Issue Station
Sign In
Tools hereToolbox

codex - 💡(How to fix) Fix Linux sandbox failure (bwrap: Failed RTM_NEWADDR) causes all workspace edits to require sandbox bypass [2 comments, 3 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openai/codex#17337•Fetched 2026-04-11 06:17:26
View on GitHub
Comments
2
Participants
3
Timeline
9
Reactions
0
Author
cramjacocramjaco
Participants
cramjacocramjacogithub-actions[bot]github-actions[bot]viyatb-oaiviyatb-oai
Timeline (top)
labeled ×3commented ×2closed ×1mentioned ×1

Fix Action

Fix / Workaround

The following workaround failed.

This workaround worked

Workaround

RAW_BUFFERClick to expand / collapse

What version of Codex CLI is running?

codex-cli 0.118.0

What subscription do you have?

Plus

Which model were you using?

gpt-5.4

What platform is your computer?

Linux 6.8.0-100-generic x86_64 x86_64

What terminal emulator and version are you using (if applicable)?

GNOME Terminal 3.52.0

What issue are you seeing?

What issue are you seeing?

Codex cannot perform file edits within the workspace under the default Linux sandbox. Even trivial operations (e.g., creating a new file) fail and trigger:

Reason: command failed; retry without sandbox?

This occurs consistently in normal writable directories.

Direct sandbox commands also fail:

codex sandbox linux -- pwd

with:

bwrap: loopback: Failed RTM_NEWADDR: Operation not permitted

As a result, Codex cannot execute any sandboxed commands and requires bypassing the sandbox for all edits.

What steps can reproduce the bug?

  1. Start Codex in a normal writable directory: mkdir -p ~/Projects/CodexTest cd ~/Projects/CodexTest codex
  2. Enter the prompt: Please create a test file Test.md
  3. Codex proposes the edit, then fails with: Reason: command failed; retry without sandbox?

What is the expected behavior?

Sandbox should function under workspace-write Codex should be able to create/edit files in the current workspace without requesting sandbox bypass

Additional information

The following workaround failed.

Configuration

Codex reads configuration from:

~/.codex/config.toml

If this file does not exist, create it:

mkdir -p ~/.codex nano ~/.codex/config.toml

Add the following:

sandbox_mode = "workspace-write" approval_policy = "on-request"

Save the file and restart Codex.

This does not resolve the issue.

This workaround worked

Workaround

Edit the same config file:

nano ~/.codex/config.toml

Add:

[features] use_legacy_landlock = true

Full example config:

sandbox_mode = "workspace-write" approval_policy = "on-request"

[features] use_legacy_landlock = true

Save the file and restart Codex.

After enabling this:

codex sandbox linux -- pwd succeeds Codex can create/edit files normally within the workspace

Notes Issue persists across versions (0.117.0 and 0.118.8) Appears specific to Linux sandbox (bubblewrap) path Likely interaction with Ubuntu 24.04 / AppArmor user namespace restrictions Landlock fallback works reliably, suggesting regression or incompatibility in bwrap-based sandbox

Summary

The bwrap-based sandbox fails on Ubuntu 24.04 with:

Failed RTM_NEWADDR: Operation not permitted

This breaks all normal Codex editing workflows unless sandbox bypass is allowed.

The Landlock fallback (use_legacy_landlock = true) fully resolves the issue.

Impact Prevents basic usage of Codex CLI on affected Linux systems Forces users to disable sandbox protections or manually approve every edit Likely affects multiple users on modern Ubuntu systems

Related

This behavior appears similar to other recent reports of sandbox-related failures (e.g., issue #12888).

Thanks for taking a look — happy to provide additional diagnostics if useful.

extent analysis

TL;DR

Enabling the Landlock fallback by setting use_legacy_landlock = true in the Codex configuration file resolves the sandbox issue on Ubuntu 24.04.

Guidance

  • The issue is likely caused by an incompatibility between the bwrap-based sandbox and Ubuntu 24.04's AppArmor user namespace restrictions.
  • To resolve the issue, edit the ~/.codex/config.toml file and add the following lines:
    • sandbox_mode = "workspace-write"
    • approval_policy = "on-request"
    • [features]
    • use_legacy_landlock = true
  • Restart Codex after saving the changes to apply the new configuration.
  • Verify that the issue is resolved by running codex sandbox linux -- pwd and attempting to create or edit files within the workspace.

Example

No code snippet is necessary, as the solution involves modifying the configuration file.

Notes

The issue appears to be specific to Ubuntu 24.04 and the bwrap-based sandbox, and the Landlock fallback provides a reliable workaround. The problem may be related to other reports of sandbox-related failures.

Recommendation

Apply the workaround by enabling the Landlock fallback, as it fully resolves the issue and allows for normal usage of the Codex CLI on affected Linux systems.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#agent execution#callback error#memory management#API rate limit#retriever error

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING