bwrap: loopback: Failed RTM_NEWADDR: Operation not permitted

What version of Codex CLI is running?

codex-cli 0.117.0

What subscription do you have?

Plus

Which model were you using?

_No response_

What platform is your computer?

Ubuntu 24.04

What terminal emulator and version are you using (if applicable)?

GNU bash, version 5.2.21(1)-release (x86_64-pc-linux-gnu)

What issue are you seeing?

Problem:
The default Linux sandbox backend fails even for a trivial command:

codex sandbox linux /bin/pwd

Error:
bwrap: loopback: Failed RTM_NEWADDR: Operation not permitted

Relevant host state:
kernel.unprivileged_userns_clone = 1
user.max_user_namespaces = 30935
kernel.apparmor_restrict_unprivileged_userns = 1

Additional checks:
unshare -Ur /bin/true -> write failed /proc/self/uid_map: Operation not permitted
unshare -n /bin/true -> unshare failed: Operation not permitted

Workaround:
Enabling the legacy Landlock backend makes the sandbox work again:

codex --enable use_legacy_landlock sandbox linux /bin/pwd

This succeeds and prints the working directory.

Expected:
Codex should work on a standard Ubuntu 24.04 install without requiring users to relax system-wide namespace/AppArmor protections, or it should
automatically fall back to the Landlock backend when bubblewrap cannot initialize.

What steps can reproduce the bug?

Uploaded thread: 019d43b5-9a1c-7db3-b2a2-b9003e446ed3

What is the expected behavior?

Codex should work on a standard Ubuntu 24.04 install without requiring users to relax system-wide namespace/AppArmor protections, or it should
automatically fall back to the Landlock backend when bubblewrap cannot initialize.

Additional information

_No response_