clone/codex
1
0
Fork 0
mirror of https://github.com/openai/codex.git synced 2026-05-02 02:17:22 +00:00
Code Issues Packages Projects Releases Wiki Activity

Isolate Linux sandbox IPC namespace

Browse Source
This commit is contained in:
Eva Wong
2026-04-29 11:00:26 -07:00
parent 6014b6679f
commit c3ff56bae9
4 changed files with 155 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
codex-rs/linux-sandbox/README.md
View File

@@ -82,7 +82,8 @@ commands that would enter the bubblewrap path.
writable roots are blocked by mounting `/dev/null` on the symlink or first
missing component.
- When bubblewrap is active, the helper explicitly isolates the user namespace via
`--unshare-user` and the PID namespace via `--unshare-pid`.
`--unshare-user`, the PID namespace via `--unshare-pid`, and the IPC namespace
via `--unshare-ipc`.
- When bubblewrap is active and network is restricted without proxy routing, the helper also
isolates the network namespace via `--unshare-net`.
- In managed proxy mode, the helper uses `--unshare-net` plus an internal