Comment by usef-
10 hours ago
The Linux version seems to use bubblewrap + seccomp for a "workspace sandbox" automatically, in addition to the auto mode and/or user approval.
A VM would be even better, but people could presumably run this in one if we manage to convince them of higher sandboxing in general ?
Bubblewrap gets a bit confused inside a Docker container. If anyone knows how to run Codex inside a Docker container on Linux without it constantly complaining about a broken bubblewrap, please tell.
You have to add Linux capabilities to support creating nested namespaces. IIRC SYS_ADMIN is required. If you do that, what do you think you’re achieving with the container? It defeats the entire purpose IMO, just makes development more inconvenient.
If you need the sandboxing capabilities provided by the application and don’t want to run it on the host, you should set up a VM, not a container.
From a systems perspective, it’s foolish to rely on a proprietary application to provide its own isolation guarantees. This is an OS-layer responsibility.
ML/AI experts suffer badly from hubris. They are brilliant in one domain. It transfers poorly to systems engineering. The proof is in the FelonyBench results.
> If anyone knows how to run Codex inside a Docker container on Linux without it constantly complaining about a broken bubblewrap, please tell.
Why would you even use bubblewrap once it's running in a container? I've been running Codex in a container since it was publicly available, not even sure what you'd use bubblewrap for when you already separated codex from the rest of your filesystem?
Doesn't it automatically use bwrap if it's installed (in the container in this case)?
2 replies →
The cli does that already with codex on linux