Issue Station
Sign In
Tools hereToolbox

codex - 💡(How to fix) Fix On Ubuntu, every single normal edit requires skipping sandbox [1 comments, 2 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openai/codex#17525•Fetched 2026-04-12 13:27:04
View on GitHub
Comments
1
Participants
2
Timeline
4
Reactions
0
Author
jancellorjancellor
Participants
github-actions[bot]github-actions[bot]jancellorjancellor
Timeline (top)
labeled ×3commented ×1

Code Example

abi <abi/4.0>,
include <tunables/global>

profile local-codex <PATH_TO_CODEX> flags=(unconfined) {
  userns,

  include if exists <local/local-codex>
}
RAW_BUFFERClick to expand / collapse

What version of Codex CLI is running?

0.120.0

What subscription do you have?

Plus

Which model were you using?

gpt-5.4

What platform is your computer?

Linux 6.17.0-20-generic x86_64 x86_64 (Ubutnu 24.04)

What terminal emulator and version are you using (if applicable)?

gnome-terminal

What issue are you seeing?

Under Ubuntu, every normal edit to a file in the current working directory says it fails and prompts to skip the sandbox which does work to allow the edit. Last good version is 0.114.0. I believe this is related to bwrap and Ubuntu's default AppArmor configuration.

One work around is to add an AppArmor profile for the codex to allow userns, as below. I believe Claude Code had/has a similar problem that required allowing userns for the bwrap binary itself. No comment on security implications of loosening AppArmor like this. My layman understand was that Ubuntu's default rules are more conservative than other distros.

In /etc/apparmor.d/local-codex:

abi <abi/4.0>,
include <tunables/global>

profile local-codex <PATH_TO_CODEX> flags=(unconfined) {
  userns,

  include if exists <local/local-codex>
}

(I use mise to install node so that path was something like /home/me/.local/share/mise/installs/node/*/lib/node_modules/@openai/codex/node_modules/@openai/codex-linux-x64/vendor/x86_64-unknown-linux-musl/codex/codex.)

What steps can reproduce the bug?

Uploaded thread: 019d80f4-80f5-7613-a2b3-a8671c7b6429

What is the expected behavior?

No response

Additional information

No response

extent analysis

TL;DR

To resolve the issue with Codex CLI edits failing under Ubuntu, add an AppArmor profile to allow userns for the Codex binary.

Guidance

  • The issue is likely caused by Ubuntu's default AppArmor configuration being too conservative, which prevents Codex from functioning correctly.
  • To verify the issue, try editing a file in the current working directory and see if it fails and prompts to skip the sandbox.
  • Create an AppArmor profile for Codex by adding the provided configuration to /etc/apparmor.d/local-codex and reload the AppArmor profiles.
  • Replace <PATH_TO_CODEX> with the actual path to the Codex binary, which can be found using the mise installation path.

Example

sudo nano /etc/apparmor.d/local-codex

Add the following configuration, replacing <PATH_TO_CODEX> with the actual path:

abi <abi/4.0>,
include <tunables/global>

profile local-codex <PATH_TO_CODEX> flags=(unconfined) {
  userns,

  include if exists <local/local-codex>
}

Then, reload the AppArmor profiles:

sudo apparmor_parser -r /etc/apparmor.d/local-codex

Notes

The provided workaround loosens AppArmor restrictions, which may have security implications. It is recommended to understand the security implications before applying this workaround.

Recommendation

Apply the workaround by adding an AppArmor profile to allow userns for the Codex binary, as it is a known solution that has worked for similar issues.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#task chaining#parallel task#integration issue#index setup#retrieval issue

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING

codex - 💡(How to fix) Fix On Ubuntu, every single normal edit requires skipping sandbox [1 comments, 2 participants]