codex: 在linux上报错：Codex's Linux sandbox uses bubblewrap and needs access to create user namespaces.

一，报错信息

⚠ Codex's Linux sandbox uses bubblewrap and needs access to create user namespaces.

 以及:

沙箱环境本身有问题（bwrap 网络初始化失败），我需要申请提升权限来执行命令。

二，原因：

Codex 依赖 bubblewrap (bwrap) 来构建隔离的沙箱环境，但这需要系统允许普通用户创建“用户命名空间”（User Namespaces）。
你的系统当前禁止了这一行为，导致沙箱无法启动。

三，解决:

临时关闭:

sudo sysctl -w kernel.unprivileged_userns_clone=1

永久性关闭：

$ echo "kernel.unprivileged_userns_clone=1" | sudo tee /etc/sysctl.d/99-userns.conf
kernel.unprivileged_userns_clone=1
$ sudo sysctl --system

 

如果你使用的是 Ubuntu 24.04 或更新系统，还需要额外关闭 AppArmor 对用户命名空间的限制)

$ echo "kernel.apparmor_restrict_unprivileged_userns=0" | sudo tee /etc/sysctl.d/99-apparmor-userns.conf
[sudo] password for liuhongdi: 
kernel.apparmor_restrict_unprivileged_userns=0

$ sudo sysctl --system
* Applying /usr/lib/sysctl.d/10-apparmor.conf ...
* Applying /etc/sysctl.d/10-bufferbloat.conf ...
* Applying /etc/sysctl.d/10-console-messages.conf ...
* Applying /etc/sysctl.d/10-ipv6-privacy.conf ...
* Applying /etc/sysctl.d/10-kernel-hardening.conf ...
* Applying /etc/sysctl.d/10-magic-sysrq.conf ...
* Applying /etc/sysctl.d/10-map-count.conf ...
* Applying /etc/sysctl.d/10-network-security.conf ...
* Applying /etc/sysctl.d/10-ptrace.conf ...
* Applying /etc/sysctl.d/10-zeropage.conf ...
* Applying /usr/lib/sysctl.d/50-bubblewrap.conf ...
* Applying /usr/lib/sysctl.d/50-coredump.conf ...
* Applying /usr/lib/sysctl.d/50-pid-max.conf ...
* Applying /etc/sysctl.d/99-apparmor-userns.conf ...
* Applying /usr/lib/sysctl.d/99-protect-links.conf ...
* Applying /etc/sysctl.d/99-sysctl.conf ...
* Applying /etc/sysctl.conf ...
kernel.apparmor_restrict_unprivileged_userns = 1
net.core.default_qdisc = fq_codel
kernel.printk = 4 4 1 7
net.ipv6.conf.all.use_tempaddr = 2
net.ipv6.conf.default.use_tempaddr = 2
kernel.kptr_restrict = 1
kernel.sysrq = 176
vm.max_map_count = 1048576
net.ipv4.conf.default.rp_filter = 2
net.ipv4.conf.all.rp_filter = 2
kernel.yama.ptrace_scope = 1
vm.mmap_min_addr = 65536
kernel.unprivileged_userns_clone = 1
kernel.core_pattern = |/usr/lib/systemd/systemd-coredump %P %u %g %s %t 9223372036854775808 %h %d
kernel.core_pipe_limit = 16
fs.suid_dumpable = 2
kernel.pid_max = 4194304
kernel.apparmor_restrict_unprivileged_userns = 0
fs.protected_fifos = 1
fs.protected_hardlinks = 1
fs.protected_regular = 2
fs.protected_symlinks = 1