9950b5e265
## Summary - always pass `--unshare-user` in the Linux bubblewrap argv builders - stop relying on bubblewrap's auto-userns behavior, which is skipped for `uid 0` - update argv expectations in tests and document the explicit user namespace behavior The installed Codex binary reproduced the same issue with: - `codex -c features.use_linux_sandbox_bwrap=true sandbox linux -- true` - `bwrap: Creating new namespace failed: Operation not permitted` This happens because Codex asked bubblewrap for mount/pid/network namespaces without explicitly asking for a user namespace. In a root-inside-container environment without ambient `CAP_SYS_ADMIN`, that fails. Adding `--unshare-user` makes bubblewrap create the user namespace first and then the remaining namespaces succeed. |
||
|---|---|---|
| .. | ||
| bwrap.rs | ||
| landlock.rs | ||
| lib.rs | ||
| linux_run_main.rs | ||
| linux_run_main_tests.rs | ||
| main.rs | ||
| proxy_routing.rs | ||
| vendored_bwrap.rs | ||