--verify-fd-mount is only supported in the inner sandbox sta

Error message

--verify-fd-mount is only supported in the inner sandbox stage

What it means

Error "--verify-fd-mount is only supported in the inner sandbox stage" thrown in openai/codex.

Source

Thrown at codex-rs/linux-sandbox/src/linux_run_main.rs:177

pub fn run_main() -> ! {
    let LandlockCommand {
        sandbox_policy_cwd,
        command_cwd,
        permission_profile,
        use_legacy_landlock,
        apply_seccomp_then_exec,
        allow_network_for_proxy,
        proxy_route_spec,
        verify_fd_mounts,
        no_proc,
        command,
    } = LandlockCommand::parse();

    if command.is_empty() {
        panic!("No command specified to execute.");
    }
    if !apply_seccomp_then_exec && !verify_fd_mounts.is_empty() {
        panic!("--verify-fd-mount is only supported in the inner sandbox stage");
    }
    ensure_inner_stage_mode_is_valid(apply_seccomp_then_exec, use_legacy_landlock);
    let EffectivePermissions {
        permission_profile,
        mut file_system_sandbox_policy,
        network_sandbox_policy,
    } = resolve_permission_profile(permission_profile).unwrap_or_else(|err| panic!("{err}"));
    ensure_legacy_landlock_mode_supports_policy(
        use_legacy_landlock,
        &file_system_sandbox_policy,
        network_sandbox_policy,
        &sandbox_policy_cwd,
    );

    // Inner stage: apply seccomp/no_new_privs after bubblewrap has already
    // established the filesystem view.
    if apply_seccomp_then_exec {
        if let Err(err) = crate::fd_mount::verify_fd_mounts(&verify_fd_mounts) {

View on GitHub (pinned to 339751715c)

When it happens

Trigger: Thrown at codex-rs/linux-sandbox/src/linux_run_main.rs:177 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of openai/codex@339751715c (2026-08-25). Data as JSON: /api/errors/4a2f5a0f87f8af4a. Report an issue: GitHub.