panic due to sandbox. error running landlock: Sandbox(LandlockRestrict)

note: it worked after I ran it as codex -s workspace-write. But I don't know why it failed originally. I did accept all requests to allow it to execute commands.

Getting this within NixOS as well.

Output of uname -mprs is Linux 6.6.97+ x86_64 unknown

Same problem on Ubuntu

Linux 5.14.0-427.76.1.el9_4.x86_64 x86_64 x86_64

Root cause/solution in #3140, tl;dr: Missing landlock in the Linux kernel, install or build a kernel with CONFIG_SECURITY_LANDLOCK=y

Getting this problem as well. Building a kernel seems not possible since I dont have root on the machine I use

debian, same problem

Codex should probably be (a lot) clearer about landlock being required for sandboxing to work, and should _check_ if the sandbox works before running.

@adrianmihalko From what I can tell/from what google tells me, Debian has refused to support Landlock since 2022 with no explanation why, seemingly with no mention of it since.
Almost every other distro supports it out of the box by default.
I doubt Codex is planning to completely redo its sandboxing using some other method, so your (and anyone else's running into this issue) options are:

1. Convince Debian to ship a landlock-enabled kernel;
2. Build your own landlock-enabled kernel
3. Use pretty much any other modern distro (even EL supports it ootb)
4. Disable sandboxing entirely. Codex will run fine if you disable sandboxing/enable full read/write, but it will be able to touch your entire system in any way it wants, so it is a non-trivial risk.

In my view, Landlock isn't a good selection due to its limited adoption. My development environment, for example, is a docker container, but I don't have visibility into the underlying cluster infrastructure, nor can I propose adaptation measures to the appropriate team

Same problem on a custom Linux with codex 0.58

$ codex --sandbox workspace-write --ask-for-approval never

› can you confirm you can execute commands based on the sandbox that is configured for this folder

• I’ll quickly run pwd, list files, and create/remove a temp file to confirm command execution and write access here.

• Ran set -euo pipefail
  │ printf 'CWD: '
  │ pwd
  │ … +8 lines
  └
    thread 'main' panicked at linux-sandbox/src/linux_run_main.rs:30:9:
    error running landlock: Sandbox(LandlockRestrict)
    note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace

─ Worked for 36s ─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────

• I tried running basic commands, but command execution is blocked here. The sandbox failed with: “error running landlock: Sandbox(LandlockRestrict)”, so even simple
  reads like pwd/ls didn’t run.

  - Current status: I can’t execute shell commands in this environment.
  - What I can do: read and edit files via patches; review code; propose changes.
  - To enable commands: rerun with a mode that allows execution (e.g., disable Landlock, switch sandbox to danger-full-access, or allow escalated/unsandboxed
    commands).

OK so https://github.com/openai/codex/issues/2267#issuecomment-3338689060 is helpful... but not sure why in my case my kernel says it has landlock but I still get the error above then:

$ uname -r
6.12.0-104.43.4.2.el9uek.x86_64
$ grep LANDLOCK /boot/config-$(uname -r)
CONFIG_SECURITY_LANDLOCK=y

@saidelike If your kernel has built-in config (/proc/config.gz) check it just in case.

I have the same problem when running a Docker dev container on macOS. Docker Desktop’s VM ships its own Linux kernel, so there’s no exposed switch for picking a different build, which makes it hard to work around kernel-specific regressions. Is there a supported way to test against an alternate kernel version in this setup?

Is there a supported way to test against an alternate kernel version in this setup?

Official builds of Codex require Landlock support. You could either update the Linux kernel in your docker container or modify the Codex source and build your own private copy that eliminates the Landlock dependency.

i am getting this,

my codex.yml action

  codex:
    runs-on: ubuntu-slim # https://docs.github.com/en/actions/reference/runners/github-hosted-runners#single-cpu-runners
    timeout-minutes: ${{ inputs.timeout-minutes }}
    if: github.actor != 'dependabot[bot]'
    permissions:
      contents: read
    outputs:
      final_message: ${{ steps.run_codex.outputs.final-message }}
    steps:
      - uses: actions/checkout@v6
        with:
          # Explicitly check out the PR's merge commit.
          ref: refs/pull/${{ github.event.pull_request.number }}/merge

      - name: Pre-fetch base and head refs for the PR
        run: |
          git fetch --no-tags origin \
            ${{ github.event.pull_request.base.ref }} \
            +refs/pull/${{ github.event.pull_request.number }}/head

      - name: Run Codex
        id: run_codex
        uses: openai/codex-action@v1
        env:
          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
          CODEX_API_KEY: ${{ secrets.OPENAI_API_KEY }} # per AI needs to be set to avoid 401 errors
        with:
          openai-api-key: ${{ secrets.OPENAI_API_KEY }}
          safety-strategy: drop-sudo
          sandbox: workspace-write
          prompt: |
            The workspace is /home/runner/work/${{ github.repository }}/${{ github.repository }}

            This is PR #${{ github.event.pull_request.number }} for ${{ github.repository }}.
            Base SHA: ${{ github.event.pull_request.base.sha }}
            Head SHA: ${{ github.event.pull_request.head.sha }}

            Review ONLY the changes introduced by the PR.
            Suggest any improvements, potential bugs, or issues.
            Be concise and specific in your feedback.

