Full access session still launches in workspace-write sandbox without NVIDIA device passthrough

Summary

A Codex session that the user reports was granted full access is still running inside a workspace-write bubblewrap sandbox. The sandbox has no Linux capabilities and does not expose NVIDIA device nodes, so CUDA/NVML are unavailable even though the host driver sees the GPU.

This blocks GPU workloads from Codex despite the user granting full permission.

Environment

• Codex CLI: codex-cli 0.124.0
• Package: @openai/codex version 0.124.0
• Repository metadata: https://github.com/openai/codex.git, directory codex-cli
• Host GPU visible through /proc/driver/nvidia: NVIDIA GeForce RTX 5090
• NVIDIA driver: 590.48.01
• Workspace path: Linux host, Codex running under bwrap

Expected behavior

When the user grants full access / danger-full-access for the session, commands should not be placed in a restricted workspace-write sandbox that hides /dev/nvidia*. GPU workloads should be able to access CUDA devices when the host has a working NVIDIA driver/GPU.

Actual behavior

The Codex process is launched under bubblewrap with a workspace-write policy and an isolated /dev that lacks NVIDIA device nodes.

Observed PID 1 command includes:

bwrap ... --dev /dev ... --unshare-user --unshare-pid --unshare-net ... codex-linux-sandbox ... --sandbox-policy {"type":"workspace-write", ... "network_access":false} ...

Sandbox/capability diagnostics:

CapEff:      0000000000000000
CapBnd:      0000000000000000
NoNewPrivs:  1
Seccomp:     2

NVIDIA device nodes are absent:

find /dev -maxdepth 1 -name 'nvidia*' -ls
# no output

NVML/CUDA fail:

$ nvidia-smi -L
NVIDIA-SMI has failed because it couldn't communicate with the NVIDIA driver.

$ python -c "import torch; print(torch.cuda.is_available()); print(torch.cuda.device_count())"
False
0

But the host driver/GPU is visible through /proc:

/proc/driver/nvidia/gpus/0000:01:00.0/information
Model: NVIDIA GeForce RTX 5090
Device Minor: 0

/proc/driver/nvidia/version
NVRM version: NVIDIA UNIX Open Kernel Module for x86_64 590.48.01

Manual recovery is not possible from inside this process because there are no capabilities and mknod is denied:

mknod /dev/nvidia0 c 195 0
mknod: /dev/nvidia0: Operation not permitted

Impact

GPU experiments cannot be run from Codex even though the user granted full access and the host GPU/driver are present. The runtime permission state exposed to the agent appears inconsistent with the user-granted access level.

Request

Please check whether full-access sessions are accidentally still being launched with the workspace-write sandbox / isolated /dev, or whether NVIDIA device passthrough is missing for full-access Linux sessions.