linux-sandbox(bwrap) - GPU Access

What variant of Codex are you using?

CLI

What feature would you like to see?

We would like for sandboxed agents to be able to run GPU-accelerated applications inside the sandbox, but there are two things missing at the moment to make that happen:

1. The sandbox does not mount the various /dev points needed to access a GPU
2. Our driver (libcuda.so) needs to know it is in a sandbox so that we can disable a few non-core features that have no way of working in bwrap but are fatal in a normal environment.

Another agent gives us a consistent env-var for this, but the Codex implementation of bwrap does not have anything that we can key off of.

Additional information

_No response_