core-agent-ide/codex-rs/linux-sandbox/src
viyatb-oai 603b6493a9
fix(linux-sandbox): ignore missing writable roots (#14890)
## Summary
- skip nonexistent `workspace-write` writable roots in the Linux
bubblewrap mount builder instead of aborting sandbox startup
- keep existing writable roots mounted normally so mixed Windows/WSL
configs continue to work
- add unit and Linux integration regression coverage for the
missing-root case

## Context
This addresses regression A from #14875. Regression B will be handled in
a separate PR.

The old bubblewrap integration added `ensure_mount_targets_exist` as a
preflight guard because bubblewrap bind targets must exist, and failing
early let Codex return a clearer error than a lower-level mount failure.

That policy turned out to be too strict once bubblewrap became the
default Linux sandbox: shared Windows/WSL or mixed-platform configs can
legitimately contain a well-formed writable root that does not exist on
the current machine. This PR keeps bubblewrap's existing-target
requirement, but changes Codex to skip missing writable roots instead of
treating them as fatal configuration errors.
2026-03-17 00:21:00 -07:00
..
bwrap.rs fix(linux-sandbox): ignore missing writable roots (#14890) 2026-03-17 00:21:00 -07:00
landlock.rs linux-sandbox: plumb split sandbox policies through helper (#13449) 2026-03-07 19:40:10 -08:00
lib.rs feat(linux-sandbox): implement proxy-only egress via TCP-UDS-TCP bridge (#11293) 2026-02-21 18:16:34 +00:00
linux_run_main.rs fix: canonicalize symlinked Linux sandbox cwd (#14849) 2026-03-16 22:39:18 -07:00
linux_run_main_tests.rs fix: canonicalize symlinked Linux sandbox cwd (#14849) 2026-03-16 22:39:18 -07:00
main.rs fix: overhaul how we spawn commands under seccomp/landlock on Linux (#1086) 2025-05-23 11:37:07 -07:00
proxy_routing.rs feat(linux-sandbox): implement proxy-only egress via TCP-UDS-TCP bridge (#11293) 2026-02-21 18:16:34 +00:00
vendored_bwrap.rs linux-sandbox: honor split filesystem policies in bwrap (#13453) 2026-03-07 23:46:52 -08:00