Issue Station
Sign In
Tools hereToolbox

codex - 💡(How to fix) Fix codex cli sandbox blocks tokio signal handling on UnixStream/socketpair(AF_UNIX...) [1 comments, 1 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openai/codex#20427•Fetched 2026-05-01 05:43:11
View on GitHub
Comments
1
Participants
1
Timeline
5
Reactions
0
Author
ahornbyahornby
Participants
ahornbyahornby
Timeline (top)
labeled ×3commented ×1unlabeled ×1

Error Message

codex ... › run in sandbox: /spare/local/ahornby/.micromamba/envs/rattler-build/bin/rattler-build --version

• Ran in the sandbox. It exited with code 1 and printed:

thread '<unnamed>' (5) panicked at .../tokio-1.51.1/src/signal/unix.rs:71:53: failed to create UnixStream: Os { code: 1, kind: PermissionDenied, message: "Operation not permitted" } note: run with RUST_BACKTRACE=1 environment variable to display a backtrace Error: × Thread panicked

Code Example

codex
...
› run in sandbox: /spare/local/ahornby/.micromamba/envs/rattler-build/bin/rattler-build --version

• Ran in the sandbox. It exited with code 1 and printed:

  thread '<unnamed>' (5) panicked at .../tokio-1.51.1/src/signal/unix.rs:71:53:
  failed to create UnixStream: Os { code: 1, kind: PermissionDenied, message: "Operation not permitted" }
  note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
  Error:   × Thread panicked

---

codex
...
› run in sandbox: /spare/local/ahornby/.micromamba/envs/rattler-build/bin/rattler-build --version

• Ran /spare/local/ahornby/.micromamba/envs/rattler-build/bin/rattler-build --version
  └ (no output)

──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────

• rattler-build 0.63.1

---

model = "gpt-5.5"
model_reasoning_effort = "medium"
approvals_reviewer = "user"

default_permissions = "workspace"

[shell]
program = "/bin/bash"
args = ["--noprofile", "--norc"]

[permissions.workspace.filesystem]
":root" = "read"
":tmpdir" = "write"

[permissions.workspace.filesystem.":project_roots"]
"." = "write"

[permissions.workspace.network]
enabled = true
# full is still filtered by domain but allows POST etc (c.f. limited)
mode = "full"
# needed to resolve local 10.* IPs
allow_local_binding = true

[permissions.workspace.network.domains]
"example.com" = "allow"
RAW_BUFFERClick to expand / collapse

What version of Codex CLI is running?

0.125.0

What subscription do you have?

Enterprise ChatGPT and api key

Which model were you using?

gpt-5.5

What platform is your computer?

linux Ubuntu 24.04 Linux 6.14.0-37-generic x86_64 x86_64

What terminal emulator and version are you using (if applicable)?

iTerm2 ssh to tmux session on linux

What issue are you seeing?

I can't run programs that use rust tokio signal handling inside sandbox. Noticed it with the rattler-build tool which is a cli build tool used in conda environments, even running rattler-build --version fails

What steps can reproduce the bug?

install rattler-build somewhere, e.g. brew install rattler-build or micromamba create -y -n rattler-build rattler-build

run codex with sandbox enabled:

codex
...
› run in sandbox: /spare/local/ahornby/.micromamba/envs/rattler-build/bin/rattler-build --version

• Ran in the sandbox. It exited with code 1 and printed:

  thread '<unnamed>' (5) panicked at .../tokio-1.51.1/src/signal/unix.rs:71:53:
  failed to create UnixStream: Os { code: 1, kind: PermissionDenied, message: "Operation not permitted" }
  note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
  Error:   × Thread panicked

What is the expected behavior?

Expect that rattler-build --version works, e.g.

codex
...
› run in sandbox: /spare/local/ahornby/.micromamba/envs/rattler-build/bin/rattler-build --version

• Ran /spare/local/ahornby/.micromamba/envs/rattler-build/bin/rattler-build --version
  └ (no output)

──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────

• rattler-build 0.63.1

socketpair(AF_UNIX, ...) is a common local IPC primitive. Blocking socketpair is probably overly broad if the intent is preventing host socket access. Allowing socketpair(AF_UNIX, ...) while continuing to deny socket(AF_UNIX, ...)/connect/ bind would likely fix Tokio-style internal IPC without reopening the obvious host-UDS bypass.

Additional information

Config used:

model = "gpt-5.5"
model_reasoning_effort = "medium"
approvals_reviewer = "user"

default_permissions = "workspace"

[shell]
program = "/bin/bash"
args = ["--noprofile", "--norc"]

[permissions.workspace.filesystem]
":root" = "read"
":tmpdir" = "write"

[permissions.workspace.filesystem.":project_roots"]
"." = "write"

[permissions.workspace.network]
enabled = true
# full is still filtered by domain but allows POST etc (c.f. limited)
mode = "full"
# needed to resolve local 10.* IPs
allow_local_binding = true

[permissions.workspace.network.domains]
"example.com" = "allow"

extent analysis

TL;DR

Allowing socketpair(AF_UNIX, ...) in the sandbox configuration may resolve the issue with running programs that use Rust Tokio signal handling.

Guidance

  • The error message indicates a permission denied issue when creating a UnixStream, which is related to socketpair(AF_UNIX, ...).
  • The current sandbox configuration may be overly broad, blocking socketpair(AF_UNIX, ...) which is a common local IPC primitive.
  • To verify, try running the program outside of the sandbox to see if it works as expected.
  • Consider modifying the sandbox configuration to allow socketpair(AF_UNIX, ...) while continuing to deny socket(AF_UNIX, ...)/connect/bind.

Example

No code snippet is provided as the issue is related to configuration and permissions.

Notes

The provided configuration file does not explicitly mention socketpair or UnixStream permissions, so it is unclear how to modify it directly. Further investigation into the Codex CLI documentation and configuration options may be necessary.

Recommendation

Apply workaround: Modify the sandbox configuration to allow socketpair(AF_UNIX, ...) if possible, as this is likely to resolve the issue with running programs that use Rust Tokio signal handling.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#api#dependency error#configuration error#environment variable#network issue

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING

codex - 💡(How to fix) Fix codex cli sandbox blocks tokio signal handling on UnixStream/socketpair(AF_UNIX...) [1 comments, 1 participants]