SIGTERM when calling from from pid 1

What version of Codex is running?

0.41.0

Which model were you using?

not applicable

What platform is your computer?

any linux container runtime

What steps can reproduce the bug?

Container runtimes use a separate pid space. The root command of the container can see its own pid as 1.

docker run --rm alpine sh -c 'echo $$'
> 1

Since it's expected that codex sometimes be run in a container, its reasonable to assume it sometimes may have pid 1. Let's try it out:

FROM ghcr.io/linuxcontainers/alpine

RUN apk add --no-cache curl tar

RUN curl -fL https://github.com/openai/codex/releases/download/rust-v0.41.0/codex-x86_64-unknown-linux-musl.tar.gz \
	| tar -xz codex-x86_64-unknown-linux-musl \
	&& install codex-x86_64-unknown-linux-musl /usr/local/bin/codex \
	&& rm codex-x86_64-unknown-linux-musl

docker run --rm $(docker build -q .) codex debug landlock true; echo $?
> 143

Uh-oh! 143 is SIGTERM!

Here is the culprit btw: https://github.com/openai/codex/blob/e85742635f8e958c22ad46b5428f16b973c6b38d/codex-rs/core/src/spawn.rs#L82

What is the expected behavior?

_No response_

What do you see instead?

_No response_

Additional information

A likely solution is to check the actual parent id before registering the pre_exec callback, then compare the return value of libc::getppid() to the expected parent id.