OpenBSD Sandbox Support
Open 💬 9 comments Opened May 9, 2026 by donpellegrino
What variant of Codex are you using?
CLI
What feature would you like to see?
It would be useful to have sandbox support on OpenBSD.
Additional information
Issue #12338 references OpenBSD support as a new feature generally. There is a Port of Codex (https://marc.info/?l=openbsd-ports&m=176853999431595&w=2, https://cvsweb.openbsd.org/ports/devel/codex?sort=File) to OpenBSD, however it does not include a sandbox implementation. I have started some proof-of-concept work on an implementation of a sandbox on OpenBSD (https://github.com/DeciSym/openbsd-port-codex/issues/1).
9 Comments
With all the respect , for openbsd usage ,
the codex openbsd , is an experimental port
the https://marc.info/?l=openbsd-ports&m=176853999431595&w=2
mention a local port of codex , to use lllmccp
<img width="737" height="794" alt="Image" src="https://github.com/user-attachments/assets/34ee2694-55c5-4140-8b65-c6a36d57d8a3" />
and I see you forked the project , and made beautiful expirementation
and
https://github.com/openai/codex/blob/35aaa5d9/codex-rs/linux-sandbox/src/linux_run_main.rs
which take use of
https://docs.rs/landlock/latest/landlock/
and
https://github.com/openai/codex/blob/35aaa5d9fcb606fb6f27dd5747ecab3f4ba0c07e/codex-rs/sandboxing/src/seatbelt_tests.rs
seatbelt for macintosh
and for openbsd abd freebsd
there isnt something clear beside
Capsicum (freebsd)
OpenBSD pledge(2) manual (c++ function for sandboxing? / kernel feature of openbsd) https://man.openbsd.org/pledge.2
OpenBSD unveil(2) manual(cc++ function for sandboxing? / kernel feature of openbsd https://man.openbsd.org/unveil.2)
and FreeBSD Jail? which I dont understand really, Its like using a VM or docker ... when sandboxing, is a different feel
as per AIX (which I use to love too doesnt appear to have any sandboxing beside ) -- so should use now port AIX to have codex user expirence cli? like you can maybe enjoy AIX , because you found a POWER9 ibm second hand server,
----
after using some llm , I found this paper,
which says pledge and unveil , is a simular capability
<img width="708" height="340" alt="Image" src="https://github.com/user-attachments/assets/f6b18ac7-9b8e-44a3-9fe1-a742bf77eafc" />
https://arxiv.org/pdf/2509.18548
(maybe shed insights on bsd sandboxing , I couldnt find a https://docs.rs/landlock/latest/landlock/ rust-landlock project for openbsd)
and its not a magic library for openai they can use for sandboxing in rust, or for anyone who tries to make a freebsd/openbsd port ---- personally I think its correct only to support linux/windows/macos , because of rust limitation? KERNEL API limitation or whatever?
refrenching
https://github.com/landlock-lsm/rust-landlock/tree/main/src
landlock(linux, and used by codex- openai)
--
other approch I see , which is running the coding-client within a jail some how
https://wal.sh/research/2026-agent-isolation-freebsd-jails/index.html
edit 3#
https://github.com/i80and/pledge-rs/blob/master/src/promise.rs#L48
there is a pledge-rd which was last maintained 6 years ago
so never the less , sandboxing might be possible , and no need to write a pledge library for rust
@Mahkhmood9 - thanks for the references. My initial approach is to begin with the Codex configuration and policy semantics that Codex advertises to its users (e.g., https://github.com/openai/codex/blob/178c3d30053ba63d118ee93a0dbe2716a12e5769/codex-rs/app-server-protocol/src/protocol/v2/permissions.rs#L593). The Codex policies are supported with differing mechanisms by the underlying OS-specific sandboxing implementations. My initial proof-of-concept needs to identify what can and can't actually be enforced by OpenBSD so that users can have a comprehensible and auditable relationship between the Codex policy semantics and the the controls. I am starting with unveil(), pledge(), and pledge() with execpromises as key components of an implementation.
initial proof-of-concept needs to identify what can and can't actually be enforced by OpenBSD so that users can have a comprehensible and auditable relationship between the Codex policy semantics and the the controls. I am starting with unveil(), pledge(), and pledge() with execpromises as key components of an implementation.
