Frequently Asked Question

How does Codex sandbox commands on Linux?

Codex combines four kernel facilities, each closing a class of escape that the others cannot.

bubblewrap builds the filesystem view, mounting the root filesystem read-only with --ro-bind / / and then binding specific writable directories back in. The default is therefore total: nothing is writable until something says it is. Protected subpaths such as .git and .codex are re-applied read-only inside otherwise writable roots.

Namespaces provide isolation: --unshare-user enables unprivileged sandboxing, --unshare-pid hides host processes, and --unshare-net removes network access when networking is restricted.

seccomp filters system calls, blocking networking at the syscall level, and applies PR_SET_NO_NEW_PRIVS, which prevents the process or any child from gaining privileges through a setuid binary.

Landlock, the Linux security module merged in kernel 5.13, is retained as a fallback where bubblewrap is unavailable.

WSL1 is unsupported because it cannot create the required user namespaces; WSL2 works.