fix: enable Codex sandbox in Docker

2026-07-20 16:19:59 +02:00
parent 14737db853
commit a12229a147
5 changed files with 70 additions and 6 deletions
@@ -7,6 +7,18 @@ services:
        CODEGRAPH_VERSION: ${CODEGRAPH_VERSION:-1.3.1}
        TEA_VERSION: ${TEA_VERSION:-0.14.2}
    restart: unless-stopped
+    # Codex applies its own bwrap sandbox inside this otherwise unprivileged container.
+    cap_add:
+      - SYS_ADMIN
+      - SYS_CHROOT
+      - SETUID
+      - SETGID
+      - SYS_PTRACE
+      - NET_ADMIN
+      - NET_RAW
+    security_opt:
+      - seccomp=unconfined
+      - apparmor=unconfined
    environment:
      AGENTCI_GITEA_URL: ${AGENTCI_GITEA_URL:-http://gitea:3000}
      AGENTCI_BOT_USERNAME: ${AGENTCI_BOT_USERNAME:-agentci}