Document the Landlock requirement for Linux

What is the type of issue?

Documentation is missing

What is the issue?

It might be worth documenting that when LandLock is not built into the Linux kernel that by default codex won't be allowed to execute commands even if we set:

approval_policy       = "on-request"
sandbox_mode          = "workspace-write"

or even

approval_policy       = "never"
sandbox_mode          = "workspace-write"

and that we will get errors like:

$ codex --sandbox workspace-write --ask-for-approval never

› can you confirm you can execute commands based on the sandbox that is configured for this folder

• I’ll quickly run pwd, list files, and create/remove a temp file to confirm command execution and write access here.

• Ran set -euo pipefail
  │ printf 'CWD: '
  │ pwd
  │ … +8 lines
  └
    thread 'main' panicked at linux-sandbox/src/linux_run_main.rs:30:9:
    error running landlock: Sandbox(LandlockRestrict)
    note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace

─ Worked for 36s ─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────

• I tried running basic commands, but command execution is blocked here. The sandbox failed with: “error running landlock: Sandbox(LandlockRestrict)”, so even simple
  reads like pwd/ls didn’t run.

  - Current status: I can’t execute shell commands in this environment.
  - What I can do: read and edit files via patches; review code; propose changes.
  - To enable commands: rerun with a mode that allows execution (e.g., disable Landlock, switch sandbox to danger-full-access, or allow escalated/unsandboxed
    commands).

This would allow avoiding lots of issues being created like:

• https://github.com/openai/codex/issues/2267
• https://github.com/openai/codex/issues/3140

Where did you find it?

_No response_