Skip to content

Codex CLI shell commands hang indefinitely during bwrap sandbox initialization on autofs-backed mounts #20017

@mahendra202602

Description

@mahendra202602

What version of Codex CLI is running?

v0.125.0

What subscription do you have?

Corporate

Which model were you using?

gpt-5.5, gpt-5.4

What platform is your computer?

Oracle Linux 8

What terminal emulator and version are you using (if applicable)?

No response

What issue are you seeing?

Codex CLI shell commands are hanging indefinitely. Even simple commands like echo test, pwd, date, and ls never return. Instead, they remain as background terminal requests and keep piling up.

This does not appear to be caused by the model loop or by the shell command itself. Investigation suggests Codex is blocking during Bubblewrap sandbox initialization. The sandbox probe appears to run a command similar to:

/usr/bin/bwrap --unshare-user --unshare-net --ro-bind / / /bin/true

That bwrap process then blocks while setting up mounts. The stuck child process was observed in autofs_wait, which suggests it is waiting on an autofs-backed mountpoint encountered while binding the host filesystem.

As a result, Codex becomes unusable because no shell commands complete.

What steps can reproduce the bug?

Run Codex CLI in a Linux environment that has autofs-backed or lazy-mounted workspace paths.
Ask Codex to run a simple shell command, for example:
echo test
date
pwd
ls
Observe that the command does not return.
Run /ps in Codex.
Observe that multiple background terminal requests are still pending and continue to accumulate.
Trace the Codex process or its child processes.
Observe that Codex is waiting on a bwrap sandbox probe, and the bwrap child is blocked during mount setup, with process state showing autofs_wait.

What is the expected behavior?

Codex should complete simple shell commands normally.

If the sandbox cannot be initialized, Codex should fail fast with a clear error message instead of leaving commands running indefinitely in the background.

Ideally, Codex should also avoid blocking forever when bwrap --ro-bind / / encounters an autofs-backed mountpoint.

Additional information

No response

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't workingperformancesandboxIssues related to permissions or sandboxingtool-callsIssues related to tool calling

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions