On Ubuntu, every single normal edit requires skipping sandbox

Potential duplicates detected. Please review them and close your issue if it is a duplicate.

• #17337
• #16402
• #16334
• #17134
• #15982

Powered by Codex Action

Same issue here on Ubuntu. The issue seems to be present from 0.118.0 and onwards. No issue in 0.117.0. Drives me insane. Had to downgrade to 0.117.0.

My config settings:
approval_policy = "on-request"
sandbox_mode = "workspace-write"

Here is the prompt I get every time any file is edited. Doesn't matter if I choose option 2. I will keep getting this prompt.
<img width="544" height="217" alt="Image" src="https://github.com/user-attachments/assets/a7785fef-31e2-419e-85c3-e868416744c8" />

Please see this documentation for details about how to enable the Codex bwrap-based sandbox if you have AppArmor enabled.

Did you follow the approach using bubblewrap to solve this issue? Not sure if I should update from 0.114.0 lol
0.117.0 sandbox still fails on my ubuntu20.04

@etraut-openai I do have bubblewrap installed. In 0.170.0 it works fine. No problems (no warning on startup). Starting from 0.118.0, the sandboxing is ALWAYS blocking (still no warning on startup). Doing sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0 does solve the problem but it removes a security hardening layer and increases kernel attack surface compared with the restricted default on modern Ubuntu. I don't understand why I am forced to remove this security feature to get codex to run properly. Please explain. I feel like it goes against modern sandboxing guidelines and more like a temporary workaround rather than a real solution.

My setup is: virtual machine where the agent user does not have access to 'sudo'. I'm on Ubuntu 24.04.4 LTS

@vicmik sorry for the inconvienience! can you paste the output of

codex sandbox linux -- /bin/true
command -v bwrap
readlink -f "$(command -v bwrap)"
echo $PATH

to help me debug? redact sensitive info in the $PATH

@viyatb-oai

$ codex sandbox linux -- /bin/true
command -v bwrap
readlink -f "$(command -v bwrap)"
echo $PATH

/usr/bin/bwrap
/usr/bin/bwrap
/home/agent/.local/bin:/home/agent/.cargo/bin:/home/agent/.local/npm/bin:/home/agent/.local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin

Running into the same issue codex-cli 0.120.0 & Ubuntu 24.04.4 LTS & bubblewrap 0.9.0

• ⚠ Codex's Linux sandbox uses bubblewrap and needs access to create user namespaces.

Please see this documentation for details about how to enable the Codex bwrap-based sandbox if you have AppArmor enabled.

^ This works, but please update the docs to explicitly say that this workaround works only until the next reboot, and it's dangerous to do this.

May I suggest that Codex performs a startup check for a) ubuntu, b) bubblewrap, c) that sys setting is correct and if anything's amiss, offer instructions on how to fix? Searching for that issue does not bring up that documentation page above, or this issue for that matter. Stumbled upon it after a number of follow up links on various issues that do.

mkdir -p /tmp/codex-bwrap-repro
cd /tmp/codex-bwrap-repro
printf 'before\n' > file.txt
codex sandbox linux --full-auto -- sh -lc 'set -eux; printf "after\n" >> file.txt; cat file.txt'
echo "workspace_write_status=$?"
sysctl kernel.apparmor_restrict_unprivileged_userns
aa-status 2>/dev/null | grep -i bwrap || true

@vicmik @vavkamil can you also paste the output of this?

Ideally, if you installed bubblewrap through Ubuntu (apt), it should install a permissive apparmor policy for /usr/bin/bwrap automatically that allows it access to create unprivileged user namespaces.