worth mentioning, PLEDGE or UNVEIL , arent the same thing as BWRAP(Linux, and in the codex-rs project)
https://man.openbsd.org/pledge.2
pledge is not sandboxing / container
I want to mention
https://github.com/samuelkarp/runj
which was mention in https://github.com/opencontainers/runc/issues/1501
https://github.com/containers/bubblewrap
(openai codex imports this vendor https://github.com/openai/codex/tree/main/codex-rs/vendor/bubblewrap)
mention
binctr, <img width="700" height="581" alt="Image" src="https://github.com/user-attachments/assets/229f6c42-5daf-4123-89e3-bed30528aaf2" />
bottom line
https://github.com/dlrobertson/capsicum-rs
https://man.freebsd.org/cgi/man.cgi?query=capsicum
**anything practical Is using capsicum , which is for FreeBSD
Codex-rs support both bwrap and landlock** as per the linux refrence
https://github.com/openai/codex/blob/main/codex-rs/linux-sandbox/src/linux_run_main_tests.rs
https://man.freebsd.org/cgi/man.cgi?query=capsicum
capsicum is the onlything close to bwrap/landlock
unveil/pledge is different its like a Premission based thing
---
as per XNU / DARWIN / MACOS
it actually appears to be simular to Pledge
https://manpagez.com/man/3/sandbox_init/
https://manpagez.com/man/7/sandbox/
https://github.com/openai/codex/blob/main/codex-rs/sandboxing/src/seatbelt.rs
---
anyways in my eyes, linux is the winner here,
but I am not a kernel developer! never been! you likley dont even want sandbox in openbsd, and remove this sandboxing part ---
let along with gpt 5.5 , being mostly training on Linux shell and MacOs shell... But its really and issue , since macos/xnu/darwin as a very simular feel to Bsd systems , in terms of usage,
also even in linux 90% of your linux distros use linux-gnu which is solid (and I HATE POSIX haha) and using Busybox would give issues , with a coding agent
```llm citation
Most coding agents generate shell commands assuming the GNU Coreutils suite. BusyBox, however, uses a single binary to provide stripped-down versions of these tools.
Flag Incompatibility: Agents often use advanced flags (e.g., sed -i behavior differences or grep --perl-regexp). BusyBox applets often support only a fraction of these flags, leading to "invalid option" errors.
Missing Tools: Standard agents might try to use bash specific syntax (like [[ ... ]] or arrays), but many BusyBox environments only provide ash or sh, which are strictly POSIX-compliant and lack those features.
{{not that coding agents use too many commands, but busybox is an example for why not bsd,, yet macos is a thing , so I assume it can figure to use macos-like commands and hygine}}
You likely want to bypass sandboxing functionally (have it not use it all ) for openbsd, and see what else you need to modify --- plus the rust ecosystem is really fun , I am attempting porting codex into freebsd now aswell
https://github.com/DeciSym/codex/tree/openbsd-sandbox has the working proof-of-concept implementing an OpenBSD sandbox enforcing the Codex sandbox policy with all available tests passing.
I have also toyed with it , I got it to run FreeBSD (and there is no other port for it for FreeBSD??????), its pretty cool --- I toyed with it ... also toyed and stripped down ,, its pretty solid ... but I suffer from "Developer Pride Syndrom" when a human like me does a bad quality job,, but so proud he got it barely working -- yet ship a poorly made product (also for example why open source project have so many issues... and why Linux Foundation donation ,,, drive actually good coding practices that comes from Enterpise and structism ---- being from Kyrgyzstan... and reminder I was at late 20s when the USSR started falling --- so I think about economy a lot --- and structed and oragnism)
Thats cool, but also I think its shows how great linux has become ---- I dont have proofs but I am pretty sure busybox (non gnu) such as Alpine linux , can be very problematic with Codex/ gpt due the nature of GNU . Alltho I am very proud to have a contirbuted some code many many years ago to gnu...
also rises another issue , like how coding agents do not fully ultalize , you grep or whatever , when they can. and they do it better in recent months...
GIT for me is much harder than SVN or CVS, For me atleast.. but it has its place? its like GIT the moment you use it , its better (unrelated, but its a comment as about Busybox)
OpenBSD is a toy project , many Linux developers of the 90s end up in microsoft for example.. Powershell can be decent, and it is useful, but its not perfect... and if OpenBSD is much more stable , than what I seen (when I tried to install it barebone , it crashed because of kernel internet drivers? I had to modify openbsd ? how network drivers causes the machine to crash?) ,, OpenBSD has gotten better, because its the same developers who also in the linux kernel developent sphere.
