concepts/sandboxing.md Codex Docs, 2026-04-20 18:26 UTC → 2026-05-02 06:45 UTC

67 67 

68Codex surfaces a startup warning when `bwrap` is missing or when the helper68Codex surfaces a startup warning when `bwrap` is missing or when the helper

69can't create the needed user namespace. On distributions that restrict this69can't create the needed user namespace. On distributions that restrict this

70AppArmor setting, you can enable it with:70AppArmor setting, prefer loading the `bwrap` AppArmor profile so `bwrap` can

71keep working without disabling the restriction globally.

72 

73**Ubuntu AppArmor note:** On Ubuntu 25.04, installing `bubblewrap` from

74 Ubuntu's package repository should work without extra AppArmor setup. The

75 `bwrap-userns-restrict` profile ships in the `apparmor` package at

76 `/etc/apparmor.d/bwrap-userns-restrict`.

77 

78On Ubuntu 24.04, Codex may still warn that it can't create the needed user

79namespace after `bubblewrap` is installed. Copy and load the extra profile:

80 

81```bash

82sudo apt update

83sudo apt install apparmor-profiles apparmor-utils

84sudo install -m 0644 \

85 /usr/share/apparmor/extra-profiles/bwrap-userns-restrict \

86 /etc/apparmor.d/bwrap-userns-restrict

87sudo apparmor_parser -r /etc/apparmor.d/bwrap-userns-restrict

88```

89 

90`apparmor_parser -r` loads the profile into the kernel without a reboot. You

91can also reload all AppArmor profiles:

92 

93```bash

94sudo systemctl reload apparmor.service

95```

96 

97If that profile is unavailable or does not resolve the issue, you can disable

98the AppArmor unprivileged user namespace restriction with:

71 99 

72```bash100```bash

73sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0101sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0

117- `never`: Codex doesn't stop for approval prompts.145- `never`: Codex doesn't stop for approval prompts.

118 146 

119Full access means using `sandbox_mode = "danger-full-access"` together with147Full access means using `sandbox_mode = "danger-full-access"` together with

120`approval_policy = "never"`. By contrast, `--full-auto` is the lower-risk local148`approval_policy = "never"`. By contrast, the lower-risk local automation

121automation preset: `sandbox_mode = "workspace-write"` and149preset is `sandbox_mode = "workspace-write"` together with

122`approval_policy = "on-request"`.150`approval_policy = "on-request"`, or the matching CLI flags

151`--sandbox workspace-write --ask-for-approval on-request`.

123 152 

124If you need Codex to work across more than one directory, writable roots let153If you need Codex to work across more than one directory, writable roots let

125you extend the places it can modify without removing the sandbox entirely. If154you extend the places it can modify without removing the sandbox entirely. If

131Managed network profiles use map tables such as160Managed network profiles use map tables such as

132`[permissions.<name>.network.domains]` and161`[permissions.<name>.network.domains]` and

133`[permissions.<name>.network.unix_sockets]` for domain and socket rules.162`[permissions.<name>.network.unix_sockets]` for domain and socket rules.

163Filesystem profiles can also deny reads for exact paths or glob patterns by

164setting matching entries to `"none"`; use this to keep files such as local

165secrets unreadable without turning off workspace writes.

134 166 

135When a workflow needs a specific exception, use [rules](https://developers.openai.com/codex/rules). Rules167When a workflow needs a specific exception, use [rules](https://developers.openai.com/codex/rules). Rules

136let you allow, prompt, or forbid command prefixes outside the sandbox, which is168let you allow, prompt, or forbid command prefixes outside the sandbox, which is

139[Codex app features](https://developers.openai.com/codex/app/features#approvals-and-sandboxing), and for the171[Codex app features](https://developers.openai.com/codex/app/features#approvals-and-sandboxing), and for the

140IDE-specific settings entry points, see [Codex IDE extension settings](https://developers.openai.com/codex/ide/settings).172IDE-specific settings entry points, see [Codex IDE extension settings](https://developers.openai.com/codex/ide/settings).

141 173 

174Automatic review, when available, doesn't change the sandbox boundary. It

175reviews approval requests, such as sandbox escalations or network access, while

176actions already allowed inside the sandbox run without extra review. See

177[Automatic approval reviews](https://developers.openai.com/codex/agent-approvals-security#automatic-approval-reviews)

178for the policy behavior.

179 

142Platform details live in the platform-specific docs. For native Windows setup,180Platform details live in the platform-specific docs. For native Windows setup,

143behavior, and troubleshooting, see [Windows](https://developers.openai.com/codex/windows). For admin181behavior, and troubleshooting, see [Windows](https://developers.openai.com/codex/windows). For admin

144requirements and organization-level constraints on sandboxing and approvals, see182requirements and organization-level constraints on sandboxing and approvals, see