Start Codex from ~/.local/bin/codex:

  cd ~/bin
  codex

  Then ask Codex to run:

  pwd

  The command fails before execution with:

  bwrap: execvp /home/jk/.codex/tmp/arg0/codex-arg0.../codex-linux-sandbox: No such file or directory

  The generated launcher exists and resolves on the host:

  readlink /home/jk/.codex/tmp/arg0/codex-arg0.../codex-linux-sandbox
  # /home/jk/.local/bin/codex

  readlink -f /home/jk/.codex/tmp/arg0/codex-arg0.../codex-linux-sandbox
  # /home/jk/.local/bin/codex

  ls -lL /home/jk/.codex/tmp/arg0/codex-arg0.../codex-linux-sandbox
  # -rwx------ ... /home/jk/.codex/tmp/arg0/.../codex-linux-sandbox

  Copying the exact same Codex binary into the workspace and launching it directly fixes the problem:

  cp ~/.local/bin/codex ~/bin/codex
  chmod 755 ~/bin/codex
  cd ~/bin
  ./codex

  After launching this way, tool commands such as pwd execute successfully:

  /home/jk/bin

  Tool commands should execute successfully regardless of whether Codex is launched from ~/.local/bin/codex or ~/bin/codex, assuming the binary exists and is executable.

  When launched from ~/.local/bin/codex, Codex creates a sandbox launcher under:

  ~/.codex/tmp/arg0/.../codex-linux-sandbox

  as an absolute symlink to:

  /home/jk/.local/bin/codex

  bwrap then fails to execvp that launcher with ENOENT.

  The launcher path exists on the host, but inside the bwrap filesystem namespace the absolute symlink target /home/jk/.local/bin/codex appears not to be visible or resolvable. Copying the
  binary into the workspace avoids the issue, suggesting the sandbox bind mounts include the workspace path but not the absolute symlink target under ~/.local/bin.

wget https://github.com/openai/codex/releases/download/rust-v0.133.0/codex-x86_64-unknown-linux-musl.tar.gz

Checksum verified:

d06019ab9c35d281b78dc2ebb2ae55c2bb97ea11bf7f452bafe390eddb0034ef  codex-x86_64-unknown-linux-musl.tar.gz

Installed with:

mkdir -p ~/.local/opt/codex/0.133.0
mkdir -p ~/.local/bin
tar -xzf codex-x86_64-unknown-linux-musl.tar.gz -C ~/.local/opt/codex/0.133.0
chmod 700 ~/.local/opt/codex/0.133.0/codex-x86_64-unknown-linux-musl
cp ~/.local/opt/codex/0.133.0/codex-x86_64-unknown-linux-musl ~/.local/bin/codex
chmod 755 ~/.local/bin
chmod 755 ~/.local/bin/codex

The binary itself works:

/home/jk/.local/bin/codex --version
# codex-cli 0.133.0

file reports:

/home/jk/.local/bin/codex: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), static-pie linked, stripped