Ai system in the future should adopt , to learn more paramers .... Because tool have complexity... Or if they dont , and if they dont ... it prove why we human dont use it (the gnu vs busybox debate).... a lot of systems like Alpine Linux uses busybox ``
ls, grep, sed, or awk) are "stripped down" to save space``` ... in the same way its pretty funny, even us humans have like "system prompts" Oh I now should act like I am going to use MacOS.. going to use this best practices))Alpine uses Ash (via BusyBox) yet it coding agents now need to adopt magically ,,, I also wonder how those Linux Eval , compare on exotic machines such as OPENBSD
Thanks))
Edit:: I marked this comment as irrlevant , because its also iirelvant to the discussion PLEDGE, UNVEILE and Sandboxing such as Landlock ,,, systemd nspawn,, docker,,, sandboxing,,, freebsd-jails (the ones on XNU --- and the whatever reason its a research topic ,,, and a Sales pitch into selling another feature to the linux kernel)
@Mahkhmood9 codex in OpenBSD ports for few months, and it is quite useful. If you have suggestion how to improve it in OpenBSD / ports, please share with me.
Yes, it works well with both llama-server from ports and with OpenAI cloud.
Its very broken ? also sandboxing isnt a thing there (not that i care) I had some issues when using it on a FreeBSD barebone machine, rust is really fun in thoery I was also able to get it on a PowerPC-cpu too. Also got it to work o FreeBSD --- I also have a MIPS device I want to port just for nostalgia sake --
to be improve , having like a testing pattern -- right now I am expirementing with LLM - how to vibe code it... Rust is really been smooth for me atleast.... Im sure you can give the llm to summrize what needed testing - what you need to moderate and view (and only gpt 5.4 does it effectivly) gpt is the only thing that feel "agentic" in the true sense of the world , in terms of acting and summerizing --- anything else is an okay autocomplete
both llama and cloudworks --- my memory is a bit rusty and not what it used to be ---- bit I wasnt able to your your port -- so I used the
git clone https://github.com/openai/codex -bMy most eldest grandson is about to turn 11, I really regret really pushing against board design with my own children (my boys and girls) because of .. Flux fumes / rosin smoke... alcohol/ethenol vapour (because I consider it not kosher nor haram) ... I myself got a stroke many years ago I think because of some the solvants I also have very high levels of Arsenic in my blood.... I still have scars from working so heavily with reparing some Industrial equipment (and the irritation scars) but granted I seen people who some how got heavier dose - so I likely was up to protocol ... Atsome point we relized it was something entirely else , after 10 years we made a policy not to repair too heavily nor modify --- but buy second exported stuff --- but granted a lot of things can be bypassed and literally used in analog pillosophy --- but granted the best idea is to just contact a forgien company - being ex soviet country - you always have the feel you need to repair it yourself -- when its not the case 30 years later... and granted things are a lot safer ... to be granted when we attempt to buy broken equipment -- its practally brand new stuff - which is funny everything is in the manual -- you assume people get very handy when it comes to this kind of rugged equitment but you be surprised - when for example "you just asking" and not looking for someone who sells
as per FreeBSD I think its really funny , how bad linux was in terms of wide support -- in terms of the best expirerince in software support I think Windows XP and 95 were very solid and freeBSD, a lot of issues in the core level... with Windows or FreeBSd if you ever had issues is because it turns out you bought a faulty ram set ..... I really really like MIPS and OpenPC --- I recently ditched about 40 Juniper Networks NetScreen device , they were running for about 11.5 years striaght (along with a UPS backup) granted about 5 years ago, some the server rack fell on the ground smashing --- and they are in a warehouse ---- only 1 router was sacrificed (destroyed) --- in my house I have a modified router with some SDRAM modification , upgrated to 128mb (those are magical )
(some of the Juniper routers literally grow black mold because they were so badly maintained)
to be fair I dont trust most of the new software -- and we are working hard to modernize -- right now as per what around everything is working okay --- people are able to heat their houses --- a lot of things in terms of safety has improved ----
and everything is a product in the end of the day its designed to be used no matter who made it .... Right remmeber when we moved to PCIEXPRESS but then they are still being issues anything so called second hand we bought is the only thing that lasts so much time.... Some of the new folks here attempt to move the routing to modern servers
both of my parents were immgrants from the korean penisula , that being said none of the relatives of my dad nor my mom had faced anything, infact he even visited korea few time in the 80s - but after, Ceaucescu , Pyongyang viewed the downfall of Ceausescu - and travel was banned... and the deportation thing was a reward thing historically --- but I again I really really hate using expesnive sources --- but again its a mentality mindset
