sbx/codex-kit:latest

schemaVersion: "2"
kind: sandbox
name: codex
version: 1.0.0
displayName: Codex
description: OpenAI Codex CLI, OpenAI's agentic coding CLI.
sandbox:
    image: docker.io/sbx/codex-image:latest
    entrypoint:
        - codex
    command:
        default:
            - --dangerously-bypass-approvals-and-sandbox
        interactive:
            - --dangerously-bypass-approvals-and-sandbox
agentInstructions:
    filename: AGENTS.md
permissions:
    network:
        allow:
            - api.openai.com
            - openai.com
            - auth.openai.com
            - chatgpt.com
            - files.openai.com
            - '*.chatgpt.com'
            - '*.oaiusercontent.com'
            - registry.npmjs.org
            - releases.openai.com
            - api.github.com
            - github.com
            - codeload.github.com
            - archive.ubuntu.com
            - security.ubuntu.com
            - ports.ubuntu.com
            - download.docker.com
credentials:
    - service: openai
      apiKey:
        name: OPENAI_API_KEY
        inject:
            - domain: api.openai.com
              header: Authorization
              format: Bearer %s
            - domain: openai.com
              header: Authorization
              format: Bearer %s
      oauth:
        tokenEndpoint:
            host: auth.openai.com
            path: /oauth/token
        resourceHosts:
            - chatgpt.com
        sentinels:
            accessToken: oai-oat01-proxy-managed
            refreshToken: oai-ort01-proxy-managed
        skipIfEnv:
            - OPENAI_API_KEY
environment:
    variables:
        BROWSER: xdg-open
        CODEX_HOME: /home/agent/.codex
        GIT_TERMINAL_PROMPT: "0"
setup:
    install:
        - command: |
            set -e
            # ~/.codex is CODEX_HOME; ~/.agents is where Codex looks for the
            # cross-agent skills tree (~/.agents/skills). Both are created up
            # front so nothing later has to create them as root.
            mkdir -p /home/agent/.codex /home/agent/.agents
            MODE="${SBX_CRED_OPENAI_MODE:-none}"
            cat > /home/agent/.codex/config.toml << 'EOF'
            # Codex configuration for a Docker sandbox.
            # The container is the sandbox, so Codex's own approval gate and
            # filesystem sandbox are turned off: there is nobody to answer a
            # prompt, and the isolation is already provided from the outside.

            approval_policy = "never"
            sandbox_mode = "danger-full-access"
            mcp_oauth_credentials_store = "file"
            EOF
            # In a managed mode the placeholder in auth.json is the whole auth
            # story, so a remote client must not be able to replace it with a
            # sandbox-local ChatGPT login. `none` mode deliberately permits that
            # login — it is the only way to authenticate at all there.
            case "$MODE" in
              oauth|apikey)
                cat >> /home/agent/.codex/config.toml << 'EOF'
            forced_login_method = "api"
            EOF
                ;;
            esac
            if [ "$MODE" = oauth ]; then
              cat >> /home/agent/.codex/config.toml << 'EOF'

            model_provider = "sandboxd"

            [model_providers.sandboxd]
            name = "Sandbox Proxy"
            base_url = "https://chatgpt.com/backend-api/codex"
            experimental_bearer_token = "oai-oat01-proxy-managed"
            requires_openai_auth = false
            EOF
            fi
            case "$MODE" in
              oauth|apikey)
                cat > /home/agent/.codex/auth.json << 'EOF'
            {
              "OPENAI_API_KEY": "proxy-managed"
            }
            EOF
                ;;
              *)
                rm -f /home/agent/.codex/auth.json
                ;;
            esac
          user: agent
          description: Seed Codex config/auth from SBX_CRED_OPENAI_MODE
    startup:
        - command:
            - sh
            - -c
            - command -v apt-get > /dev/null 2>&1 && (apt-get update -qq -y > /dev/null 2>&1 || true) &
          user: root
          description: Update apt package cache in background
        - command:
            - sh
            - -c
            - |
              set -e
              [ -n "$MCP_GATEWAY_URL" ] || exit 0
              mkdir -p "$HOME/.codex"
              cfg="$HOME/.codex/config.toml"
              touch "$cfg"
              grep -q "^\[mcp_servers.mcp-gateway\]" "$cfg" && exit 0
              cat >> "$cfg" <<EOF

              [mcp_servers.mcp-gateway]
              type = "http"
              url = "$MCP_GATEWAY_URL"
              [mcp_servers.mcp-gateway.http_headers]
              Authorization = "Bearer $MCP_SENTINEL_TOKEN_NAME"
              EOF
          user: agent
          description: Register the sandbox MCP gateway in ~/.codex/config.toml