            Pull request title and body:
            ----
            ${{ github.event.pull_request.title }}
            ${{ github.event.pull_request.body }}

logs

Run openai/codex-action@v1
Run actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
Attempting to download 20...
Acquiring 20.20.1 - x64 from https://github.com/actions/node-versions/releases/download/20.20.1-22746716736/node-20.20.1-linux-x64.tar.gz
Extracting ...
/usr/bin/tar xz --strip 1 --warning=no-unknown-keyword --overwrite -C /home/runner/work/_temp/bb8d7fcc-865a-4684-a5b6-3fac7f861bba -f /home/runner/work/_temp/ba4a19f4-7c90-45c2-8b24-fb15359e48a4
Adding to the cache ...
Environment details
Run node "/home/runner/work/_actions/openai/codex-action/v1/dist/main.js" check-write-access \
Checking write access for actor 'skilbjo' on xhrdev/proxy
Actor 'skilbjo' has permission level 'admin'.
Actor 'skilbjo' is permitted to continue.
Run npm install -g "@openai/codex@"
added 2 packages in 3s
Run npm install -g "@openai/codex-responses-api-proxy@"
added 1 package in 1s
Run node "/home/runner/work/_actions/openai/codex-action/v1/dist/main.js" resolve-codex-home \
Resolved Codex home: /home/runner/.codex
Run server_info_file="/home/runner/.codex/22838956934.json"
Run server_info_file="/home/runner/.codex/22838956934.json"
Run upstream_url=""
responses-api-proxy listening on 127.0.0.1:35341
Run server_info_file="/home/runner/.codex/22838956934.json"
Run node "/home/runner/work/_actions/openai/codex-action/v1/dist/main.js" read-server-info "/home/runner/.codex/22838956934.json"
Run node "/home/runner/work/_actions/openai/codex-action/v1/dist/main.js" write-proxy-config \
  
Run server_info_file="/home/runner/.codex/22838956934.json"
Run node "/home/runner/work/_actions/openai/codex-action/v1/dist/main.js" read-server-info "/home/runner/.codex/22838956934.json"
Run node "/home/runner/work/_actions/openai/codex-action/v1/dist/main.js" write-proxy-config \
  
Run case "${RUNNER_OS}" in
  
runner is not a member of the sudo group.
Removed runner entry from /etc/sudoers.d/runner
No runner entries found in /etc/sudoers requiring changes.
Groups for runner after cleanup: runner adm users systemd-journal
Run if sudo -n true 2>/dev/null; then
Confirmed sudo privilege is disabled.
Run node "/home/runner/work/_actions/openai/codex-action/v1/dist/main.js" run-codex-exec \
Running: CODEX_HOME=/home/runner/.codex codex "exec" "--skip-git-repo-check" "--cd" "/home/runner/work/proxy/proxy" "--output-last-message" "/tmp/codex-exec-ZdhtpR/output.md" "--sandbox" "workspace-write"
Reading prompt from stdin...
OpenAI Codex v0.112.0 (research preview)
--------
workdir: /home/runner/work/proxy/proxy
model: gpt-5.3-codex
provider: codex-action-responses-proxy
approval: never
sandbox: workspace-write [workdir, /tmp, $TMPDIR, /home/runner/.codex/memories]
reasoning effort: none
reasoning summaries: none
session id: 019cd0f9-7cd4-7d70-9b6a-306cc932c2ad
--------
user
This is PR #538 for xhrdev/proxy.
Base SHA: b6140a84ad23b2e0cd9b63d9b19bbe543a665d12
Head SHA: 6321660ae37451290fc27754020a81ab9bda0467
Review ONLY the changes introduced by the PR.
Suggest any improvements, potential bugs, or issues.
Be concise and specific in your feedback.
Pull request title and body:
----
refactor: remove hardcoded ua
mcp startup: no servers
codex
Reviewing PR `#538` by diffing `b6140a84...` to `6321660a...` and inspecting only changed files for regressions and edge cases. I’ll report concrete findings with file/line references and keep it concise.
codex
I hit a sandbox runtime error when invoking shell commands, so I’m trying a minimal command path next to verify whether any local git inspection is possible in this session.
codex
Unable to review this PR’s changes from the repo in the current session because every shell command fails before execution with:
Unable to review this PR’s changes from the repo in the current session because every shell command fails before execution with:
`error applying legacy Linux sandbox restrictions: Sandbox(LandlockRestrict)`
`error applying legacy Linux sandbox restrictions: Sandbox(LandlockRestrict)`
So I can’t access `git diff b6140a84..6321660a` locally.
So I can’t access `git diff b6140a84..6321660a` locally.
``