As per FreeBSD or Mips or OpenPC , I guess I am a living fossil , but I actually advocate on modernizing as people throw up a lot of good equipment abaord :) -- and I am not a big fan of it because I was using MacOS/XNU for many years... Its like a self relience kind of thing -- you should not buy anything that will break -----
and you see my father was mummbeling nonstop about americans bombing koreans.. and its a complex topic.... but dont forget how much the USSR , and the asians states , how much they like and praise american technology ---- I cant subscribe to the idea that anything american is good, but nor non american hardware and software ---
thats why im a cheapstack
and in the end a lot of it comes to portiablity , and how often you can port software ---- for me I really try to avoid Japanese anything because what they did to chinese and korean people. The damage they did you can even see on people that are living in Taiwan. And what you are going to do mistreat-Japanese people? Avoid japanese people? most of the japanese people are peaceful (and my father was thinking the same) they seem to be now ---
if there is something that is not analog ,, and require linux I guess I will use it --- but it really doesnt matter
should you Galvanic Isolation,, or trust the ip64 label (water proof label)- and trust the specifcation? (as per what OS)
or you should put some
(I had great success with putting Polyurethanes {PU} ) I basically toy with some decommission non waterproof part not a while ago , it seems to be okay (another copy didnt survive --- I know for a fact because someone clever got the fire alarm system off which sprays foam internally on some Overload Protection Unit)//// I even noticed a P210A(soviet made) Transistor modification with a 40 year old modded bootleged on some speaker , pretty much just this one resistor , and no complex non-germanium based transsitors - not a lot of drawbacks (very interesting stuff )--- huh the other part exploded without Polyurethanes --- I guess god work in mystrious ways..
granted thresshold are allows lower than label, but second-hand gear is a ticking time bomb. Micro-fractures, stress corrosion cracking, so its a mixture of refrubrusing and enhancing methrial usage ... Luckily im pretty sure the place is just as safer as you can see some european and american companies ....
when it comes to chemical processing chain, and chemical processing - should you make the large invest in export or beg for second hand hardware
When you get a new product shipped should attempt to test the label , or attempt to keep production low for safety reasons?
With chermical bi-product(waste) do you chemically treat it to become solid or not... I have my guilt, but I have my pride what was stopped ----chemically treating the chemical waste is expsnive --- so they dont leak or dissolve even in a solid state (Chemical Precipitation , when you turn chemicals into salt) (now we sell the waste for china because they find the biproducts attactive -- so you dont store them in a containers)
as per workers safety non of the workers post 2005 have anything in their blood in result of working with harsh chemicals --- and granted , worker safety comes last ,, the first priority is not plueting the envrioment
(some argue defacing montains for minerals , (taking the ore) ) (one of the gold companies here had some minor Cyanide leakage into some water - we caught it fast - due to our protocols [but again if fish will start to die, and people will point at you] )
how long you can sell the idea that the "rare earth metals" really worth anything ... so think about that -- they already wasted a lot of money with the new sodium cyanide as of the one highest operating costs of a gold mine, companies try to reuse as much of it as possible
so in theory they now do it like the west does it
[Barren Solution] --> [reused back]
and the biproduct is sold to a copper refinery (which has high standards)
and they do some new novel SART (Sulfidize, Acidify, Recycle, and Thicken) ,
before they almost dump acids and fluids into the water?? we dont know how much damage they did --- and some canadian company were the one that was advising how to fix it (its such a bad investment no to care even -- even if there is no relgulation here)
I am not saint in terms of defacing montains and nature---- but no fish shall die -- nothing should be forever
---
and the data is very promising for many years in a row - not having a serious effect --- and lets be fair we can triple export with very minor investment -- but risk and reward- we/the-company are able to heat our houses and pay well employees?
all of it is very complex AND NOT PERFECT, so much biproduct its better to just sell the waste
they are many american chemical companies that are very bad,, yet europeans and americans held to the highest standards (and because neacular energy originated from this places so the safety guildlines are very clear --- and not written specs by-now dead people ... )--- but they are many companies who keep up to standards and regulation --- the world problems not going to be over because everyone found a porpuse , but for me its a gold standard to copy how companies work under forgein law , because regulation where I live is non existant --- as the old generation leave on a pale white wooden ship --- its the new generation job to be obbsessed on past issues