[BUG] The default read-only mounting mode is too strict; even chained files cannot be created.

Open 💬 1 comment Opened Aug 5, 2026 by LIghtJUNction

During the review process, the git show --show-signature command was executed, which utilized GnuPG. However, the sandbox configured ~/.gnupg as read-only.
GnuPG 2.4’s keyboxd requires the creation of lock files, resulting in an error:

Read-only file system
Unable to connect to the KeyBoxd service.
No Keybox daemon is running.
Unable to verify signature: No public key available.

The last line of text can be misleading. It actually indicates that “the public key database cannot be opened”, rather than saying that “there are no public keys on the machine”.

View original on GitHub ↗

1 Comment

LIghtJUNction · 18 days ago

I implemented a candidate fix for this issue in my fork:

  • Supported non-setuid Linux bubblewrap read-only sandboxes now add a scoped ephemeral --tmp-overlay for ~/.gnupg, allowing GnuPG keyboxd to create lock state without writing to the host.
  • PR: https://github.com/LIghtJUNction/codex/pull/1
  • Commit: 4c9440e8d

My account cannot create the upstream PR because it has read-only permissions on openai/codex. Please review the fork PR or cherry-pick the commit. just fmt and a manual bwrap/GPG probe passed; scoped Rust tests were blocked before compilation by an aws-config crates.io download timeout.