linux-sandbox test brittleness: cwd='/' exact bwrap argv depends on host /.git

Open Beginner friendly
#15,786 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
68/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Quiet
Tech stack
linux, rust
Domain
operating-systems, security, testing

Research direction

Start with the linux-sandbox test bwrap::tests::mounts_dev_before_writable_dev_binds and run it on a host with and without /.git. Keep the assertion focused on --dev /dev preceding the writable /dev bind, while avoiding host-dependent exact argv matching. Done means the test validates mount ordering consistently without treating the expected /.git carveout as a failure.

Written by the indexing model from the issue text.

Description

bug sandbox

Codex version

v0.117.0-alpha.13

Summary

A linux-sandbox unit test failed on my machine because it has a real /.git directory.

The failing test was:

  • bwrap::tests::mounts_dev_before_writable_dev_binds

What happened

The test uses cwd = "/" with a WorkspaceWrite policy. In that setup, / becomes a writable root. The policy's default protected subpaths include .git, so if /.git exists, bwrap args include:

  • --ro-bind /.git /.git

On my machine, /.git exists, so the generated argv had that extra carveout and the test failed because it expected an exact hardcoded argv list without /.git.

Why this is confusing / brittle

The test intent is to validate mount ordering for /dev, but exact full-vector matching makes it host-dependent when / is the writable root.

That means:

  • host with /.git: extra /.git carveout appears
  • host without /.git: no extra carveout

So the same code can pass/fail depending on host filesystem state.

Important clarification

The /.git carveout itself is expected behavior (security policy), not the bug.

The brittle part is the test shape:

  • exact argv equality in a root-cwd scenario where protected subpaths are host-dependent.

Suggested test strategy

  • Keep asserting the behavior under test (--dev /dev comes before writable /dev bind).
  • If testing exact vectors, either:
    • run with a temp cwd (not /), or
    • include conditional expectation for /.git when it exists.
Dominant language
Rust
Stars
125k
Forks
19.5k
Avg merge
1m
Merged PRs (30d)
1k

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from openai/codex

All issues in openai/codex

Similar issues

More Rust issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.