# Codex Environment Notes

## 2026-07-01 Global Codex sandbox fix

Problem: Codex sandbox and image tools failed on this cPanel CloudLinux server.

First error: bwrap namespace ENOSPC because max_user_namespaces was 0.
Fix: /proc/sys/user/max_user_namespaces changed to 28633.

Second error: bwrap could not access /newroot/proc/sysrq-trigger inside user namespace.
Diagnosis: manual bwrap tests showed --unshare-user with --proc /proc fails, while binding /proc works.

Global fix applied: /usr/bin/codex is now a wrapper that calls /usr/lib/node_modules/@openai/codex/bin/codex.js with --sandbox danger-full-access by default.
The wrapper respects explicit --sandbox and --dangerously-bypass-approvals-and-sandbox arguments.

Verification: codex --ask-for-approval never exec pwd showed sandbox: danger-full-access.

Scope: global for future Codex sessions on this server across all projects. Already running sessions may need restart.

Workspace mountpoints created under /home/whats/public_html: .git .agents .codex as empty directories. Real repo remains /home/whats/public_html/mohamed/.git.

Image workaround before restart: PHP GD can open ISS-2026-0018-attachment.jpg and confirmed dimensions 1600x723.