Install Codex on Linux and WSL2

Two verified install paths on Linux: the npm package or the prebuilt binary. Either one needs bubblewrap present for the sandbox to work, so install that in the same sitting.

npm install -g @openai/codex
sudo apt install bubblewrap
codex

That’s the whole thing on Debian or Ubuntu. On Fedora it’s sudo dnf install bubblewrap (sandboxing docs).

Install on native Linux

1. Get Codex. npm install -g @openai/codex is the simplest. If you’d rather skip Node, download the musl tarball from the latest GitHub release: codex-x86_64-unknown-linux-musl.tar.gz for x86_64 or codex-aarch64-unknown-linux-musl.tar.gz for arm64. Extract it, rename the single binary to codex, and put it on your PATH (README).
2. Install bubblewrap. Since CLI 0.115 the Linux sandbox is bubblewrap (bwrap), and Codex uses the first bwrap it finds on your PATH. Without one it falls back to a bundled helper that still needs unprivileged user namespaces (linux-sandbox README). Run sudo apt install bubblewrap.
3. Start it. Run codex in your project directory and sign in.

Running under WSL2

WSL2 takes the exact same path as native Linux: install the CLI, install bubblewrap, run codex (sandboxing docs).

WSL1 is the trap. It worked through CLI 0.114, then 0.115 moved the sandbox to bwrap, and WSL1 can’t create the user namespaces bwrap needs, so Codex now rejects sandboxed shell commands there (PR #17559). If shell commands started failing right after an update, that’s the cause. Move to WSL2:

wsl -l -v          # check which version each distro is on
wsl --set-version <distro> 2

Keep your code off /mnt/c

Run Codex against files in your Linux home (~), not the Windows mount at /mnt/c. Every file operation under /mnt/c crosses the Windows/Linux boundary, and that path runs at a small fraction of native speed (microsoft/WSL #4197). Codex reads and writes a lot of files per run, so a repo living on /mnt/c makes everything drag. Clone into ~/projects instead.

If it fails

• bwrap: Creating new namespace failed or bwrap: Unknown option --argv0 right after upgrading to 0.115 usually means you’re on WSL1, not WSL2 (issue #16076). Switch to WSL2.
• Sandbox warnings on Ubuntu 24.04 even with bubblewrap installed: 24.04’s AppArmor blocks the user namespace. Load the restrict profile, then Codex can start the sandbox:

sudo apt install apparmor-profiles apparmor-utils
sudo install -m 0644 /usr/share/apparmor/extra-profiles/bwrap-userns-restrict /etc/apparmor.d/bwrap-userns-restrict
sudo apparmor_parser -r /etc/apparmor.d/bwrap-userns-restrict

Ubuntu 25.04 handles this on its own (sandboxing docs).

• Still stuck on sandbox startup? See sandbox error: retry without sandbox?.

Related

• Install Codex on Windows — native is the default on Windows; WSL is for Linux-native tooling.
• sandbox error: retry without sandbox?
• sandbox_mode config