Issue Station
Sign In
Tools hereToolbox

codex - 💡(How to fix) Fix Linux sandbox still fails with `bwrap: Failed to make / slave: Permission denied` on codex-cli 0.130.0 while legacy Landlock works [1 comments, 2 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openai/codex#23468•Fetched 2026-05-20 03:49:27
View on GitHub
Comments
1
Participants
2
Timeline
4
Reactions
0
Author
crabshellmancrabshellman
Participants
crabshellmancrabshellmangithub-actions[bot]github-actions[bot]
Timeline (top)
labeled ×3commented ×1

openai/codex#15434 is closed, but I can still reproduce the same Linux sandbox failure on codex-cli 0.130.0.

The default sandbox path fails with:

bwrap: Failed to make / slave: Permission denied

But the legacy Landlock path works for the same minimal command.

Error Message

  • return an actionable error message that points to the workaround.

Root Cause

openai/codex#15434 is closed, but I can still reproduce the same Linux sandbox failure on codex-cli 0.130.0.

The default sandbox path fails with:

bwrap: Failed to make / slave: Permission denied

But the legacy Landlock path works for the same minimal command.

Fix Action

Fix / Workaround

  • run successfully,
  • fall back to the working legacy Landlock path when bwrap cannot perform the required mount propagation step, or
  • return an actionable error message that points to the workaround.

Code Example



---

bwrap: Failed to make / slave: Permission denied
RAW_BUFFERClick to expand / collapse

What version of Codex CLI is running?

0.130

What subscription do you have?

pro

Which model were you using?

No response

What platform is your computer?

No response

What terminal emulator and version are you using (if applicable)?

No response

Codex doctor report

What issue are you seeing?

Summary

openai/codex#15434 is closed, but I can still reproduce the same Linux sandbox failure on codex-cli 0.130.0.

The default sandbox path fails with:

bwrap: Failed to make / slave: Permission denied

But the legacy Landlock path works for the same minimal command.

Expected behavior

codex sandbox linux -- pwd should either:

  • run successfully,
  • fall back to the working legacy Landlock path when bwrap cannot perform the required mount propagation step, or
  • return an actionable error message that points to the workaround.

Actual behavior

The default Linux sandbox path fails immediately with:

bwrap: Failed to make / slave: Permission denied

The same command succeeds when --enable use_legacy_landlock is used.

Environment

  • codex-cli 0.130.0
  • bubblewrap 0.6.1
  • Linux kernel 5.15
  • Reproduced in a containerized Linux environment using overlayfs

What steps can reproduce the bug?

Reproduction

$ codex sandbox linux -- pwd bwrap: Failed to make / slave: Permission denied

$ codex sandbox linux --enable use_legacy_landlock -- pwd prints working directory successfully

The failure is reproducible with a minimal command like pwd.

What is the expected behavior?

No response

Additional information

No response

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…

FAQ

Expected behavior

codex sandbox linux -- pwd should either:

  • run successfully,
  • fall back to the working legacy Landlock path when bwrap cannot perform the required mount propagation step, or
  • return an actionable error message that points to the workaround.
#embedding generation#cache error#pipeline error#runtime error#dependency conflict

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING

codex - 💡(How to fix) Fix Linux sandbox still fails with `bwrap: Failed to make / slave: Permission denied` on codex-cli 0.130.0 while legacy Landlock works [1 comments, 2 participants]