bwrap: Failed RTM_NEWADDR — subagents cannot execute any commands

What version of Codex CLI is running?

Codex CLI: 0.104.0

What subscription do you have?

pro

Which model were you using?

Model: gpt-5.3-codex

What platform is your computer?

OS: Ubuntu 24.04.4 LTS Kernel: 6.8.0-100-generic x86_64

What terminal emulator and version are you using (if applicable)?

_No response_

What issue are you seeing?

When running Codex CLI (0.104.0) on Ubuntu 24.04.4 LTS with sandbox enabled (workspace-write or default), subagents fail to execute any shell command. Every execution attempt results in:
bwrap: loopback: Failed RTM_NEWADDR: Operation not permitted
Example prompt:
Create a subagent and have it run: pwd; ls -la; return raw stdout/stderr.
Result:
bwrap: loopback: Failed RTM_NEWADDR: Operation not permitted
This happens even for trivial commands like pwd, ls, or cat.
Important context:

bubblewrap is installed and available at /usr/bin/bwrap

Version: bubblewrap 0.9.0

Manual namespace test works:

bwrap --ro-bind / / --dev /dev --proc /proc --unshare-all /bin/echo "bwrap ok"
Output:
bwrap ok
So bubblewrap works on the host, but Codex subagents fail inside the sandbox.
Using:
--sandbox danger-full-access
or
--dangerously-bypass-approvals-and-sandbox
allows commands to execute successfully.
The failure only occurs when sandboxing is enabled.

What steps can reproduce the bug?

Environment:

Ubuntu 24.04.4 LTS

Kernel: 6.8.0-100-generic

codex-cli 0.104.0

bubblewrap 0.9.0

AppArmor enabled

kernel.apparmor_restrict_unprivileged_userns = 1

Steps:

Install bubblewrap:
sudo apt install bubblewrap

Add AppArmor profile allowing user namespaces:
/etc/apparmor.d/bwrap
abi <abi/4.0>, include <tunables/global> profile bwrap /usr/bin/bwrap flags=(unconfined) { userns, include if exists <local/bwrap> }
Reload:
sudo apparmor_parser -r /etc/apparmor.d/bwrap sudo systemctl reload apparmor

Confirm manual bwrap works:
bwrap --ro-bind / / --dev /dev --proc /proc --unshare-all /bin/echo "bwrap ok"

Run Codex CLI with sandbox:
codex --sandbox workspace-write "Create a subagent and have it run: pwd; ls -la"

Observe:
bwrap: loopback: Failed RTM_NEWADDR: Operation not permitted

Thread ID: N/A (non-interactive CLI run)

What is the expected behavior?

Subagents should be able to execute shell commands inside the sandbox when:

bubblewrap is correctly installed

user namespaces are allowed via AppArmor profile

manual bubblewrap namespace tests succeed

If Codex requires additional flags (e.g., specific network namespace configuration), it should:

either document the requirement,

auto-detect incompatibility and fallback,

or provide a clearer diagnostic message.

The CLI should not fail to execute trivial commands when bubblewrap works at the OS level.

Additional information

The error appears to originate from how Codex invokes bubblewrap internally (possibly related to network namespace or loopback setup).

The issue persists even though manual bwrap --unshare-all works.

Disabling sandboxing entirely resolves the problem, indicating the failure is isolated to Codex’s sandbox implementation.

This may be related to other sandbox/bwrap issues reported in recent Codex CLI versions.

If needed, I can provide strace output of Codex invoking bwrap.