0.131.0 Linux sandbox fails creating .codex/tmp, forcing approvals for routine workspace commands

[maizaAvaro]

What version of Codex is running?

0.131.0

OS / environment

Linux, repo-local workspace-write session.

What happened?

After upgrading from 0.130.0 to 0.131.0, the sandbox appears to be unusable in this repository/session. Routine commands that should run inside the workspace-write sandbox now fail sandbox setup and require explicit approval to run outside the sandbox.

The recurring failure reason shown by Codex is:

bwrap: Can't create file at /home/maizaavaro/pickMarket/.codex/tmp: Read-only file system

This happens even though the same user can write to that directory from a normal shell. I manually created .codex/tmp/ and verified shell write access with a write test, but Codex still required escalation for normal developer commands afterward.

Examples of affected commands

During a normal docs-only implementation slice, Codex requested manual approval to run the following outside the sandbox:

rg -n "Closeout|closeout|RALPH_SESSION_RELOAD|RALPH_PLANNING|human commit gate|recommended commit|non-authoritative|subordinate" .codex/AGENTS_RALPH_CONSTRAINTS.md .codex/ralph/RALPH.md .codex/ralph/RALPH_SESSION_RELOAD.md .codex/ralph/RALPH_PLANNING.md

Reason shown:

Do you want to allow this contracted read-only rg check to run outside the sandbox after the sandbox failed creating its temp directory?

A scoped write inside the approved workspace also had to be approved outside the sandbox after the patch tool failed:

ruby -0pi -e '...single scoped text replacement...' .codex/AGENTS_RALPH_CONSTRAINTS.md

Reason shown:

Do you want to allow a single scoped text replacement in the approved Ralph constraints file after the patch tool failed due the sandbox temp-directory issue?

Then the contracted checks also required approval outside the sandbox:

git diff -- .codex/AGENTS_RALPH_CONSTRAINTS.md

rg -n "Closeout ordering|RALPH_SESSION_RELOAD|RALPH_PLANNING|human commit gate|recommended commit|non-authoritative|subordinate" .codex/AGENTS_RALPH_CONSTRAINTS.md .codex/ralph/RALPH.md .codex/ralph/RALPH_SESSION_RELOAD.md .codex/ralph/RALPH_PLANNING.md

git status --short -- .codex/AGENTS_RALPH_CONSTRAINTS.md .codex/ralph/RALPH.md .codex/ralph/RALPH_SESSION_RELOAD.md .codex/ralph/RALPH_PLANNING.md

Each was escalated because the sandbox had failed or previously failed creating its temp directory.

Expected behavior

In a normal workspace-write session:

• read-only commands such as rg, git diff, and path-scoped git status should run inside the sandbox without requiring outside-sandbox approval;
• edits to files inside the writable workspace root should be possible through the normal sandboxed edit path;
• Codex should not require elevated execution for routine repo-local developer checks when the target paths are inside the workspace.

This is how the same workflow behaved for me on 0.130.0.

Actual behavior

The sandbox setup fails around .codex/tmp, and Codex falls back to asking for outside-sandbox approval for routine commands. This makes the sandbox effectively unusable and turns normal development workflow into repeated escalation prompts.

Why this seems like a regression

This started after updating from 0.130.0 to 0.131.0. The 0.131.0 release includes several nearby changes that may be relevant, including:

• [codex] Tighten unified exec sandbox setup #22207 “Tighten unified exec sandbox setup”
• permissions: resolve profile identity with constraints #22683 workspace-root permission profile resolution cleanup
• fix(permissions): preserve managed deny-read during escalation #15977 preserving managed read restrictions during escalation
• TUI display of effective workspace roots / permissions / approval mode

This may be a regression in sandbox setup or workspace-root/temp-dir permission resolution.

Reproduction details

1. Run Codex CLI 0.131.0 in a Linux repo-local workspace-write session.
2. Use a repository where .codex/tmp/ is configured/listed as a writable root.
3. From the normal shell, verify .codex/tmp/ is writable:

cd /home/maizaavaro/pickMarket
mkdir -p .codex/tmp
touch .codex/tmp/.write-test
rm .codex/tmp/.write-test

4. In Codex, ask it to run routine repo-local commands such as:

rg -n "some-pattern" .codex/AGENTS_RALPH_CONSTRAINTS.md

or:

git diff -- .codex/AGENTS_RALPH_CONSTRAINTS.md

5. Observe sandbox setup failure and approval prompts to run outside the sandbox.

Additional context

I already filed a separate 0.131.0 issue about subagent completion notifications showing UUID agent_path instead of friendly nicknames: #23588. This sandbox issue is separate and more severe because it affects command execution safety and normal workspace-write operation.

[maizaAvaro]

this one led to me downgrading back to v0.130.0 for the time being, though it didn't actually break my pipeline, just made human-approval gates much more common...

[jshaofa-ui]

🔧 Solution Submitted — P1 Bug (regression)

Issue: Linux sandbox fails creating .codex/tmp
Estimated Impact: $1,500-2,500
Competition: Zero (first solution)

Summary

Full technical solution with root cause analysis and proposed code fixes has been developed. See the solution file for complete details:

📄 Solution: codex-23601-linux-sandbox-codex-tmp-fix.md

Key Points

Fix 1: Ensure .codex/tmp is mounted read-write (Primary)

Fix 2: Add fallback tmp directory

Fix 3: Add diagnostic logging for sandbox mount failures

Impact

• Functionality: Restores sandbox operation on Linux
• Scope: Linux users on v0.131.0+

Next Steps

1. Review the solution approach
2. I can provide a PR with the fix if accepted
3. Open to discussion on the approach

---

Solution developed through technical analysis of the issue report. Happy to iterate on the approach.