How do I install the Codex Container Sandbox skill?

Run npx skillmds add majiayu000/codex-container-sandbox in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Codex Container Sandbox safe to use?

This skill has not completed SkillMD's automated safety review yet. Capability flags: reads secrets. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Codex Container Sandbox?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Codex Container Sandbox free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Codex Container Sandbox?

majiayu000 (@majiayu000) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Codex Container Sandbox by majiayu000

Name: Codex Container Sandbox
Rating: 4.666666666666667 (3 reviews)
Author: majiayu000

Codex Container Sandbox

Run Codex CLI inside a Podman container with full internet access but filesystem exposure limited to the repo root + explicit bind mounts; use when you want yolo/web-search without giving the agent access to your whole host filesystem.

majiayu000 c078fbd 2 files · 3.1 KB Updated Sep 9, 2026 567 repo stars

File contents

codex-container-sandbox

Use this when you want:

Full egress/network for codex (web search, fetching, etc.)
Tight filesystem boundaries via container bind mounts (repo root + explicit allowlist)

This repo contains a wrapper script intended to be installed as codex-container-sandbox.

Workflow

Build the image

From the repo root (this repository):

podman build -t localhost/codex-container-sandbox:latest -f Containerfile .

Install the wrapper

install -m 0755 codex-container-sandbox ~/.local/bin/codex-container-sandbox

(Optional) Configure extra mounts

Create ~/.config/codex-container-sandbox/config.sh:

CODEX_CONTAINER_SANDBOX_IMAGE="localhost/codex-container-sandbox:latest"

# Extra read-only mounts (mapped under /home/codex/... if under $HOME)
CODEX_CONTAINER_SANDBOX_RO_MOUNTS=(
  "$HOME/.local/bin"
)

# Extra read-write mounts
CODEX_CONTAINER_SANDBOX_RW_MOUNTS=(
  "$HOME/.cache/uv"
  "$HOME/tmp"
)

Login once inside the container

codex-container-sandbox --shell
codex login

Run the self-test (recommended)
```
./selftest.sh
```
If this repo is vendored as a git submodule at ./codex-container-sandbox/ (for example in a dotfiles repo), either:
- cd codex-container-sandbox && ./selftest.sh, or
- run ./codex-container-sandbox/selftest.sh from the parent repo root.

Run Codex

codex-container-sandbox exec "Summarize this repo"

Safety notes

This wrapper runs Codex in full-yolo mode (--dangerously-bypass-approvals-and-sandbox) with full networking. Anything mounted into the container can be exfiltrated.
Keep mounts minimal; do not mount secrets, password stores, SSH keys, or large chunks of $HOME unless you intend to expose them.

---name: codex-container-sandboxdescription: Run Codex CLI inside a Podman container with full internet access but filesystem exposure limited to the repo root + explicit bind mounts; use when you want yolo/web-search without giving the agent access to your whole host filesystem.--- # codex-container-sandbox Use this when you want: - Full egress/network for `codex` (web search, fetching, etc.) - Tight filesystem boundaries via container bind mounts (repo root + explicit allowlist) This repo contains a wrapper script intended to be installed as `codex-container-sandbox`. ## Workflow 1. **Build the image** From the repo root (this repository): ```bash podman build -t localhost/codex-container-sandbox:latest -f Containerfile . ``` 2. **Install the wrapper** ```bash install -m 0755 codex-container-sandbox ~/.local/bin/codex-container-sandbox ``` 3. **(Optional) Configure extra mounts** Create `~/.config/codex-container-sandbox/config.sh`: ```bash CODEX_CONTAINER_SANDBOX_IMAGE="localhost/codex-container-sandbox:latest" # Extra read-only mounts (mapped under /home/codex/... if under $HOME) CODEX_CONTAINER_SANDBOX_RO_MOUNTS=( "$HOME/.local/bin" ) # Extra read-write mounts CODEX_CONTAINER_SANDBOX_RW_MOUNTS=( "$HOME/.cache/uv" "$HOME/tmp" ) ``` 4. **Login once inside the container** ```bash codex-container-sandbox --shell codex login ``` 5. **Run the self-test (recommended)** ```bash ./selftest.sh ``` If this repo is vendored as a git submodule at `./codex-container-sandbox/` (for example in a dotfiles repo), either: - `cd codex-container-sandbox && ./selftest.sh`, or - run `./codex-container-sandbox/selftest.sh` from the parent repo root. 6. **Run Codex** ```bash codex-container-sandbox exec "Summarize this repo" ``` ## Safety notes - This wrapper runs Codex in full-yolo mode (`--dangerously-bypass-approvals-and-sandbox`) with full networking. Anything mounted into the container can be exfiltrated. - Keep mounts minimal; do not mount secrets, password stores, SSH keys, or large chunks of `$HOME` unless you intend to expose them.

Frequently asked questions