valknar/llmx
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: clarify sandboxing situation on Linux (#103)

Browse Source 
There doesn't appear to actually be any sandboxing on Linux. Correct the
README.

Signed-off-by: Christopher Cooper <christopher@cg505.com>
This commit is contained in:
Christopher Cooper
2025-04-17 08:15:39 -07:00
committed by GitHub
parent 4386dfc67b
commit f9c15523e7
2 changed files with 5 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
README.md
View File

@@ -137,13 +137,12 @@ The hardening mechanism Codex uses depends on your OS:
- Outbound network is _fully blocked_ by default – even if a child process - Outbound network is _fully blocked_ by default – even if a child process
tries to `curl` somewhere it will fail. tries to `curl` somewhere it will fail.
- **Linux** – we recommend using Docker for sandboxing, where Codex launches itself inside a **minimal - **Linux** – there is no sandboxing by default.
We recommend using Docker for sandboxing, where Codex launches itself inside a **minimal
container image** and mounts your repo _read/write_ at the same path. A container image** and mounts your repo _read/write_ at the same path. A
custom `iptables`/`ipset` firewall script denies all egress except the custom `iptables`/`ipset` firewall script denies all egress except the
OpenAI API. This gives you deterministic, reproducible runs without needing OpenAI API. This gives you deterministic, reproducible runs without needing
root on the host. You can read more in [`run_in_container.sh`](./codex-cli/scripts/run_in_container.sh) root on the host. You can use the [`run_in_container.sh`](./codex-cli/scripts/run_in_container.sh) script to set up the sandbox.
Both approaches are _transparent_ to everyday usage – you still run `codex` from your repo root and approve/reject steps as usual.
--- ---

4
codex-cli/src/utils/agent/handle-exec-command.ts
View File

@@ -257,7 +257,7 @@ async function execCommand(
}; };
} }
const isInContainer = async (): Promise<boolean> => { const isInLinux = async (): Promise<boolean> => {
try { try {
await access("/proc/1/cgroup"); await access("/proc/1/cgroup");
return true; return true;
@@ -270,7 +270,7 @@ async function getSandbox(runInSandbox: boolean): Promise<SandboxType> {
if (runInSandbox) { if (runInSandbox) {
if (process.platform === "darwin") { if (process.platform === "darwin") {
return SandboxType.MACOS_SEATBELT; return SandboxType.MACOS_SEATBELT;
} else if (await isInContainer()) { } else if (await isInLinux()) {
return SandboxType.NONE; return SandboxType.NONE;
} }
throw new Error("Sandbox was mandated, but no sandbox is available!"); throw new Error("Sandbox was mandated, but no sandbox is available!");