This morning I updated Codex to the latest version (v0.156.1), asked it to edit a local file and got this instead:
bwrap: setting up uid map: Permission deniedHuh. Not convenient when I just wanted to get things done. The error suggests that bwrap (the Bubblewrap executable), which is used to create sandboxes on Linux, has a permission problem.
A sandbox is an isolated environment that restricts what a program can access or modify. It lets a program run while limiting its ability to affect the rest of the system, usually by restricting access to files, network resources or other processes.
I wasn’t terribly familiar with Linux sandboxes, so I found out more about Bubblewrap.
Bubblewrap (bwrap) is a lightweight sandboxing tool. It uses namespaces and filesystem bindings to give a process a restricted view of the system, allowing selected files and directories to be made read-only, writable or inaccessible without requiring a full virtual machine or container.
As the name implies, Bubblewrap wraps the child process in a sandbox environment. It creates the sandbox, but the Linux kernel enforces isolation of the processes running inside the sandbox.
Why Bubblewrap Couldn’t Start
Ubuntu 24.04 restricts unprivileged user namespaces through AppArmor. In the unprivileged mode involved here, Bubblewrap creates a user namespace and writes a UID map. If AppArmor denies that operation, then bwrap will fail.
AppArmor is a kernel-level Linux security system that restricts what applications are allowed to do. It applies per-application security profiles that can limit access to files, devices, network operations and other system resources, helping contain the damage if a program is compromised or behaves unexpectedly. AppArmor is not dependent on Bubblewrap and can apply a security profile to any process, regardless of whether it’s running in a sandbox.
Check where bwrap is installed.
which bwrap/usr/bin/bwrapThe solution below applies specifically to /usr/bin/bwrap.
Allow Bubblewrap to Create a Namespace
I found a solution which applies an AppArmor profile to the Bubblewrap executable. First check whether you already have either an AppArmor profile at /etc/apparmor.d/bwrap or /etc/apparmor.d/bwrap-userns-restrict. Inspect an existing profile before making changes. If neither file exists, then create an AppArmor profile for /usr/bin/bwrap at /etc/apparmor.d/bwrap with the following content:
abi <abi/4.0>,
include <tunables/global>
profile bwrap /usr/bin/bwrap flags=(unconfined) {
userns,
include if exists <local/bwrap>
}The userns rule lets it create a user namespace. The unconfined flag leaves Bubblewrap’s other operations unrestricted, while the include directive allows site-specific additions. The permission applies to the /usr/bin/bwrap executable regardless of which program launches it.
Restart AppArmor to apply those changes.
sudo systemctl reload apparmorRun the program that produced the error. If the error persists, let me know: I’d be happy to figure out another solution.
I restarted Codex and the issue was resolved. 🚀