›_ Codex Issues
Codex Issues / #9292

Linux: codex-cli 0.81+ sandbox fails with landlock; 0.79/0.80 ignore --sandbox flags

Resolved 💬 7 comments Opened Jan 15, 2026 by vincentsch Closed Jan 15, 2026
💡 Likely answer: A maintainer (etraut-openai, contributor) responded on this thread — see the highlighted reply below.

Summary

On Ubuntu 24.04.3 (Xubuntu), codex-cli 0.81+ fails any sandboxed run with:

error running landlock: Io(Os { code: 1, kind: PermissionDenied, message: "Operation not permitted" })

Only --dangerously-bypass-approvals-and-sandbox works.

Additionally, in 0.79/0.80 the --sandbox flag appears ignored (acts like workspace-write even when read-only or danger-full-access is passed).

Environment

  • OS: Ubuntu 24.04.3 LTS (Xubuntu)
  • Kernel: 6.14.0-37-generic
  • AppArmor enabled; kernel.apparmor_restrict_unprivileged_userns=1
  • /sys/kernel/security/landlock is missing
  • Install method: npm install -g @openai/codex@<version>

Minimal repro (0.81+)

codex exec --sandbox workspace-write \
  -c model=gpt-5.2-codex -c reasoning_effort=xhigh -c max_tokens=8000 \
  --full-auto "Run 'true' using exec."

Expected

  • true executes successfully inside sandbox.

Actual

  • Landlock setup fails with Operation not permitted before command runs.

Version matrix (tested)

| Version | Result (sandboxed run) | Notes |
|---|---|---|
| 0.79.0 | Works | --sandbox read-only still allows /tmp writes; --sandbox danger-full-access still blocks writes outside workspace (flag ignored). |
| 0.80.0 | Works | Same behavior as 0.79.0. |
| 0.81.0 | Fails | Landlock permission denied. |
| 0.84.0 | Fails | Landlock permission denied. |

Additional observations

  • The CLI header always reports sandbox: workspace-write regardless of --sandbox value (0.79/0.80).
  • --dangerously-bypass-approvals-and-sandbox works on 0.81/0.84.

Workaround

  • Pin to @openai/codex@0.80.0, or bypass sandbox (not ideal).

Happy to run more diagnostics if you have specific data to collect.

View original on GitHub ↗

7 Comments

vincentsch · 6 months ago

Opened PR #9295 with a graceful fallback: if unshare/uid_map/mount steps fail with EPERM, skip the new read-only bind mounts and continue with Landlock-only enforcement (pre-0.81 behavior). Tests: cargo test -p codex-linux-sandbox.

smerrill · 6 months ago

This totally ruins Codex CLI's utility on Linux for me. I reverted to 0.80.0.

etraut-openai contributor · 6 months ago

We're working on a fix. Apologies for the regression.

smerrill · 6 months ago

No worries; thanks for a great tool!

etraut-openai contributor · 6 months ago

This should be addressed in 0.85, which has been published. If you're still seeing problems, let us know.

vincentsch · 6 months ago

Update: 0.85.0 fixes the Landlock crash on my Ubuntu 24.04 host.

However, --sandbox read-only still permits /tmp writes and --sandbox danger-full-access still blocks writes outside the workspace, so the CLI still behaves like workspace-write regardless of the flag.

vincentsch · 6 months ago

Figured it out: --full-auto overrides any --sandbox flag by design (forces workspace-write). I wrote it up here: https://www.vincentschmalbach.com/how-codex-cli-flags-actually-work-full-auto-sandbox-and-bypass/