From ef53880f6a4fc5719efad3a491478c52ba492a37 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 20 Jul 2026 01:35:11 +0000 Subject: [PATCH] feat: ship bubblewrap in the base image for the Codex CLI sandbox The OpenAI Codex CLI's Linux sandbox uses the first bwrap executable on PATH and warns at startup when only its bundled fallback helper is available. Install the Ubuntu bubblewrap package image-tier so the system bwrap is always present, matching upstream's recommended setup. Adds bwrap to the always-present core command inventory in the e2e suite and documents the tool in the README and changelog. Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01GiQdQXNUM2Wca7VcWrByhS --- CHANGELOG.md | 6 ++++++ Dockerfile | 3 +++ README.md | 1 + scripts/e2e-test.sh | 2 +- 4 files changed, 11 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 616ee72..bdc9ffd 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,12 @@ ## Unreleased +### Added + +- `bubblewrap` in the base image so the OpenAI Codex CLI uses the system + `bwrap` for its Linux sandbox instead of warning and falling back to its + bundled helper. + ### Removed - Paseo assistant installation and Selection support. diff --git a/Dockerfile b/Dockerfile index 2c98478..89d538b 100644 --- a/Dockerfile +++ b/Dockerfile @@ -37,6 +37,9 @@ RUN printf 'path-include=/usr/share/doc/fzf/examples/key-bindings.bash\n' \ nano \ zstd \ zoxide \ + # bubblewrap: OpenAI Codex CLI's Linux sandbox uses the first bwrap on PATH + # and warns at startup when only its bundled fallback helper is available. + bubblewrap \ toilet \ toilet-fonts \ libicu-dev \ diff --git a/README.md b/README.md index 6bb2dd7..9a6e1ff 100644 --- a/README.md +++ b/README.md @@ -218,6 +218,7 @@ What's included | Name | Language | Description | |------|----------|-------------| | [bat](https://github.com/sharkdp/bat) | Rust | Cat clone with syntax highlighting | +| [bubblewrap](https://github.com/containers/bubblewrap) | C | Unprivileged sandboxing tool (`bwrap`), used by the Codex CLI sandbox | | [curl](https://github.com/curl/curl) | C | URL data transfer | | [delta](https://github.com/dandavison/delta) | Rust | Syntax-highlighting pager for git diffs | | [difftastic](https://github.com/Wilfred/difftastic) | Rust | Syntax-aware structural diff tool (`difft`) | diff --git a/scripts/e2e-test.sh b/scripts/e2e-test.sh index 3435935..356ede7 100755 --- a/scripts/e2e-test.sh +++ b/scripts/e2e-test.sh @@ -72,7 +72,7 @@ suite_tools() { # Candidate suite so publication cannot depend on the separate PR workflow. local command_name local -a core_commands=( - bat curl delta difft eza fd fzf gh glow gum jq just mise nano rg + bat bwrap curl delta difft eza fd fzf gh glow gum jq just mise nano rg starship xh yq zoxide ) for command_name in "${core_commands[@]}"; do