[codex] Support bubblewrap in secure Docker devcontainer

.devcontainer/Dockerfile.secure

@@ -10,6 +10,7 @@ ENV TZ="$TZ"
 
 SHELL ["/bin/bash", "-o", "pipefail", "-c"]
 
+# Devcontainers run as a non-root user, so enable bubblewrap's setuid mode.
 RUN apt-get update \
     && apt-get install -y --no-install-recommends \
         build-essential \
@@ -37,6 +38,8 @@ RUN apt-get update \
         ipset \
         iptables \
         aggregate \
+        bubblewrap \
+    && chmod u+s /usr/bin/bwrap \
     && apt-get clean \
     && rm -rf /var/lib/apt/lists/*
 

.devcontainer/README.md

@@ -14,6 +14,8 @@ Use `devcontainer.json` when you are developing Codex itself. This is the same l
 Use `devcontainer.secure.json` when you want a stricter runtime profile for running Codex inside a project container:
 
 - installs the Codex CLI plus common build tools
+- installs bubblewrap in setuid mode for Codex's Linux sandbox
+- disables Docker's outer seccomp and AppArmor profiles so bubblewrap can construct Codex's inner sandbox
 - enables firewall startup with an allowlist-driven outbound policy
 - blocks IPv6 by default so the allowlist cannot be bypassed over AAAA routes
 - requires `NET_ADMIN` and `NET_RAW` so the firewall can be installed at startup
@@ -43,3 +45,5 @@ Note that `/workspace/target` will contain the binaries built for your host plat
 For arm64, specify `--platform=linux/arm64` instead for both `docker build` and `docker run`.
 
 Currently, the contributor `Dockerfile` works for both x64 and arm64 Linux, though you need to run `rustup target add x86_64-unknown-linux-musl` yourself to install the musl toolchain for x64.
+
+The secure profile's capability, seccomp, and AppArmor options are required when you want Codex's bubblewrap sandbox to run inside Docker as the non-root devcontainer user. Without them, Docker's default runtime profile can block bubblewrap's namespace setup before Codex's own seccomp filter is installed. This keeps the Docker relaxation explicit in the profile that is meant to run Codex inside a project container, while the default contributor profile stays lightweight.

.devcontainer/devcontainer.secure.json

@@ -12,6 +12,13 @@
     }
   },
   "runArgs": [
+    "--cap-add=SYS_ADMIN",
+    "--cap-add=SYS_CHROOT",
+    "--cap-add=SETUID",
+    "--cap-add=SETGID",
+    "--cap-add=SYS_PTRACE",
+    "--security-opt=seccomp=unconfined",
+    "--security-opt=apparmor=unconfined",
     "--cap-add=NET_ADMIN",
     "--cap-add=NET_RAW"
   ],