Linux sandbox fails on Unraid rootfs: `bwrap: pivot_root: Invalid argument`

Start with the Linux sandbox path and the failure reported at linux-sandbox/src/linux_run_main.rs:252:9; reproduce on an Unraid host whose root is the initial rootfs using the bundled bubblewrap helper. Trace the pivot_root failure and existing legacy Landlock fallback, then make the behavior compatible with this topology or report a clear compatibility diagnostic; verify that sandboxed commands no longer fail opaquely.

What version of Codex is running?

codex-cli 0.144.1

What platform is affected?

• Unraid Linux
• Kernel: 6.12.54-Unraid
• Architecture: x86_64
• Sandbox policy: workspace-write
• Workspace filesystem: ZFS
• Root filesystem: the initial rootfs

$ findmnt -no TARGET,FSTYPE,PROPAGATION,OPTIONS /
/ rootfs private rw,size=31643352k,nr_inodes=7910838,inode64

$ findmnt -T /mnt/cache/projects/<repo> -o TARGET,SOURCE,FSTYPE,OPTIONS
TARGET                     SOURCE         FSTYPE OPTIONS
/mnt/cache/projects        cache/projects zfs    rw,relatime,xattr,posixacl,casesensitive

There is no system bwrap on this host, so Codex uses its bundled bubblewrap helper.

What issue are you seeing?

Every sandboxed command fails before the requested command executes:

bwrap: pivot_root: Invalid argument

This affects harmless read-only commands such as pwd, git status --short, and rg --files.

Because the sandbox bootstrap fails, the only available retry path is execution outside the sandbox. With an approval-based policy, this makes ordinary repository inspection appear to require approval for every command.

The same commands succeed normally when executed outside the Codex sandbox, confirming that repository ownership and workspace permissions are not the problem.

Steps to reproduce

1. Run Codex 0.144.1 on an Unraid host where / remains mounted as the kernel's initial rootfs.

2. Start a session using the default bubblewrap filesystem sandbox and workspace-write.

3. Ask Codex to run any command, for example:

   pwd
   

4. Observe:

   bwrap: pivot_root: Invalid argument
   

5. Retry the same command outside the sandbox and observe that it succeeds.

Additional diagnostics

Unprivileged user and mount namespaces are available. Both of these complete successfully:

unshare --user --map-root-user true
unshare --user --map-root-user --mount true

The namespace limit is also nonzero:

$ cat /proc/sys/user/max_user_namespaces
246490

This rules out the common case where unprivileged user namespaces are disabled.

The legacy Landlock fallback is present but does not work on this host:

codex --enable use_legacy_landlock sandbox linux /bin/true

Result:

thread 'main' panicked at linux-sandbox/src/linux_run_main.rs:252:9:
error applying legacy Linux sandbox restrictions: Sandbox(LandlockRestrict)

Likely cause

Linux documents EINVAL from pivot_root(2) when “the current root is on the rootfs (initial ramfs) mount”:

https://man7.org/linux/man-pages/man2/pivot_root.2.html

That exactly matches both the error and this host's mount topology.

Expected behavior

Codex should either:

1. support sandboxing when the host root is the initial rootfs without relying on an unsupported pivot_root() operation;
2. detect this mount topology at startup and use a compatible sandbox backend; or
3. surface a clear compatibility diagnostic rather than failing every command and causing repeated approval escalations.

This appears distinct from AppArmor/user-namespace failures because namespace creation succeeds and the syscall fails specifically at pivot_root.