codex can't run commands that are shipped as snap packages in Linux

What version of Codex CLI is running?

0.98.0

What subscription do you have?

Plus

Which model were you using?

_No response_

What platform is your computer?

Ubuntu 24.04.3 LTS x86_64 and Ubuntu 26.04 LTS

What terminal emulator and version are you using (if applicable)?

_No response_

What issue are you seeing?

codex can't run commands that are shipped as snap packages, e.g. golang and docker.
snap-confine has elevated permissions and is not confined but should be. Refusing to continue to avoid permission escalation attacks
Also, other agents can run them.
Would be nice to fix this or to have a workaround. Thank you.

What steps can reproduce the bug?

$ codex sandbox linux go version
snap-confine has elevated permissions and is not confined but should be. Refusing to continue to avoid permission escalation attacks
Please make sure that the snapd.apparmor service is enabled and started.

snapd.apparmor is enabled, no issue with other snap programs. no issue with other agents.

$ systemctl is-enabled snapd.apparmor
enabled

even with "dangerous" flags:

$ codex --dangerously-bypass-approvals-and-sandbox --sandbox danger-full-access sandbox linux go version
snap-confine has elevated permissions and is not confined but should be. Refusing to continue to avoid permission escalation attacks
Please make sure that the snapd.apparmor service is enabled and started.
$ codex --dangerously-bypass-approvals-and-sandbox --sandbox danger-full-access sandbox linux docker version
snap-confine has elevated permissions and is not confined but should be. Refusing to continue to avoid permission escalation attacks
Please make sure that the snapd.apparmor service is enabled and started.

What is the expected behavior?

_No response_

Additional information

_No response_