That does not seem to be happening though. On my system, bubblewrap was already installed, as a dependency of something else.

output:

bwrap: loopback: Failed RTM_NEWADDR: Operation not permitted
workspace_write_status=1
kernel.apparmor_restrict_unprivileged_userns = 1

after running sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0:

+ printf after\n
+ cat file.txt
before
after
workspace_write_status=0
kernel.apparmor_restrict_unprivileged_userns = 0

@luispabon can you paste the output of

codex sandbox linux -- /bin/true
command -v bwrap
readlink -f "$(command -v bwrap)"
echo $PATH

to help me debug?

@viyatb-oai not sure - but my #18185 _could_ be the same issue, and i have found the root cause and proposed a patch in that issue, so check it out and see if it helps solve this one.

@dfaerch can you check if 0.122.0 fixes this?

Issue is still present in 0.122. on XUbuntu 24.04. bwrap was already installed by apt before installing Codex:

% codex sandbox linux -- /bin/true ~/projects/prod_active

bwrap: loopback: Failed RTM_NEWADDR: Operation not permitted

Instructing users to do kernel.apparmor_restrict_unprivileged_userns = 0 in the official docs is totally not OK. It's disabling a security feature that was put there for a reason.

Looks like it's an issue with AppArmor policy not present on Ubuntu 24.04 and derivatives. The fix is to create the policy yourself, for example in /etc/apparmor.d/usr.bin.bwrap put

abi <abi/4.0>,
include <tunables/global>
/usr/bin/bwrap flags=(unconfined) {
  userns,
  include if exists <local/usr.bin.bwrap>
}

and then do sudo systemctl reload apparmor

@dfaerch can you check if 0.122.0 fixes this?

It does 👍

Looks like it's an issue with AppArmor policy not present on Ubuntu 24.04 and derivatives. The fix is to create the policy yourself, for example in /etc/apparmor.d/usr.bin.bwrap put `` abi <abi/4.0>, include <tunables/global> /usr/bin/bwrap flags=(unconfined) { userns, include if exists <local/usr.bin.bwrap> } ` and then do sudo systemctl reload apparmor`

I think this relates to another issue than what is being discussed here. I made a solution-comment on the other issue here, for reference:

https://github.com/openai/codex/issues/14919#issuecomment-4223539341

I'm using Ubuntu 20.04, codex v0.122.0, but still got sandbox failed.
You're all talking about issues with Ubuntu 24.04, but why do I have the same problem on 20.04?

(base) root@3eg2emnhb0n87-0:~# apt update
Reading package lists... Done
Building dependency tree       
Reading state information... Done
104 packages can be upgraded. Run 'apt list --upgradable' to see them.

(base) root@3eg2emnhb0n87-0:~# apt install bubblewrap -y          
Reading package lists... Done
Building dependency tree       
Reading state information... Done
bubblewrap is already the newest version (0.4.0-1ubuntu4.1).
0 upgraded, 0 newly installed, 0 to remove and 104 not upgraded.

Issue remains as of v0.122.0 on Ubuntu 24.04.

@milancurcic can you please try this? ubuntu 25.x ships with a profile bwrap-userns-restrict with apparmor-profiles that is somehow not on Ubuntu 24.04 by default - it was removed due to a Flatpak regression. See https://www.ubuntuupdates.org/package/core/noble/main/updates/apparmor-profiles and https://apparmor.net/news/release-4.0.2/

sudo apt update
sudo apt install apparmor-profiles apparmor-utils

dpkg -L apparmor-profiles | grep bwrap-userns-restrict

sudo install -m 0644 \
  /usr/share/apparmor/extra-profiles/bwrap-userns-restrict \
  /etc/apparmor.d/bwrap-userns-restrict

Thank you, @viyatb-oai, following these instructions solved it for me.

Adding a note that a full OS reboot was needed for the change to take effect.

@milancurcic my bad - you can do sudo apparmor_parser -r /etc/apparmor.d/bwrap-userns-restrict to reload the apparmor policies without a reboot.

I've updated the docs to reflect this https://developers.openai.com/codex/concepts/sandboxing#prerequisites - please let me know if its missing anything. I'll close this issue!