Codex CLI sandboxing
Codex CLI's built-in sandbox: Seatbelt on macOS, bubblewrap on Linux/WSL2 and a native Windows sandbox, with read-only, workspace-write and full-access modes. Solid built-in confinement for Codex CLI across all three desktop platforms; it is a CLI feature, not a reusable sandbox.
Overview
Codex CLI, OpenAI's open-source coding agent "that runs locally on your computer", applies an OS sandbox to every command it spawns, including git, package managers and test runners. On macOS it "works out of the box using the built-in Seatbelt framework"; on Linux and WSL2 it needs bubblewrap (bwrap), using the first on PATH or a bundled helper that requires unprivileged user namespaces (Ubuntu 24.04 may need AppArmor changes); on Windows it offers a native sandbox with three implementations, mxc (recommended on Windows 11 24H2/25H2 builds that have it), elevated (dedicated low-privilege users, the "preferred legacy fallback") and unelevated (restricted token).
Three modes govern scope: read-only, workspace-write (the default low-friction mode) and danger-full-access, which "runs without sandbox restrictions". Approvals (on-request, never, with an approvals_reviewer option) are a separate control. The Windows page does not label the sandbox experimental; the Linux mechanism documented is bubblewrap rather than Landlock/seccomp. The repository is Apache-2.0.
Notable
- Sandbox modes: read-only, workspace-write (default), danger-full-access; approval policies on-request and never
- Windows native sandbox with mxc (recommended), elevated and unelevated implementations; Windows 11 recommended, Windows 10 1809+ best effort
- Linux/WSL2 sandbox depends on bubblewrap and unprivileged user namespaces
Codex CLI sandboxing specifications
| Attribute | Details |
|---|---|
| Isolation | macOS: built-in Seatbelt framework; Linux and WSL2: bubblewrap (bwrap) from PATH or a bundled helper that needs unprivileged user namespaces; Windows: native sandbox with mxc process isolation (recommended), elevated lower-privilege sandbox users, or an unelevated restricted token |
| Deployment | Local / OS-level |
| Open source | Yes (Apache-2.0) |
| SDKs and interfaces | CLI |
| Cold start (vendor claim) | Not documented |
| Max session length | Not documented |
| Persistence | Works directly on the host workspace; workspace-write confines edits to the workspace, read-only requires approval to edit or run commands |
| GPU | Not documented |
| Networking | The sandbox controls "whether commands can use the network"; approval policy can "Always ask to edit external files and use the internet"; in ChatGPT Work "Allow public internet access" is off by default with a managed hostname allowlist |
| Pricing | Free, open-source CLI; use requires a ChatGPT plan or API key |
| Free tier | Not documented |
| Compliance | Not documented |
| Regions | Not documented |
Facts from Codex CLI sandboxing’s public documentation, verified November 9, 2026. Performance numbers are vendor claims.
Strengths and trade-offs
Strengths
- You use Codex CLI and want default confinement with no containers
- You need a native Windows sandbox, not just WSL2
- You want network use gated by approvals or an allowlist
Trade-offs
- OS-level sandboxing shares the host kernel; full-access mode removes all boundaries
- Linux requires bubblewrap and user-namespace support; Windows mxc needs specific recent builds
- Windows unelevated mode has weaker network isolation and no denied read paths
Good fit for: Confining Codex CLI command execution on macOS, Linux or Windows without containers.
Use cases Codex CLI sandboxing fits
- Local agents: Codex CLI’s built-in sandboxing: Seatbelt on macOS, bubblewrap on Linux and WSL2, and a native Windows sandbox, with no containers.
How Codex CLI sandboxing compares
| Sandbox | Isolation | Open source | Self-host / BYOC | Cold start (vendor) | Max session | Snapshots / pause | GPU | SDKs |
|---|---|---|---|---|---|---|---|---|
| Codex CLI sandboxing | Seatbelt / bubblewrap / Windows | Yes | No / No | Not documented | Not documented | No / Not documented | Not documented | CLI |
| Gemini CLI sandboxing | Seatbelt or container | Yes | No / No | Not documented | Not documented | No / Not documented | Not documented | CLI |
| Anthropic Sandbox Runtime | OS-level (Seatbelt / bubblewrap) | Yes | Yes / Not documented | Process start | Not documented | No / No | Not documented | CLI (srt), TypeScript (npm) |
| nono | Landlock / Seatbelt | Yes | No / No | Not documented | Not documented | Yes / Not documented | Not documented | CLI, Rust, Python, JavaScript/TypeScript, Go |
| Minimal | namespaces or libkrun microVM | Yes | No / No | Not documented | Not documented | Not documented / Not documented | Not documented | CLI, MCP server |
| bubblewrap | Linux namespaces | Yes | Yes / No | Not documented | Not documented | No / No | Not documented | CLI |
| Windows Sandbox | Hyper-V lightweight VM | No | No / No | A few seconds | Until closed | No / No | Yes | CLI |
Frequently asked questions
What is Codex CLI sandboxing?
How does Codex CLI sandboxing isolate code?
Is Codex CLI sandboxing open source?
How much does Codex CLI sandboxing cost?
What are the alternatives to Codex CLI sandboxing?
Sources
Cite this page
Agent Sandboxes. (2026). Codex CLI sandboxing. agentsandboxes.org. Last reviewed November 9, 2026. https://agentsandboxes.org/sandboxes/codex-cli-sandbox/
Found an error or a missing sandbox? Submit a correction — every entry links to the sources it relies on.