers running Linux as well using the exact same test used in #763.

Seems --full-auto --auto-edit triggers sandboxing and any attempts to exempt ourselves from the sandboxing via --dangerously-auto-approve-everything still fails. Not using --full-auto --auto-edit is the solution for now, but it's impractical to run automated handsfree workflows without this.

root@debug-container-fdd9d97f4-45jcv:~# codex --model gpt-4.1 --full-auto --auto-edit --dangerously-auto-approve-everything
╭──────────────────────────────────────────────────────────────╮
│ ● OpenAI Codex (research preview) v0.1.2505172129            │
╰──────────────────────────────────────────────────────────────╯
╭──────────────────────────────────────────────────────────────╮
│ localhost session: 0259e949d8194196be02cb4f79d62d94          │
│ ↳ workdir: ~                                                 │
│ ↳ model: gpt-4.1                                             │
│ ↳ provider: openai                                           │
│ ↳ approval: full-auto                                        │
╰──────────────────────────────────────────────────────────────╯
user
echo 'hello world' > hello_world.txt

    command

    $ bash -c "echo 'hello world' > hello_world.txt"
╭──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮
│(     ●) 2s  Thinking.                                                                                                                                                                                                                                                                   press Esc twice to interrupt │
╰──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯
  ctrl+c to exit | "/" to see commands | enter to send — 100% context left

file:///root/.bun/install/global/node_modules/@openai/codex/dist/cli.js:498
`;function IHe(e){return new Promise((t,r)=>{let n=["--","true"];bHe(e,n,(a,i,o)=>{a?(zt(`Sandbox check failed for ${e} ${n.join(" ")}: ${a}`),zt(`stdout: ${i}`),zt(`stderr: ${o}`),r(new Error(THe))):t()})})}function DHe(){return AB||(AB=CHe()),AB}function wHe(){switch(process.arch){case"arm64":return"codex-linux-sandbox-arm64";case"x64":return"codex-linux-sandbox-x64";default:return"codex-linux-sandbox-x64"}}f();cl();function xHe(){return[`${process.env.HOME}/.pyenv`]}var E6="/usr/bin/sandbox-exec";function hce(e,t,r,n,a){let i,o,s=[...r,...xHe()];if(s.length>0){let{policies:g,params:_}=s.map((E,b)=>({policy:`(subpath (param "WRITABLE_ROOT_${b}"))`,param:`-DWRITABLE_ROOT_${b}=${E}`})).reduce((E,{policy:b,param:S})=>(E.policies.push(b),E.params.push(S),E),{policies:[],params:[]});i=`
                                                                                                                                                                                       ^

Error: The combination of seccomp/landlock that Codex uses for sandboxing is not
supported in this environment.

If you are running in a Docker container, you may want to try adding
restrictions to your Docker container such that it provides your desired
sandboxing guarantees and then run Codex with the
--dangerously-auto-approve-everything option inside the container.

If you are running on an older Linux kernel that does not support newer
features of seccomp/landlock, you will have to update your kernel to a newer
version.

    at file:///root/.bun/install/global/node_modules/@openai/codex/dist/cli.js:498:184
    at ChildProcess.exithandler (node:child_process:421:5)
    at ChildProcess.emit (node:events:518:28)
    at x0.emit (file:///root/.bun/install/global/node_modules/@openai/codex/dist/cli.js:332:3112)
    at maybeClose (node:internal/child_process:1101:16)
    at Socket.<anonymous> (node:internal/child_process:456:11)
    at Socket.emit (node:events:518:28)
    at x0.emit (file:///root/.bun/install/global/node_modules/@openai/codex/dist/cli.js:332:3112)
    at Pipe.<anonymous> (node:net:351:12)

Node.js v22.15.1
root@debug-container-fdd9d97f4-45jcv:~#

root@debug-container-fdd9d97f4-45jcv:~# cat /etc/os-release
PRETTY_NAME="Ubuntu 22.04.5 LTS"
NAME="Ubuntu"
VERSION_ID="22.04"
VERSION="22.04.5 LTS (Jammy Jellyfish)"
VERSION_CODENAME=jammy
ID=ubuntu
ID_LIKE=debian
HOME_URL="https://www.ubuntu.com/"
SUPPORT_URL="https://help.ubuntu.com/"
BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/"
PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy"
UBUNTU_CODENAME=jammy
root@debug-container-fdd9d97f4-45jcv:~# uname -a
Linux debug-container-fdd9d97f4-45jcv 6.1.132-147.221.amzn2023.x86_64 #1 SMP PREEMPT_DYNAMIC Tue Apr  8 13:14:54 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux

reporting same issue here

file:///.nvm/versions/node/v22.15.1/lib/node_modules/@openai/codex/dist/cli.js:498
`;function IHe(e){return new Promise((t,r)=>{let n=["--","true"];bHe(e,n,(a,i,o)=>{a?(zt(`Sandbox check failed for ${e} ${n.join(" ")}: ${a}`),zt(`stdout: ${i}`),zt(`stderr: ${o}`),r(new Error(THe))):t()})})}function DHe(){return AB||(AB=CHe()),AB}function wHe(){switch(process.arch){case"arm64":return"codex-linux-sandbox-arm64";case"x64":return"codex-linux-sandbox-x64";default:return"codex-linux-sandbox-x64"}}f();cl();function xHe(){return[`${process.env.HOME}/.pyenv`]}var E6="/usr/bin/sandbox-exec";function hce(e,t,r,n,a){let i,o,s=[...r,...xHe()];if(s.length>0){let{policies:g,params:_}=s.map((E,b)=>({policy:`(subpath (param "WRITABLE_ROOT_${b}"))`,param:`-DWRITABLE_ROOT_${b}=${E}`})).reduce((E,{policy:b,param:S})=>(E.policies.push(b),E.params.push(S),E),{policies:[],params:[]});i=`

at file:////.nvm/versions/node/v22.15.1/lib/node_modules/@openai/codex/dist/cli.js:498:184
    at ChildProcess.exithandler (node:child_process:421:5)
    at ChildProcess.emit (node:events:518:28)
    at x0.emit (file:///.nvm/versions/node/v22.15.1/lib/node_modules/@openai/codex/dist/cli.js:332:3112)
    at maybeClose (node:internal/child_process:1101:16)
    at ChildProcess._handle.onexit (node:internal/child_process:304:5)

effectively duplicate of #973

I'm not sure what's up with that dangerously-auto-approve-everything flag that gets suggested. It doesn't seem to actually be implemented anywhere.

The environment variable CODEX_UNSAFE_ALLOW_NO_SANDBOX is already implemented and seems intended to let you skip sandboxing entirely (#699), but was always after the check for Darwin and also got placed after the check for Linux sandboxing (#763). That PR also mentions the flag, but I don't see implementation.

You could implement #996 on a custom codex build to be able to skip sandboxing using CODEX_UNSAFE_ALLOW_NO_SANDBOX.

Getting the same error Error: The combination of seccomp/landlock that Codex uses for sandboxing is not
supported in this environment.

Thank you for the feedback. Please try using the latest version of Codex CLI. If the issue persists, we'd appreciate it if you could test it with the native/Rust implementation and let us know if it still occurs. More details can be found in our project update: https://github.com/openai/codex/discussions/1174.