Linux sandbox can exceed bubblewrap 9000 argument limit with many bind mounts

Problem

Codex can generate very large bubblewrap invocations on Linux when a workspace or profile expands into many read-only bind mounts. On the VM used for Codex parity checks, the sandbox proof rows fail before the actual sandbox behavior is exercised because bubblewrap exits with:

bwrap: Exceeded maximum number of arguments 9000

This appears to be the same upstream limit tracked in containers/bubblewrap#703. The Codex downstream pressure point is the Linux sandbox command construction around bind arguments, especially many --ro-bind entries.

Why this matters

The current failure mode turns a sandbox correctness check into an argument-count failure. It makes it difficult to distinguish:

• a real sandbox policy regression
• a local profile with many mounts
• an upstream bubblewrap argument cap

For Codex integrations that need runtime proof, this blocks honest verification. The local doctor has to report the row as a known upstream gap instead of PASS.

Requested direction

Please consider one of these approaches for the Codex Linux sandbox path:

1. Consolidate repeated --ro-bind mounts where possible before invoking bubblewrap.
2. Use an fd-loaded argument mechanism if bubblewrap grows support for a mode that does not count fd-loaded arguments against the 9000 argument cap.
3. Add a Codex-side preflight that detects the bubblewrap argument count and returns a clear diagnostic with the relevant upstream issue before invoking bubblewrap.

Related upstream issue

• containers/bubblewrap#703

Acceptance signal

A Codex sandbox run with a large mount profile should either execute the sandbox proof or fail with a Codex-owned diagnostic that identifies the bubblewrap argument limit and the remediation path.