viyatb-oai 9950b5e265 fix(linux-sandbox): always unshare bwrap userns (#13624) ...

## Summary
- always pass `--unshare-user` in the Linux bubblewrap argv builders
- stop relying on bubblewrap's auto-userns behavior, which is skipped
for `uid 0`
- update argv expectations in tests and document the explicit user
namespace behavior

The installed Codex binary reproduced the same issue with:
- `codex -c features.use_linux_sandbox_bwrap=true sandbox linux -- true`
- `bwrap: Creating new namespace failed: Operation not permitted`

This happens because Codex asked bubblewrap for mount/pid/network
namespaces without explicitly asking for a user namespace. In a
root-inside-container environment without ambient `CAP_SYS_ADMIN`, that
fails. Adding `--unshare-user` makes bubblewrap create the user
namespace first and then the remaining namespaces succeed.

2026-03-05 21:57:40 +00:00

..

bwrap.rs

fix(linux-sandbox): always unshare bwrap userns (#13624)

2026-03-05 21:57:40 +00:00

landlock.rs

…

lib.rs

…

linux_run_main_tests.rs

fix(linux-sandbox): always unshare bwrap userns (#13624)

2026-03-05 21:57:40 +00:00

linux_run_main.rs

…

main.rs

…

proxy_routing.rs

…

vendored_bwrap.rs

…